About Remo

Hi @SThatipelly  I made a short test (as so far I have never seen such a spoofing attack - or missed it when it happened 😛 ). The setup is a pa-220 with a default route towards the internet. Then I have an internal interface with a public /24 IP range. The first test was without a zone protection. This traffic was allowed - as I expected - but the connection would never work as the destination server would send the response not back to the firewall as it would be an answer to an IP from the network where the server is located. So this scenario is only a problem because of DoS attacks or vulnerabilities that could be exploited with a single packet. The next test was with the option enabled to drop spoofed IP address. This connections were dropped with the reason spoofed IP address. Then I also added the option for strict IP address check, but compared to the second test, this made no difference in my situation. Here is a screenshot that shows the dropped packets in the threat log (the first 4 or 5 were only with drop for spoofed IP addresses enabled): So this option definately will work to drop connections from spoofed IP addresses and as long as the route table is correct (as I assume because otherwise you would have other problems in your network) it shouln't cause any issues.   ... View more

Hi @Navaneeth1332  In this case I have another question: did you set a master device in the device group? (Step 7 on this link: https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/manage-device-groups/add-a-device-group.html ) ... View more

Hi @SThatipelly  Now I am a little confused. Without these options, how did you expect the firewall to block spoofed connections? ... View more

Hi @Jatin.Singh  The actual connection (issue) logs are located in the PANGPS logs. PANGPA logs are the agent logs or also the part of GP which interacts wth the user over the GUI. ... View more

Hi @Jatin.Singh  Did you change the hostname and IP in the configurationfile prior to import it to the new panorama appliance? And are both panorama appliances run exactly the same PAN-OS version? ... View more

Hi @SThatipelly  Did you enable "Strict IP Address Check" or only "Spoofed IP address" in the packet based attack protection of the zone protection profile? ... View more

Right now the answer is: maybe. But so far it isn't officially supported. As soon as it is released officially or at least short after, I expect there will be a release that will officially support windows 11. ... View more

Hi @PraveenT  Yes, it is possible to have both AV software active and running on these computers. As written by @jcandelaria (with default settings) defender will be disabled as soon as cortex is configured in block mode. But if you diable the microsoft security center integration for cortex, then both softwares are actively protecting the workstations. If this is always a good, is difficult question to answer. It definately requires more ressources and there might be compatibility issues. But at least in theory this should working fine. ... View more

Hi @ruslanal  Did I understand correctly and you don't have cortex installed on the workstation, only on the webserver? If not and you have cortex on the workstation, then as mentionned by @jcandelaria you can start searching in the logs for thw connections to your proxy at that time (requires xdr pro) ... View more

Hi @Navaneeth1332  May I ask some additional questions regarding your issue: Do you use panorama for this configuration or are you talking about the group not showing up locally on the firewall? What hardware and PAN-OS version do you use and if it is one of the biģger firewalls do you use multi-vsys? Do you see the group in the search list of the included groups tab or did you add these groups to the list of imported groups? If you added the groups to the included groups, did you commit the configuration? Did you check in CLI if the group is imported and if there are users in it? ... View more

@istrydom / @sduvoisin / @vogeln  Are you able to answer this prior to anyone in the community? 😉 An answer will probably also help others and not only me ... ... View more

Hi @emr_1  Thanks for your reply. I saw that there are new options in the comparison tool, but so far these options actually are only the "old" vm-types (vm-100, vm-300, ...) with new names. My question is if only the RAM is increased. As shown in the link there are some specs which change if RAM is increased but what is about all the other specs which I mentionned (virtual router, concurrent decrypted sessions, ...) ... View more

@Sec101 yes, it works the same way. As long as you have no overlaps all the configurations will be applied. (If there are overlaps then, the configuration from the template with the higher priority (higher in the list of templates in the template stack) will be used) ... View more