This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Scheduled Maintenance: November 14–15 (starting Nov. 14 at 12:00 AM PST)
LIVEcommunity will temporarily operate in read-only mode as we prepare to welcome Idira!
Public content will remain accessible, but log-ins, posting and community interactions will be paused during this period. Thank you for your patience!
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
About Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.

Discussions

Start a conversation

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4879 Views
  • 0 replies
  • 1 Likes

Resolved! Device Gropus: How to see previously devices

Hi,We got an RMA, but for the new fw there has not been selected any devices. It was a lot back and forth when trying to set up and add the new fw to Panorama, so in the process the old fw has been deleted from Panorama.Does anyone know if there is possible to see or find out which devices that have previously been selected in the different devi...

Using XFF for Logs Only

Hello, I have an application behind a WAF, without XFF the source IPs are always my WAF and for auditing reasons I need to get and log the real client IP addresses. Traffic flow is like this: Client -> WAN -> NAT -> DMZ - App Server My security policy only allows the communication from internal IP addresses, in this case the priva...

Security rule with URL category mixed up

Hello, We have a weird rule in our Security Rules list. Basically it's allowing any to any with some specific applications, but also a custom URL Category in "Service/URL Category" tab. So normally it should allow only the traffic hitting the URLS in this category. But it's allowing all the traffic actually that is hitting the specific a...

CTramier by • L0 Member
  • 1412 Views
  • 1 replies
  • 0 Likes

Blocking TLD mov and zip

Hello, Was wondering if PA does this automatically or if it needs to be done manually - blocking TLD .zip and .mov? We use the Advanced URL and DNS Security license as well. Thank you.

roma by • L2 Linker
  • 2030 Views
  • 1 replies
  • 0 Likes

Tenant ID change on NGFW

Hi all, We have a set of NGFWs that somehow are pointed to an old tenant ID and therefor not dropping the logs into the CDL. We have put in a TAC case but haven't gotten any resolution as of yet. Is there a way in the CLI to change the tenant ID? Or is this a log forwarding profile issue? Any assistance would be helpful.

2 PA-850s and 1 PA-440

Hi,I received a quote from a supplier for 2 PA-850s with Wildfire , Partner enabled premium support and GlobalProtect subscription.Then for the PA - 440 - Wildfire , GlobalProtect , advanced Url filtering , advanced threat protection and premium support.As far as i can tell they want to run 2 separate networks with the same level of protection o...

Calc66 by • L1 Bithead
  • 5803 Views
  • 5 replies
  • 0 Likes

Resolved! Palo Alto NGFW: LDAP authentication with DUO/OKTA MFA

Hi, We have a got a new Palo Alto NGFW in our Premises and configured with LDAP for authentication. Things were good with LDAP for authentication until we started looking for MFA. I couldn't find any document to have LDAP and DUO/OKTA for MFA. As this is my first firewall configuration, it hits me so hard. Can someone help me with this? Thanks...

jeromej by • L2 Linker
  • 5094 Views
  • 2 replies
  • 0 Likes

User-ID with Azure AD

Hey all, I've set up User-ID with on-prem AD servers a few times - quite straightforward. My question is, how do I set up User-ID when my customer uses Azure AD (with no on-prem servers)? I need to someone get the user-to-IP mappings on the firewall but pulled from Azure AD but not sure how its done. I did see/hear about the "Cloud Identity En...

Palo Alto New User ID Agent Adding to Firewall

Hi All, We want to add new User ID Agent to our Palo Alto Firewalls and remove the existing user ID Agent from Firewalls. The reason is the current User-ID Agent is hosted on Window 2012 and we are going to decom that Window server. We will install new user ID Agent on new Window Server 2022. We already successfully added new User-ID Agent on Fi...

EvanRaci by • L1 Bithead
  • 1707 Views
  • 1 replies
  • 0 Likes

Palo Alto Site to Site IPsec VPN went down

Hi , We've setup Site to Site IPsec VPN between Palo Alto Firewalls. The tunnel was up and working but it went down after some time. Look like the tunnel went down because there is no traffic passing through the tunnel. Everytime we need to trigger IPsec tunnel by using >test vpn ike-sa gateway to bring up. How can we configure the tunnel t...

EvanRaci by • L1 Bithead
  • 2815 Views
  • 2 replies
  • 0 Likes

VPN internet access

I have set my VPN access with no split tunnel so the users gets their internet access through the access through the VPN. Even though I cloned the security rule to the internet from the one used when you are onsite, it does not give the same access to those on the VPN and I need access via vpn to be exactly the same as onsite. Let me know if any...

Resolved! Palo PA-450 High Availability ports

Hello everyone, wanted to deploy a pair of PA-450s in HA and I understand there are no dedicated HA ports on this model so we need use data ports - I could not find a deployment guide for the PA-450 to address HA specifically and I assume you could use any data port but does anyone have any experiences when selecting ports for HA? does it matter...

bormanb by • L0 Member
  • 7120 Views
  • 3 replies
  • 0 Likes
  • 1658 Posts
  • 63 Subscriptions
Top Solution Authors
View All
Latest Comments
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks