This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
About Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.

Discussions

Start a conversation

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4779 Views
  • 0 replies
  • 1 Likes

Azure "az" command and decryption

Hello, All. Working on Windows. A few days ago, tried to understand why the Microsoft Azure CLI "az" command line program was not working with decryption behind our PAN OS 10.2.10. Azure CLI is a python tool. I am currently running v2.77 (latest) I added the root CA to C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\cacer...

Rievax by • L2 Linker
  • 5989 Views
  • 5 replies
  • 0 Likes

Not able to log XFF (Actual Client IP) in PaloAlto Logs even when we enable XFF and URL filtering profile in Palo's

Issue Summary – XFF Not Logged on Palo Alto (Even With Decryption ON) We are running a flow where AWS ALB inserts X-Forwarded-For (XFF) and the Palo Alto firewall performs SSL decryption + re-encryption: Flow:Client --> Internet --> AWS ALB (HTTPS) (Palo's are registered as TG IP) --> Palo Alto FW (SSL Decrypt) --> Server What worksA...

Difference in Session Synchronization configuration output in PAN-OS 11.2 Active/Passive HA

Hello experts, I would like to confirm the HA configuration behavior in PAN-OS 11.2.We have two firewalls configured in an Active/Passive HA pair. In the GUI, Enable Session Synchronization is enabled on both devices.However, when checking the configuration from the CLI, the following line is displayed on one device: ”set deviceconfig high-avail...

EDL Scalability & Platform Limits – Best Practices

Hello Everyone, Looking for best practice recommendations on handling large IP-based External Dynamic Lists (EDLs). In cases where the EDL reaches platform limits (e.g., ~150K IPs), scalability becomes a challenge, especially when continuous updates are required and manual handling is not practical. Would appreciate your input on: More scalable...

A.AlHafi by • L1 Bithead
  • 579 Views
  • 1 replies
  • 0 Likes

Resolved! Reason: Authentication profile not found for the user

local admin created with authentication profile set to none but still PaloAlto is looking for authentication profile for this local user and not allowing to login, saying invalid username/password and here at FW end we are getting the log- Reason: Authentication profile not found for the userPAN OS - 11.1.10-h1 - Is this is a bug in this version...

Why would an active firewall in an active-passive HA configuration broadcast gratuitous ARPs every 60 seconds?

I found a KB article stating that the active firewall sends out gratuitous ARPs every 60 seconds during normal operation, but it doesn't explain why. What is the reason for this behaviour? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004Ny3CAE

HA failover on Acitve Passive concerns

Hello all, I would like to get some idea/thoughts about the current setup on my two PA1410 Active/Passive FW failover concerns. Few weeks ago, our Active FW has some issues and hung on the data plane. I found there was some missing configurations on our network side so the Failover didn't work at all. So eventually I resumed it, and raised the...

VPN peer ID

Hi guys, we have a 3rd party VPN peer who must set the Peer Identification value, the tunnel works fine, but on their side the tunnel ID IP address can change depending on whether they are on their active or standby firewall, and that means we need to update config and push policy to get it online (this is a regular occurrence) I thought abo...

Firwall is uable to send logs to the Panorma (Log collector is showing inactive)

Hi Team, I am currently managing multiple firewalls through Panorama; however, one of the HA firewalls is not forwarding logs to Panorama. Please find the CLI output below for your reference. show logging-status -----------------------------------------------------------------------------------------------------------------------------Type Las...

Increasing config size beyond max reccomended values 450s

Hi I have a customer who is getting the following alert on their Palo Alto PA-450 on 11.1.13, I believe these alerts have come about with new features on 11.1. To try and clear error we have set to the max recommended configuration file size per this article for the model. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1...

HMcGoldrick_0-1775642951067.png
  • 1632 Posts
  • 62 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks