Next-Generation Firewall Discussions

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Routing client vpn over site to site tunnel

Hello everyone, I’m new to palo alto and I have the following problematic that I couldn’t solve. I have PA Firewall in my local site and it’s configured to allow site to site connection to a remote branch which works perfectly. In addition, I’ve set up client to site (to local site) connection and it works perfectly, I can reach all the resource...

Need a fast boot time firewall

How fast would a PA-400 boot? I am looking for something that can boot quickly. I currently have a FW that takes about 25minutes to boot (highly doubt that is normal).

Log Collector status", it gives me "Error"

Hello All, From the device-Setup-Management tab, there is "Logging and Reporting Settings". And when I click "Log Collector status", it gives me an "Error" The FW is connected to Panorama and it gets shared policies and objects and it seems like forwarding logs. What is the error indicated in firewall. Kindly suggest on this.

VPN Phase 2 Tunnel stuck

Hi, We have multiple S2S VPN with many vendors but facing issue with Fortinet. On our side we observe Phase 2 tunnel is up and packets are going out through Tunnel interface but no reply. Other party saying no issue on their end but once we restart that Phase 2 Proxy id, it starts working. Just to inform you that we have multiple Proxy ids. a...

VM not working in Vmware 6.7

Hello, I am getting desperate :(. I am totally new in PA, this was supposed to be my first VM to lab and play with it. Anyway I have credits and I have OVA file. When I try to deploy it in Workstation on my local PC, it works. When I use the same OVA in our lab environment With VXLANs a Vmware 6.7 (NSX). Its not working at all. I am not able t...

Resolved! NGFW Telemetry Uploads Failing

We have been receiving critical alerts saying telemetry uploads on all of our NGFWs from all locations are failing since just past midnight EDT last night. The most relevant parts of the alert are: type: SYSTEMsubtype: device-telemetryeventid: send-failedobject:fmt: 0id: 0module: generalseverity: criticalopaque: Failed to send: file 'PA_&l...

PA firewall conencting to the CISCO router in VRF lite

Trying to connect a cisco 9300 device with 2 VRF's accross the PA firewall. the PA firewall can not ping the attached 9300 interface in a VRF. IF the interface is taken out of the VRF the connectivity works. Dose any one know whats causing this

Resolved! Management server failed to send phase 1 to client cord

Cannot commit due to error "Management server failed to send phase 1 to client cord". Any idea what to do with it?

PaloAlto does not pass through itself a request for AD

Hi !I have problem with connection PC to AD between which stands PaloAltoPC 192.168.10.10AD 192.168.30.40 (loc.lab)pings go from PC to AD 192.168.30.40 (loc.lab) and return successfullypings go from PC to loc.lab (192.168.30.40) and return successfullyBut when I try to connect a PC with a local account enter into the domain i get when i t...

Automation of partial config load from xml

Hello, TL;DR : I use PA-VM 10.0.4 and paloaltonetworks.panos 2.12.2 galaxy ansible modules. Do you know a way to automate a partial config load from xml ? Ideally using ansible but maybe using API or python ? I tried several things with ansible, none of them are working. Ultimately I'd like to automate the use of this command, which is OK wi...

Resolved! I need routing between two internal networks

Hi ! I have a problem with setting up a static route between two internal networks. There is a networks 192.168.10.0/24 192.168.20.0/24 192.168.30.0/24 I want to ping between PC1 192.168.10.30/24 PC2 192.168.20.31/24 I can't figure out what I'm doing wrong Considering that machines from the inside have access to the Internet

Threat ID 54532

Anyone have any experience dealing with Threat ID 54532? VBScript Obfuscation. See the offenses/detections but find nothing on the hosts source or destination that reflects a vbs script. Its all internal traffic. Could it be some other traffic that is getting incorrectly labeled as VBS?

Detection logic in content update

Greetings All, can you explain what is the meaning of the below when we receive new contents updates : "improved detection logic to cover a new exploit" "improved detection logic for decoder updates" "improved detection logic to address a possible fp issue" Thanks

Resolved! Absolute domain ending in .txt

HI all, i received from an external provider a .txt list to block in my palo alto. The list is not exactly a file ,is an absolute domain,i mean is like www.test.com/blacklist/domain.list.txt. This will be a dynamic list,so is there some way to save this domain as object in palo alto,adding to a policy,and palo alto will update automatically as f...

Resolved! Hardware failure

Hi Team, Can some one guide me, My Production environment Primary firewall got Hardware failure and we got RMA. What is the procedure to add new device in HA environment .. Thanks, Balakrishna

Discussions

Welcome to the Next-Generation Firewall Discussions!

Routing client vpn over site to site tunnel

Need a fast boot time firewall

Log Collector status", it gives me "Error"

VPN Phase 2 Tunnel stuck