About CosminM

Hello @mR00t_s5  If you are trying to connect to your AD using WMI, this may not work for some months ago because of Windows patch KB5014692. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk0CAC  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkkfCAA    If that is the case, and are using Server Monitor, you need to configure WinRM-HTTP or WinRM-HTTPS. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-server-monitoring-using-winrm    ... View more

Hello @DL_CyberCX  You can find all the steps here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIOCA0  And for your second question, you can add individual groups and not a container. ... View more

Hello @RusselMoos ,   Assuming that you need connectivity between all you distant subnet, then your Proxy-ID will have 4 rules, as follows for side A:   ... View more

Hello @Ed_Brown  If you read one of my above post, you will find that this known issue it's fix also in 10.2.9-h9. ... View more

Hello @MAerre  As @PavelK mentioned, you need to "1.) Make sure that new PA-5410 has all licenses / subscriptions activated. Also make sure that it has latest App/Threat package installed and running preferred PAN-OS." https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNZgCAO  ... View more

Hello @H.Song  It's not possible to go directly from 9.1.x. to 11.1.x. You need to follow the upgrade path mentioned here: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path  ... View more

Then you need to configure ECMP on your virtual router and enable symmetric return.   More details can be found https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/ecmp/configure-ecmp-on-a-virtual-router#id7b41dd6b-dcfb-429c-adb1-b955cb15a9c7    ... View more

Hello @m.habib424169  Your PBF rule should be with action No PBF and enabled Enforce Symmetric Return. Also, I don't see the meaning of your NAT rule. If you don't disable that NAT rule when you will ping from external your ISP2 interface it will result into a LAND attack and the packet will be silently drop. ... View more

Hello @S.Sivan    There is a Customer Advisory related to certificate expiration that include information also about User-ID Agent. https://live.paloaltonetworks.com/t5/customer-advisories/update-to-additional-pan-os-certificate-expirations-and-new/ta-p/572158  Continuing to use UID Agent 9.0.5 will result in a loss of functionality from November 18, 2024, due to certificate expiration. It is necessary to upgrade both your firewalls and UID Agent to the recommended versions. Begin by upgrading the firewall; only after completing this step should you proceed with upgrading the UID Agents (refer to FAQ 7). For UID Agent version 10.1.2, ensure that your firewalls are running one of the versions listed in Table 2. ... View more

Hello @rhunziker and @robertocol  If you check the launching date for 10.2.9-h1 you will see that was release before 10.2.8-h4 and most probably because of that the issue PAN-251013 it's still in 10.2.9-h1. https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304    If you are looking for 10.2.9-hx that include that fix, you will find it on 10.2.9-h9. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-9-known-and-addressed-issues/pan-os-10-2-9-h9-addressed-issues  ... View more

Hello @Cluster8 and @Jpergolizzi ,   Depending on starting and targeting PAN-OS version you need to determine the upgrade path. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path  ... View more

Hello @LCMember40912 ,   The actual Anynet Root CA 2 I have it from another post of @S-Battermann (https://live.paloaltonetworks.com/t5/general-topics/solution-for-quot-ssl-decryption-bypass-for-anydesk-quot/m-p/584025/highlight/true#M116689 ) .   You can download directly the archive from my post. ... View more