About Raido_Rattameister

As your Palo don't have access to public IPs you will configure GlobalProtect on interface with IP 10.254.10.2. In public DNS you need to use real (public) IP for GlobalProtect record. ... View more

You create only 1 portal. Run it on DMZ interface (2x ISP IPs natted to that DMZ IP tcp/80, tcp/443 and udp/4501). If your users are ok to add https:// manually in front of the portal to access portal address then 80 is not needed. Otherwise Palo will automatically redirect 80 to 443. Set up 2 A records pointing to 2 different ISP IPs (so DNS resolution gives back 2 IPs for same portal). Agent picks one of those IPs randomly to connect to portal.   For gateways you set up 2 separate DNS records vpn-isp1.company.com vpn-isp2.company.com   Run gateway on same DMZ portal natting public IPs to DMZ IP. Portal config hands out 2 gateways to agents.   Agents perform latency test and connect through ISP that is closer by. ... View more

Rule evaluation is top to down if Device Group is nested - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CljVCAS If Device Groups are not nested then rules from Device Group 1 don't affect firewall in Device Group 2. ... View more

You need mgmt port to access specific device. Only active firewall can be accessed through dataplane ports.   Procedure: Upgrade passive Reboot passive Wait until passive returns from reboot and is functional Upgrade active Reboot active If you have preemtion enabled then active role will migrate back to the firewall it was initially. ... View more

What is you SYN Cookie activation rate in Zone Protection profile? Can security scanner be calmed down to keep new session count (together with existing traffic) below that threshold?   ... View more

https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/members_discuss/15121/1/TechNote_UnderstandingNAT.pdf     ... View more

Are you saying that scan was done from one network zone to another and firewall rules are in between? Do you have application and service both set correctly?   Let's assume you have following policy to permit incoming email and your email server public IP is 5.5.5.5. This is very insecure rule because it permits anyone on the internet to perform port scan against your email server (because service is not set). Initial TCP 3way handshake is permitted through on any port and only after 3way handshake is completed firewall can identify application based on signature to identify if application is actually SMTP or not.     So as a first step look at your traffic logs and check maybe some rule actually permitted scanner traffic through it unintentionally.     ... View more

Are you referring to incoming or outgoing traffic? As you mention DHCP it refers to internal devices accessing Internet. If it is internal traffic you need to figure out what causes traffic from those internal devices to arrive to different firewall from what you expect. ... View more

Do you mean exclusion from reconnaissance protection?   ... View more

[Update 2/20/2025] - Due to some minor issues discovered in QA testing we are delaying the previously scheduled February 19, 2025 release to February 24, 2025 Pacific Time Zone.   https://live.paloaltonetworks.com/t5/customer-resources/new-app-ids-for-deepseek/ta-p/1220674 ... View more

Check if those sessions that end with "aged-out" are actually TCP sessions. RDP uses both TCP and UDP port 3389 and it is expected for UDP to end with session end reason aged-out. CyberArk uses both protocols to connect to backend devices. ... View more

Self signed intermediate and root certs have expired.       ... View more

Firewall time is incorrect. Fix time and check that NTP is configured. ... View more