This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
About Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.

Discussions

Start a conversation

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4688 Views
  • 0 replies
  • 1 Likes

Tenant ID change on NGFW

Hi all, We have a set of NGFWs that somehow are pointed to an old tenant ID and therefor not dropping the logs into the CDL. We have put in a TAC case but haven't gotten any resolution as of yet. Is there a way in the CLI to change the tenant ID? Or is this a log forwarding profile issue? Any assistance would be helpful.

2 PA-850s and 1 PA-440

Hi,I received a quote from a supplier for 2 PA-850s with Wildfire , Partner enabled premium support and GlobalProtect subscription.Then for the PA - 440 - Wildfire , GlobalProtect , advanced Url filtering , advanced threat protection and premium support.As far as i can tell they want to run 2 separate networks with the same level of protection o...

Calc66 by • L1 Bithead
  • 5230 Views
  • 5 replies
  • 0 Likes

Resolved! Palo Alto NGFW: LDAP authentication with DUO/OKTA MFA

Hi, We have a got a new Palo Alto NGFW in our Premises and configured with LDAP for authentication. Things were good with LDAP for authentication until we started looking for MFA. I couldn't find any document to have LDAP and DUO/OKTA for MFA. As this is my first firewall configuration, it hits me so hard. Can someone help me with this? Thanks...

jeromej by • L1 Bithead
  • 4846 Views
  • 2 replies
  • 0 Likes

User-ID with Azure AD

Hey all, I've set up User-ID with on-prem AD servers a few times - quite straightforward. My question is, how do I set up User-ID when my customer uses Azure AD (with no on-prem servers)? I need to someone get the user-to-IP mappings on the firewall but pulled from Azure AD but not sure how its done. I did see/hear about the "Cloud Identity En...

Palo Alto New User ID Agent Adding to Firewall

Hi All, We want to add new User ID Agent to our Palo Alto Firewalls and remove the existing user ID Agent from Firewalls. The reason is the current User-ID Agent is hosted on Window 2012 and we are going to decom that Window server. We will install new user ID Agent on new Window Server 2022. We already successfully added new User-ID Agent on Fi...

EvanRaci by • L1 Bithead
  • 1600 Views
  • 1 replies
  • 0 Likes

Palo Alto Site to Site IPsec VPN went down

Hi , We've setup Site to Site IPsec VPN between Palo Alto Firewalls. The tunnel was up and working but it went down after some time. Look like the tunnel went down because there is no traffic passing through the tunnel. Everytime we need to trigger IPsec tunnel by using >test vpn ike-sa gateway to bring up. How can we configure the tunnel t...

EvanRaci by • L1 Bithead
  • 2655 Views
  • 2 replies
  • 0 Likes

VPN internet access

I have set my VPN access with no split tunnel so the users gets their internet access through the access through the VPN. Even though I cloned the security rule to the internet from the one used when you are onsite, it does not give the same access to those on the VPN and I need access via vpn to be exactly the same as onsite. Let me know if any...

Resolved! Palo PA-450 High Availability ports

Hello everyone, wanted to deploy a pair of PA-450s in HA and I understand there are no dedicated HA ports on this model so we need use data ports - I could not find a deployment guide for the PA-450 to address HA specifically and I assume you could use any data port but does anyone have any experiences when selecting ports for HA? does it matter...

bormanb by • L0 Member
  • 6756 Views
  • 3 replies
  • 0 Likes

TCP-RST-from-CLIENT

Hi Friends, We have a requirement we have cloud server Oracle cloud When ever user from LAN tries to access the resources over the cloud user is able to login but unable to access any resources. While checking in logs it is showing tcp-rst-from-client. I am attaching the screenshot and session flow for reference. I am also attaching the wire s...

Screenshot (207).png
Screenshot (209).png
Satyak by • L3 Networker
  • 6248 Views
  • 2 replies
  • 0 Likes

HSCI port - 5410

Hello All, I'm trying to spec the SFP's for PA-5410's & per the below documentation. https://docs.paloaltonetworks.com/hardware/pa-5400-hardware-reference/pa-5400-series-firewall-overvi... The HSCI port is a 40G port & Palo Alto Networks recommends that you use an active or passive QSFP+ cable. As per the below documentation of P...

Resolved! Not updating low traffic session status with hw offload enabled

PA-32xx series with 10.1.9 (issue showed up after upgrade) There is long-lasting SSH session where only something like keepalive is sent every 5 minutes or so. With hardware offload enabled, this traffic is not registered in the dataplane (session stats are not increasing even though there is traffic for that session) and subsequently TTL is not...

nikoo by • L3 Networker
  • 4752 Views
  • 3 replies
  • 0 Likes

snmp configuration question

as we all know , snmp can be configure at Setup -> Operiations ->SNMP Setup the snmp community string default is "public" I would like to ask 1. this is the read-only string or the read-write string ? 2. do we set the read-only string for the device ?

Multiple vsys share one pair of WAN circuits?

I have 4 vsys that are currently using individual ports to connect to the WAN circuits. I need to free up ports for additional vsys, and would like a shared circuit port for the multiple vsys to use. I've tried a layer 3 interface with sub interfaces, one for each vsys, tagged vlans 11,12,13,14 for example, trunked to a switch, but I'm getting p...

ZNetEng by • L0 Member
  • 1481 Views
  • 1 replies
  • 0 Likes

IPSec VPN Negotiation Issues

Dear Members, Greeting to All! Curranty, I'm using site to site multiple VPN configuration with Palo alto Firewall to different vendor site. All of the tunnel is working fine VPN ok. My main problem is inside of my firewall public internet down then coming to UP in case, Some of the tunnel is came to up and show green. But one of the tunnel st...

Url access error

Hello Team, I am getting this error in the EDL, also confirm URL and certificate are correct.Gone thorough this kb : https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-release-information/known-issues/known-issues-related-to-pan-os-9-1-releases/pan-os-9-1-13-known-issues#idd45332c3-ff37-42df-a84c-a418356feb7d ---- ...

SKumarDoli_0-1685509176196.png
  • 1606 Posts
  • 61 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks