Multiple Virtual Routers on SD-WAN Hub NGFW models supported

Hello! Is the feature "Multiple Virtual Routers on SD-WAN Hub" supported for virtual software NGFW and PA-1410, 1420 hardware NGFW? There are supported models started from PA-3400 only. https://docs.paloaltonetworks.com/sd-wan/3-2/sd-wan-admin/configure-sd-wan/configure-multi-vr-on-sd-wan-hub Thanks.

IPsec Tunnel Down!

Hi Team, I'm a newbie at the Palo Alto firewall, and I've been checking the IPsec connection between PA850 at my sites. I'm encountering issues with the IPsec tunnel, which is not coming up. I tried establishing IPsec using the IP used for BGP peering, and it established without any problems. However, the problem arises when I us...

CPU on 3250 series is between 50% and 60%

Hello, We have a problem , where the DP CPU is between 50% and 60% . We want to know the root cause . we investigated the resources consumption and everything is normal. How can we investigate the if the problem is related to a specific traffic?

Firewall Backup Script using powershell

Hi Team, Does anyone having a working powershell script for to export the running config from firewall using API.

stable version for pan 10.2 or 11

Hello Team, Currently we have virtual firewall vm100 with version 10.1.5-h1, I want to update it to 11 version. Could you please let us know the stable version for pan 10.2 or 11.

Decryption: Received fatal alert CertificateUnknown from client

Hi Folks, I'm seeing some instances of "Received fatal alert CertificateUnknown from client" errors in the decryption log when the root\issuer certs are clearly in the FW's cert store. Attached are screenshots of the error and the FW's cert store. Any ideas on what could be going wrong here? I'm seeing this on PAN OS 11.0.2-h3 & 10.2.7-h3...

Firewallcrash because of Application cloud Engine (ACE)

Hi community Since about 2 weeks a vm firewall started getting problems with random crashes. Our setup is a firewallcluster but so far the active firewall crashes almost completely silent. At least the firewall does not initiate a failover to the passive node. So far we had about 4 crashes at random times and in one case the firewall crashed "...

About certificate

Migrating configuration from the firewall running PAN-OS 9.1 to new firewall running PAN-OS 11.1 directly

Hi LIVEcommunity I plan to migrate the configuration from a PA-3020 firewall currently running PAN-OS 9.1 to a new PA-1410 firewall running PAN-OS 11.1. I'd like to know if it's possible to directly import the configuration from the older firewall to the newer one, despite the difference in PAN-OS versions. If direct import isn't recommend...

Zscaler Traffic Pattern

My company users are using ZCC on their laptops. Recently, there has been an issue where Zscaler traffic is being denied by the Palo Alto Firewall.Upon checking the logs, it appears that the ZCC traffic pattern changed into web browsing and HTTP Proxy, which is being denied by the firewall. We have configured the firewall to allow Zscaler Privat...

Unable to Block Personal Gmail on Ubuntu Machines.

Hi Friends, We have a customer who is facing issues in blocking Personal Gmail on Ubuntu Machines. I have followed the below mentioned discussion and created the URL filtering and Policies. https://live.paloaltonetworks.com/t5/general-topics/block-access-to-private-gmail-but-allow-corporate/td-p/195686 Personal Gmail is blocking as expected ...

FW Policy Skipped When Either App-Based only or SMTP-BASE app and 587 Port is Defined

Firewall is skipping policy when the traffic has smtp-base port 587 on it. I created a firewall policy application based with smtp-base as application but it skips the policy goes to the implicit interzone deny policy. So I created it with by just port based, 587, it sill skips the policy and goes to interzone default deny. So I explicitly defin...