How can I extract the IKEv2 encryption keys SK_ei and SK_er on PAN-OS 11.2?

How can I extract the IKEv2 encryption keys SK_ei and SK_er on PAN-OS 11.2 (for the purpose of decoding a packet capture file in Wireshark)?

The following article describes the procedure:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?

RCS Chats from iPhone (IOS 18) broken

A fun problem got brought up that now that Apple surprisingly supports RCS (Google's SMS replacement) and for some reason it does not function on our networks.

I can see in our internet firewall that there is a TCP 5223 session to us.verizon.rcs.telep

Issue connecting to GlobalProtect with public wifi

Hi guys,

I'm at a coffee shop and using their public wifi to connect to my company GP VPN. I was able to enter my credentials and MFA. The GP showed that I'm connected, but I'm not able to connect to my company's local stuff and can't browse the inte

Unable to upgrade past 11.0.4-h1

Trying to get to 11.1 but when we upgrade, after a period of time, usually 30-60 minutes after the upgrade outbound traffic begins to fail. We see traffic allowed and going out but 0 returned. We have tried several versions of 11.1 as well as even 11

Bidirectional PIM Support

Hello everyone,

Does PaloAlto support bidirectional PIM?

I understand that bidirectional multicast means that a device can be both a sender and a listener, and I would like to know if PaloAlto supports multicast communication in PIM-SM where a si

IP List limitations

We would like to integrate with AbuseIPDB after seeing numerous global protect VPN logon failures.  We've greatly slowed this process down but it was a manual process of pulling reports to a list and we have an EDL download this list on a regularly s

Log messages in ikemgr.log that were present in PAN-OS 11.1 are missing in PAN-OS 11.2

In PAN-OS 11.1 (running on VM-Series in AWS) I could do `debug ike global on dump` to get some [DEBG] and [DUMP] messages in `ikemgr.log` from which I could get the SK_ei and SK_er keys that allow me to decode the IKEv2 messages in a pcap using Wires

11.1.4h7 and 11.1.5 h1 high cpu

Hi

Ugraded 11.1.4h1 to 11.1.4h7 On PA440 and PA415,  causing high both planes cpu.

rolled back to 11.1.4h1 fixed 

Upgraded to 11.1.5h1 - same issue.

Rolled back to 11.1.4h1.

Minor patch release date for 11.1.8

I have run into a situation when we upgraded our environment to 11.1.4-h7, where from the Panorama, I can not modify existing rule sets with my radius authenticated account. This environment is government, so STIGS are used (this should allay any odd

Phishing email? - Important: Palo Alto Networks Informational Security Bulletin

I just received what looks like an official PA email which suggests I visit (which appears to be legit)
https://security.paloaltonetworks.com/PAN-SA-2024-0015

For important security information about how to configure my management interface.

Yet when

PA-450 am using getting issue on Port forwarding

PA-450 am using getting issue on Port forwarding

public to private port forwarding 9000-10999

it is not accepting on destination translation 

is there a way to monitor PA 440 HA cluster as one machine in PRTG, if yes how to configure it

is there a way to monitor PA 440 HA cluster as one machine in PRTG, if yes how to configure it

TIA

Software Version 11.1.5-h1 commit issue

Hi,

I noticed after upgrading to 11.1.5-h1 from 11.0.3-h5 that the commit has an issue with the initial config push. I will have to commit 2-3 times before working. Do you have any ideas on how to get this working properly?