This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
About Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.

Discussions

Start a conversation

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4692 Views
  • 0 replies
  • 1 Likes

DNS Proxy

Hey, i am configuring an isolated Vlan and i need some static DNS entries to be "supplied" to the clients instead exposing our internal dns servers. i thought about using the DNS Proxy feature, but i seam to be stucked. 1) when DNS Proxy is enabled, is it enabled across all interfaces and if a client configure the FW's IP as a DNS the PA shoul...

DorMarcovitch_0-1681807912675.png
DorMarcovitch_1-1681808292449.png

Cannot see an option to select the management interface for HA1 backup link - PAN-OS 10.2.4

I'm trying to configure HA Active/Passive on a pair of PA-5410's running PAN-OS 10.2.4. I'd like to use the dedicated HA1-A port for the primary HA1 link and the management interface for the HA1 backup link but I cannot see an option to select the management interface for HA1 backup link.

Proxy ARP for Private VLAN?

Is there a 'proxy arp' interface command (or equivalent) to allow l3 communication between isolated devices on private VLANs? I am looking to move our DMZ to a private VLAN. I would like all ports to be isolated, but allow some communication between certain machines. This is where I would generally set up 'proxy arp' on the router to allow l3 ...

BackUp Firewalls

Hi Team, What is the best solution to Backup our firewalls? As we have standalone firewalls we need to make sure we have backup collected and stored. Please let me know the best way. Thanks. Regards, Sanjay S

X-Forwarded-For on Threats logs

what`s mean below article? https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/identify-users-connected-through-a-proxy-server/use-xff-values-for-ip-based-security-policy-and-logging For non-URL Filtering logs, XFF IP logging is supported only when packet capture is not enabled.-->> It mean that XFF ip is visible only whe...

Palo Alto Service Route config for Dynamic Update/Wildfire/IPS

Hi, What service source interface I need to change for IPS /Dynamic/Wildfire Update ? We want to configure custom interface instead of Management interface.Now I've configured custom source interface for "External Dynamic Lists" and "URL Updates" but the system still using management interface for IPS and Wildfire Update. Do I need to change sou...

EvanRaci_0-1681107358954.png
EvanRaci by • L1 Bithead
  • 2907 Views
  • 2 replies
  • 0 Likes

IP Block List Feeds

We're looking to add a dynamic block list rather than manually blocking bad IP's as we find them. I understand that Palo Alto comes with one or more of these feeds, do we know how often they are updated?Asking for a friend.

Resolved! Global Protect VPN User did Not Sign Out Automatically after Disconnected

Hi All, After we connected GlobalProtect VPN, the GlobalProtect Client App is not asking for username and password again for the next login. We need to manually sign out from GlobalProtect Client to completely logout the user. Is it normal for GlobalProtect Client App to still Sign in even after disconnected? Are there any way to configure at P...

EvanRaci_0-1680621682641.png
EvanRaci by • L1 Bithead
  • 3720 Views
  • 1 replies
  • 0 Likes

how to stop sending duplicate user-ip-mapping by xmlapi

hello..we are using UIA and ClearPass (login/loginout type) to get user-ip-mapping. the issue is Palo Alto firewall is receiving duplicate user-ip-mapping. user-A (using) : 192.168.1.100 receiving from User ID Agent correctly. user-B(not using): 192.168.1.100 receving from XMLAPI incorrectly. user-B ip-user-mapping is sending periodically 45 min...

zinkt101 by • L1 Bithead
  • 2407 Views
  • 2 replies
  • 0 Likes

Resolved! The traffics tab does not appear on the monitor.

Cordial greetings Engineers A PA-410 device with version 10.1.3 has arrived and we identified that in the monitor tab you do not see all the possibilities to see the FW logs (I attach image). Similarly, the device was updated to version 10.2.3-h4 but the behavior remains the same. Does anyone know the reason for this behavior?

Device Telemetry can't be removed/disabled from Panorama and/or local

We currently have difficulties to remove the Device Telemetry options in any way. it seems as this Options doesn't work as expected. This issue persisted across several Versions of PanOS / Panorama Panorama 10.2.2-h2 - When trying to remove the device telemetry options from the template stack the settings are still checked and a commit & ...

mattlede_0-1662714252725.png
mattlede_1-1662714278257.png
mattlede by • L1 Bithead
  • 16270 Views
  • 15 replies
  • 1 Likes

URL Filtering is not working for Global Protect users

Hi all, We have a requirement of GP user should access certain URLs. But once i assign the URL category in security policy, GP user is not getting internet access.. SCENARIO 1 : Security Policy: Source > GP & Source user Group Destination > WAN Action > Allow Internet is working with full access. SCENARIO 2: Security Policy...

Having issues with Vmware horizon client RDP application through palo alto

The initial login works fine but when we try to open any RDP session, it gives an error as “Unable to Connect". But when on the personal network it works fine. Do not see any drops on the firewall, the initial connection is on TCP 443 after which a connection to tcp/4172 PCOI is created and is terminated by a TCP-FIN. Tried to provide an access...

  • 1607 Posts
  • 61 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks