This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.
About Next-Generation Firewall Discussions
Palo Alto Networks Next-Generation Firewalls provide true, complete visibility everywhere, along with precise policy control. Ask your questions or provide insightful answers in the discussion forum specific to NGFW.

Discussions

Start a conversation

Welcome to the Next-Generation Firewall Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4841 Views
  • 0 replies
  • 1 Likes

Wrong classified URL

Hi, Can someone explain what the malware base DB is? Does the MLAV flag indicate that the file was classified as malware by the machine learning engine? If so, how can this classification be overridden or excluded? Thanks.

url_check.png
HeinzP by • L1 Bithead
  • 67 Views
  • 1 replies
  • 0 Likes

DHCP Relay Source IP Address Behavior

Attention: Global TPM team, Could you please confirm the following DHCP Relay behavior? When a firewall acts as a DHCP Relay agent and forwards DHCPDISCOVER messages to a DHCP server as unicast packets, is the source IP address the IP address of the interface configured as the DHCP Relay agent? Also, if available, could you please share an...

R.Tabira by • L1 Bithead
  • 190 Views
  • 2 replies
  • 0 Likes

PAN-OS 12.1.2 Features - Operational and Performance Impact of Brotli Inspection and DNS Security Logging

Attention: Global TPM team, Hello Team, I would like to confirm the operational and performance impact of the following features introduced in PAN-OS 12.1.2: 1. Brotli-compressed content inspection using the Content-Based Threat Detection (CTD) engine 2. Dedicated DNS Security log type for improved DNS visibility Could you please advise on...

R.Tabira by • L1 Bithead
  • 129 Views
  • 1 replies
  • 0 Likes

Impact of "Sync to HA Peer" During PAN-OS Image Synchronization

Attention: Global TPM Team Hello Team, General product behavior question. When using "Sync to HA Peer" to synchronize a PAN-OS software image to an HA peer, are there any known service impacts or operational impacts (traffic forwarding, session handling, HA operation, management-plane performance, etc.) during the synchronization process? ...

R.Tabira by • L1 Bithead
  • 173 Views
  • 1 replies
  • 0 Likes

License Validity Date Mismatch on Palo Alto PA-1410 Firewall Without License Renewal

I have checked the purchase documentation, which states that the license validity period is from December 24, 2025, to December 23, 2026. However, the firewall displays a Date Issued of July 2, 2026, and an Expiration Date of June 17, 2029. Please note that no license renewal has been performed to date, and the next license renewal is scheduled...

reynandaal_0-1792397706918.png

Guidance on Getting Started with Enterprise DLP Testing for PII/PHI Protection

We recently deployed a Palo Alto Networks firewall and, as part of the implementation, received 200 Prisma Access licenses. I also requested an Enterprise DLP license for evaluation/testing, which has now been activated. Currently, we have access to the following components: Strata Cloud Manager Strata Logging Service Enterprise DLP Data Securi...

Factory Reset / Secure Erase - Removal of certificates and backup files

Attention: Global TPM team, Could you please confirm whether Factory Reset and Secure Erase (DoD/NNSA Scrub) remove the following data? - Imported certificates (including associated private keys) - Configuration snapshots - Configuration backup files stored on the firewall If available, could you also provide any documentation or internal ...

R.Tabira by • L1 Bithead
  • 156 Views
  • 1 replies
  • 0 Likes

Clarification on Security Policy and Decryption Policy Processing Order

Attention: Global TPM TeamHello Team, I am reviewing PAN-OS packet processing behavior related to Security Policy and Decryption Policy evaluation. Based on the public documentation below, I understand that Security Policy lookup occurs during session setup and that traffic matching a Decryption Policy can be decrypted for further inspection...

R.Tabira by • L1 Bithead
  • 142 Views
  • 1 replies
  • 0 Likes

Clarification on SSL Inbound Inspection re-encryption requirement and certificate usage

Attention: Global TPM TeamHello Team, This is a general product behavior question. No configuration review or TSF analysis is required. Question 1 With SSL Inbound Inspection enabled, is the following deployment supported? Client ↓ HTTPS PA-440 ↓ HTTP BIG-IP (AWAF) ↓ HTTP Web Server Can PA-440 forward traffic as plain HTTP after decryp...

R.Tabira by • L1 Bithead
  • 130 Views
  • 1 replies
  • 0 Likes

PAN OS integrated Use ID agent Server monitoring Status Showing "Access Denied"

Hi Team Pan OS Integrated User ID is connected with one of our DC server with out having any issues while configuring in the other DC servers we are getting the "ACCESS Denied" in the server monitoring. While seeing in the >less mp-log useridd.log I have seen in he following error: tail follow yes mp-log useridd.log 2025-02-20 14:1...

Resolved! PA-410: Unable to Export Stats Dump for SLR Report

Hello Community, We are experiencing an issue with exporting Stats Dump file required for SLR report on PA-410 firewall.The option to export Stats Dump file is not available in web GUI, and the corresponding CLI command returns an "Invalid syntax" error. Environment:Firewall Model: PA-410PAN-OS Version: 11.2.13-h2 Could anyone please clarify...

macOS27 Global Protect?

Hi, Has anyone tried Global Protect on macOS27? I have two users that get totally isolated intermittently when connected. Connection to gateway stays up, but the tunnel is seemingly blackholing all or some traffic (including dns requests). They have upgraded to the lates GP version. I have a support ticket open, but slow progress so far.

Website blocked automatically by the firewall

I am using PA-410. In our network, one specific website is blocked automatically by the firewall. I created a URL filtering, added URLs to the whitelist, and allow in the profile. Nevertheless, users cannot access the website. When I monitor the traffic, there is "undecided" in front of the application. End Reason is unknown. State is Active.Cou...

gdu_palo by • L1 Bithead
  • 880 Views
  • 7 replies
  • 0 Likes

PDF not getting blocked by pre defined Data patterns

We do not see the pdf format getting listed under file type in predefined patterns. Below is the ref. screenshot, What are the expectation by selecting the file type "Any"? It seems that only HTML and Microsoft office documents are supported under this category. We have observed that the PDF files are not getting blocked having the same c...

AHaleem849724_0-1789644627442.png
  • 1652 Posts
  • 62 Subscriptions
Top Solution Authors
View All
Latest Comments
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks