Next-Generation Firewall Discussions

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Wrong Geo location

Hello, couple times we had issue with wrong geolocation. It is very interesting how PaloAlto create ip<->location database. example: from FW: show location ip 46.8.61.78 46.8.61.78Czech Republic regarding https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPtECAW and any other geolocation service it is russian add...

GRE Tunnel and Multicast Traffic

Hi Everyone, Hi Team,We have been trying to configure GRE tunnel. From the configuration end, everything seems fine and we have already followed the official KBs but GRE tunnel nevers gets up. And this is affecting our multicast traffic flow. Same thing works fine from one of our Lab Firewall, GRE tunnel gets up and we can ping the client's en...

Resolved! Upgraded pa820 to 10.2.7, no acc info showing

Hi all, I upgraded our PA820 to 10.2.7, and somehow now the acc tabs don't show any information, in network, threats, blocked, only in globalprotect it shows data, I searched and found some information on the release notes, as well as searched around the web, found some talk about issues with PAN-OS 10.2.7. So there's bugs in 10.2.7 mainly in...

DNS Security cloud service connection refused

we facing problem since this morning DNS Security cloud service connection refused is this any global outage. Thanks Naeem

PA-450R supported SFP

Hi Chapms, Can you pls let me know if the PA-450R support the following. PAN-SFP-LX PAN-SFP-SX PAN-SFP-100BASE-FX

SSL Termination at Palo Alto NGFW

Can Palo Alto NGFW support SSL TerminationConsumerAPP (2Way SSL) --> Palo Alto NGFW support --> (1Way) to Service provider

Documentation on the setting "Software Cut Through"

Hi, I can't seem to find any info on the setting "Software Cut Through". It's currently set to true on our PA-460. Would that affect the performance of our firewall ? Thank you, Antonio

Palo Alto (KVM) VM-Series 30-day free trial Issues

Hello Team, Please I need help installing the KVM series NGFW evaluation copy on my laptop running EVE-NG on top of VMware workstation. I tried installing it, however it started showing errors and will not allow me login using the default username/password of admin/admin profile. Please find below the errors I am experiencing. 2023-12-09 19:51...

Custom Log Format when sending to Kiwi Syslog

Has anyone configured or have the format that makes traffic logs look more readable when sending to kiwi syslog?

PA-3260 best equivalent model

We need to replace our current Paloalto firewall device which is PA-3260 ,so what is best equivalent model.

Resolved! Security Policy

Hello, I have created a security policy with the below details. I am the hitting following URL https://10.x.x.x:15671 and I see the 'connection is reset' in the browser. I see traffic is hitting the policy (Hit count) but it's not logging. When I set the action to Deny/Drop/reset-client\reset-server the traffic is logging when hits the rule. W...

Demystifying the SSL Decryption on Palo Alto Firewall

On Palo Alto Firewall there are two ways to do SSL Decryption (two actions in the Decryption Policy). SSL Forward Proxy: for outbound connection (from an inside PC to an external server). Used for traffic to external servers PA Firewall splits the original session into two: client<—>PA<—>server The original server certificate is...

Interzone Default Logging not logging

I have enabled logging but it doesn't work.default-security-rules {rules {interzone-default 22c86a38-051f-4d34-9fba-e1867d4830a3 {action deny;log-start no;log-end yes; It shows it was hit twice. (see attached image)

URL Filtering to block Facebook

Hi all, I been testing to do URL filtering with whitelist approach (allow some URL and block everything) and also create SSL decrypt policy. As I was checking, it seems like not working to block facebook. I check in the test a site, Facebook fall under social-networking. When I check the log, there is no log under URL filtering that is hittin...

Commit job was not queued. Client logrcvr not connected. All daemons are not available. in 11.1.0

I tried to commit a change to a pa440 and now getting Commit job was not queued. Client logrcvr not connected. All daemons are not available. has any one else had this.

Discussions

Welcome to the Next-Generation Firewall Discussions!

Wrong Geo location

GRE Tunnel and Multicast Traffic

Resolved! Upgraded pa820 to 10.2.7, no acc info showing

DNS Security cloud service connection refused

PA-450R supported SFP

SSL Termination at Palo Alto NGFW

Documentation on the setting "Software Cut Through"

Palo Alto (KVM) VM-Series 30-day free trial Issues

Custom Log Format when sending to Kiwi Syslog

PA-3260 best equivalent model

Resolved! Security Policy

Demystifying the SSL Decryption on Palo Alto Firewall

Interzone Default Logging not logging

URL Filtering to block Facebook

Commit job was not queued. Client logrcvr not connected. All daemons are not available. in 11.1.0

Palo Alto 820 - Software Update for CVE-2026-0300

In PAN version 9, public IP addresses and the VPN were accessible from the Intranet.

PAN-OS HA UGRADE PATH

Unable to find "Hide My IP" application on firewall (Applipedia shows it exists

HSCI port - amber blinking LED on both primary and secondary devices (5445)

Re: Unable to find "Hide My IP" application on firewall (Applipedia shows it exists

Re: Azure "az" command and decryption

Re: Azure "az" command and decryption

Re: HA failover on Acitve Passive concerns

Rapid7 Insight Agent not showing as vendor in HIP Object Anti-Malware tab despite OPSWAT V4 support

Unlock your full community experience!

Resolved! Upgraded pa820 to 10.2.7, no acc info showing

Resolved! Security Policy