Using Captive portal and Azure AD for user network authentication

Is there any documentation available on how to achieve this for general user network access? I assume the network has to be set up with a captive portal, but traffic to identity provider for SAML exchange need to be allowed even before the user gets

Certificate revocation / OCSP not working

I've set up one of our PAs (a 5260 running 10.1.6-h3) to use as a certificate authority and OCSP responder for use with GlobalProtect remote access. I'm able to issue and verify certificates with no problem, but revoking a client certificate has no e

Clientless VPN for SQL Traffic?

I have users at a development partner company who need to access a dev SQL instance. So they need TCP 1433 to one server. I would like to restrict access to their corporate public NAT IP and require that they use AD credentials. But it would be prefe

Bypass the url filtering

Hi everyone

Can bypass the url filtering by changing the URL in HTTP get request ?
For example
Firewall rule deny connect to url deny.com and allow url allow.com
User try to connect to deny.com with IP adress a.b.c.d, user add item the host file or usin

unknown traffic pcaps just stopped happening one day around 2 weeks ago

I have a PA-460 that stopped doing pcaps for unknown traffic about two weeks ago.  I played around with the application dump setting and I think I may have broken something:

Application setting:
Application cache : yes
Supernode : yes
Heuristics : yes

Routing issue on Multi VSys PA Firewall integrated with Cisco ACI

Hello,

We have multi Vsys firewall to handle North-South and East-West traffic, which is integrated with Cisco ACI. The virtual router is configured with static route 0.0.0.0/0, next hope as Cisco ACI.

We are seeing some North-South traffic on Ea

sometimes the policy matched the multicast packets and sometimes it didn’t when each packet had the exact same source/dest IP and source/dest port?

 sometimes the policy matched the multicast packets and sometimes it didn’t when each packet had the exact same source/dest IP and source/dest port?

Some multicast traffic is allowed but other packets are denied. We need to understand why there is

site to site ipsec vpn issue

PA 3260 and VM 300 set site to site  ipsec vpn, The Ipsec vpn had been working.But from two days ago ,

it wasn't working ,can you help me to check it ?

admin@tfw001> tail follow yes mp-log ikemgr.log

tail follow yes mp-log ikemgr.log
2022-10-08 19:1

Palo firewall routing

Hello. New to Palo's. I have a question re routing.

I have an interface with, say, 1.1.1.1/24. There is a router on the same network on 1.1.1.2.

I have had to add a static route in order to ping/communicate with 1.1.1.2

Is this normal Palo beha

Lab firewall

I was told you can buy the lower model firewall license for much cheaper for learning

Is there website or how can I buy one

PA 3200 Virtual Address limit

HI,

Hi have two PAs in HA Active Active with floating IPs, and today I reach an limit:

". Error: total virtual addresses 65 exceeded platform maximum 64"

There is any workaround for this?

Thanks

Source Mac not displaying

We have multiple Paloalto firewalls running in version 10.1.X/10.2. None of them are showing the source or destination mac address in the traffic logs. When we select the source/destination mac address column in the traffic logs, it shows blank.

So

still see in logs while I already blocked it

Dears

panorama firewall logs show threat for example spyware which threat name is website link. I blocked website IP and the link but still I see it in logs.it repeated many times which full the logs .The source address from DMZ zone  and the destina