About Remo

Remo · ‎07-19-2020

Hi @Biswa For the URL filtering approach you have to keep in mind how a PaloAlto firewall is able to allow traffic based on URLs. So in order to see the URL, the firewall needs to allow traffic until the first http get or TLS client hello. This means at least the TCP handshake neds to be allowed generally to even see the packet required for the URL filtering. So actually even when nmap is able to connect, a complete connection to anx website shouldn't be possible. What you could do is keep the URL profile and also add one or more IP ranges for the PaaS service to further restrict the connection.

Remo · ‎07-19-2020

Hi @a.jones Do you have user-id configured on that firewall? If not then the variable for the username will contain the IP address which you can then use in a javascript that will display the message like you need it.

Remo · ‎07-04-2020

Hi @Yusuf_PA Some help about blocking TOR you can find here: https://live.paloaltonetworks.com/t5/featured-articles/how-to-block-tor-the-onion-router/ta-p/177648

Remo · ‎07-04-2020

Hi @MP18 "If you have some Internet facing servers and users access from Internet to access that and it is using port 443 then you need to block the application in security rule from outside to inside." This sounds a little confusing. From external you probably won't detect traffic coming from TOT exit nodes or do you mean when there is a TOR node bebind the paloalto firewall that is publicly available?

Remo · ‎07-04-2020

hi @VenkatSira What PAN-OS version do you have installed and what browser did you use? Did you try the dame in another browser? At least in my case where I had exactly the same problem tying another browser for importing the cert solved the issue.

Remo · ‎07-02-2020

Hi @patux80 On the external interface pointing towards the ISP you have to use one address of the /30 subnet. With the other 16 addresses you can then do whatever you want: Use one or more single (/32) addresses for loopbackinterfaces which you use for global protect or IPSec VPN for example Use these addresses with NAT rules to make internal/DMZ servers publicly available Create a DMZ zone where you place servers that will get IPs of this public /28 subnet Split the /28 in 2 /29 and use one for a DMZ and the others for NAT ... Hope this helps. Regards, Remo

Remo · ‎07-02-2020

Hi @CARRIERJerome Some help with creating a custom application signature you can find here in this knowledgebase article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0 With your example: Do you have TLS decryption enabled? If not, you will only be able to filter based on the fqdn. What you could do also - instead of creating a custom app - is using a custom url category and simply use this custom url category in your security policy rule (this does not require URL filtering license). Regards, Remo

Remo · ‎07-02-2020

Hi @Sethupathi Having GP authentication working with the different connection methods strongly depends on the GP agent version you are using. With which version do you try this configuration and also which PAN-OS version do you have installed on the firewall? Btw. I assume you already know about this critical vulnerability: https://security.paloaltonetworks.com/CVE-2020-2021 So make sure you use either one of the PAN-OS versions that are fixed or enable the option "Validate Identity Provider Certificate". Regards, Remo

Remo · ‎07-02-2020

Hi @karthikeyanB While this would be an alternative, I assume protecting from this authentication bypass vulnerability with a signature is difficult, maybe even impossible as there - as far as I understand the securityadvisory - isn't some 'malicious' in the traffic that can be blocked. The traffic looks like a normal authentication request and the problem (the vulnerability) is that PAN-OS does not correctly verify the signature of the SAML assertion. So if you are affected, do not wait and install the update as soon as possible or make sure the option "Validate Identity Provider Certificate" is enabled. Regards, Remo

Remo · ‎07-01-2020

Hi @PeterDanielsCRB Are the same DNS servers used on a client connected by global protect and your internal server?

Remo · ‎07-01-2020

Hi @KRYPTONNN Only with the hardware, you can use everything of the firewalls features except: Softwareupdates App-ID updates Threatprevention (Antispyware, Antivirus, Vulnerabilityprotection) Wildfire URL filtering based on categories SD-WAN Features HIP Profiles Various Global Protect Features Opening a Supportcase But in general, using a security device without at least maintenance to be able to install updates is almost like driving a car without breaks - Maybe it works, but not in a secure way. You not only put yourself or your users at risk, depending on the setup the firewall could be taken over and could be used to attack others.

Remo · ‎06-25-2020

Hi community When using the following operational XML-API command on panorama, there seems to be a bug with version 8.1.15: ?type=op&cmd=<show><config><running></running></config></show> Prior to 8.1.15 the outpout started like this: <response status="success"> <result> <config version="8.1.0" urldb="paloaltonetworks"> <panorama> ... But now with 8.1.15 there are additional unnecessary hierarchy levels, so the output now starts like this: <response status="success"> <result> <response status="success"> <result> <config version="8.1.0" urldb="paloaltonetworks"> <panorama> ... So if you are using this command in your scripts/programs, you probably need to change some lines of code to have it working with PAN-OS 8.1.15 on panorama. So far I did only find this one XML-API command. Other command-outputs or the same command directly on a firewall look normal. Regards, Remo

Remo · ‎06-09-2020

@miguelgzz You made sure that there isn't a type right? Are the same PAN-OS versions installed on the firewall? And you connect to the firewall and not the panorama? Because it actually does not matter if there is one or more vsys on the firewall. Also if it is managed by panorama or not doesn't matter.

Remo · ‎06-09-2020

Hi @kiwi Are there plans to implement a solution in PAN-OS regarding this issue? (I know it's not a PAN-OS issue, but in the OS the firewall would be able to solve the fault of many webserver admins)

Remo · ‎06-08-2020

Hi @RobinClayton Do you whitelist the specific domains that the firewalls require to communicate / to download updates ... ? At least I am doing this and I had the same error since a few days. Today I found out that some firewalls (mainly PA-200 and PA-220) no longer communicate to the url prod.itpdownloads.paloaltonetworks.com as documented here: Content Delivery Network Infrastructure Since a few days these firewalls try to connect to proditpdownloads.paloaltonetworks.com. As soon as I opened this URL the downloads were successfull again. Regards, Remo

Member Since	‎03-20-2013 04:23 AM
Date Last Visited	‎11-26-2025 01:29 PM
Posts	2,247
Total Likes Received	813

Online Status	Offline
Date Last Visited	‎11-26-2025 01:29 PM

About Remo

Re: Certificate Expired Warning in Deploy but all certificates are good

Re: How to request a URL filtering change to High-Risk?

Re: Template vs Device Group

Re: sorting question

Re: Panorama Disk

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Bad support from plaoalto

Re: Activate Firewall with Expired License / Unknown Auth Code

Re: Wait time

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Captive Portal with custom images

Re: Active-Passive pair takes long to show the status when one is rebooted.

Re: sorting question

Re: Deal Registration End Customer Details not Include

Re: Enable Qos on sub-interface

Re: Admin console unreachable/cant remote in or ping - PA support wont let you submit a ticket without a TSF file - which you get via admin console

Re: How to request a URL filtering change to High-Risk?

Re: Log Container Page Only - impact?

Re: Stop wsc files

Re: Customer Support Portal error

Nominated Discussion - Sorting Question

Nominated Discussion: URL Filtering in TLS v1.3

How to Add Log Forwarding Profiles in All Security Policies

Re: Block layer 4 traffic for destination blocked on URL filtering

Re: Custom Response Page

Re: Block Tor application traffic.

Re: Block Tor application traffic.

Re: Importing cert problems

Re: public ip addresses and link address /30

Re: Custom Application Signature

Re: Can Use Okta SAML for GP- "Prelogon Then On-Demand" connectio

Re: Authentication Bypass in SAML Authentication.

Re: AD DNS Zone with A Record not resolving through GlobalProtect VPN gw

Re: PALO ALTO PA-850

Bug in PAN-OS 8.1.15 with operational XML-API command on panorama

Re: How to limit concurrent GlobalProtect connections per user

Re: AddTrust External CA Root Expired

Re: Automatic updates broken?

Seattle Beta - GlobalProtect (ELK)

Unlock your full community experience!

About Remo