About HULK

Hello Satish, Could you please re-configure the LDAP server credentials on this PAN firewall and let us know the result. It looks like your LDAP credentials were not configured correctly. Thanks ... View more

Hello nfbu2, As per my knowledge, PA 5060 firewall is having 4 BG of RMA and 120/240 GB SSD drive on it. The Platform spec list gives some interesting info. Please give me some time, i will get in touch with document owner and give you an update. Thanks ... View more

Reference DOC for more details info--- HA-Sync :Information Synchronized in an HA Pair ... View more

Hello Satish, After the HA failover, did you check the reachability to the AD server from PAN firewall.? Also, verify authd logs for more detail information. Thanks ... View more

Hello Ralph, What version of GP-agent running on the client machine.? Is this behavior observed in all machines including MAC and windows..? Is there any special-character exists on your GP certificate..? Thanks ... View more

Hello Nfbu2, The PA 5060 is having 4 GB of DRAM on the management-plane. You can verify it through CLI command: > show system resources Mem: The DRAM memory ( ~ 4 GB) Swap: Swap memory taken from SSD Reference Doc for more info: How to Interpret: show system resources Hope this helps. Thanks ... View more

Hello BaNK, I would recommend you to follow the mentioned document to clear disk space on Palo Alto Firewall: How and When to Clear Disk Space on the Palo Alto Networks Device Could you please restart the management server after clearing the disk space and let us know the result. > debug software restart management-server ------------- ( it will take a few minutes to execute on the back end, CLI will log out automatically) Please let us know the result. Hope this helps. Thanks ... View more

This doc might help you to install the certificate into individual machines: How to Perform Client Certificate Install for SSL Decryption As per my knowledge, google services will not play well with SSL decryption ( google chrome as a browser), hence, could you please try to access through a different browser ( mozilla, IE) and let us know the result. in Thanks ... View more

Hello Satish, If you signed the certificate from a trusted CA i.e entrust, go-dady, then it will not throw any certificate warning. Else, you may push the certificate to the individual machine through a server ( in your network). Thanks ... View more

Hello Sathish, Could you please confirm, if you are only getting a certificate warning or the web-page is not loading correctly. In case of a forward -proxy, if you use a self signed certificate, then it is expected. Because it will not match with existing certificate ring in web-page. For example: Secondly, there are a few applications which does not play well with decryption: List of Applications Excluded from SSL Decryption in Please find below a reference DOC for SSL certificate: SSL Decryption Certificates Hope this helps. Thanks ... View more

Hello Rob, Do you have a chance to see ha-agent logs from both firewall. It should give you the reason behind the split-brain state: > show high-availability state > show log system subtype equal ha Thanks ... View more

Hello Holtcg, It's a known software issue on PAN OS 6.0.0 and few other releases: Bug 54347 - Traffic log for ping bytes count incorrect. Please refer below mentioned Document for more detail information: PAN-OS 5.0.8: Addressed Issues Bug 54347:- Extremely large amounts of traffic (Exabytes, or Billions of Gigabytes) were showing up in the ACC tab and logs for users. An issue where the date of record showed as starting in 2031 caused the incorrect counter of traffic, due to the date being set in the future. Date verification is now supported to prevent this from occurring. Hope this helps. Thanks ... View more

Hello Pred-martin, (1) Could you please check, if there is any session available on the PAN firewall, Use CLI by using '>show session all filter source IP_ADD_OF_THE_TESTING_PC destination IP_ADD_OF_THE_DESTINATION'. ( Collect the session ID) (2) If there is a session exist for the same traffic,  then please apply  CLI command PAN> show session id XYZ   >>>>>>>> to get detailed information about that session, i.e Application, port, NAT rule, security rule, ingress/egress interface etc. (3)   verify the global counters, if a specific "DRP" counter is increasing rapidly. - Create a packet filter under GUI > Monitor > Packet capture -Apply below mentioned command multiple times, while try to establish the RDP connection. ( with 2 seconds interval) > show counter global filter packet-filter yes delta yes The command show counter global provides information about the processes/actions taken on the packets going through the device; if they are dropped, nat-ed, decrypted etc.  These counters are for all the traffic going through the device and are useful in troubleshooting issues; like packet loss. It is advised to use the command show counter global filter packet-filter yes delta yes in conjunction with filters to obtain meaningful data. For more information, you can follow the DOC What is the Significance of Global Counters? (4) Could you please share the custom service details ( snapshot) for OPC-UA-4850, OPC-UA-4851, RDP-3390. Hope this helps. Thanks ... View more

Hello Santonic, As Ajbool said before, could you please run the CLI command multiple  times ( with 5 seconds interval): > debug data-plane packet-diag show setting ----  and compare "captured byte" counts. If the byte count is increasing, it means the traffic is getting matched with the filter. In that situation, you need to restart the vardata-receiver process ( responsible to capture packet). CLI command: > debug software restart vardata-receiver. For example: Hope this helps. Thanks ... View more