About Y-alwaysMe

Y-alwaysMe · ‎08-12-2023

Hi S0lselcia, if you've configured the DNS settings in Device>Setup>Service - you can customize which egress interface is used for DNS, LDAP, UID Agent etc in Service Route Configuration. By default all traffic will be via mgmt port.

Y-alwaysMe · ‎04-24-2023

Hi A_Adamski, Thank you for information. I suspect the problem will potentially be the unknown-tcp, when you enable Bytes Sent & Bytes Received and look the unknown-tcp between the src and dst IP addresses, I am guessing there will be actual data that is eq or more than 200 bytes in the sent and received columns, which could potentially explain why it would randomly stop working as most packets are normal TCP/1556 packets, and then every now and then unknown-tcp will be sent and it will stop working against the application rule. Because the application rule you allowed only contains netbackup and you did not define unknown-tcp in your application rule. I personally think there are two options use the L4 service-port based rule or look at custom application / app override - see that article by Reaper. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clc6CAC

Y-alwaysMe · ‎04-24-2023

Hi Thilina, To my knowledge the client authentication rules are processed/evaluated from top-to-bottom. 1) What I would personally do is and I think this is also what is recommended. Configure more specific rules at the top and generic catch all at the bottom. This method will ensure your specific rules are matched first and if there is no match it will match the generic catch all rule at the bottom. hope that answers your question, and in case you meant using different authentication source such as, LDAP and if LDAP is not available falling back on another authentication source such as local DB, then consider using Authentication Sequence, and also that is processed from top-to-bottom.

Y-alwaysMe · ‎04-23-2023

Hi Jonathanb, To my knowledge you cannot configure latency threshold on a) static route monitoring, b) BFD monitoring, c) PBF rule with Monitor profile. All of the 3 above options monitor failures and not quality of the link/path. In your scenario there are other options that might suit your needs. consider these two options below. 1) QoS and assign different application different priorities. 2) ECMP load balance the traffic between multiple ISP and if required assign weights to each specific ISP link.

Y-alwaysMe · ‎04-22-2023

Can the 2nd Access Point that cannot access instagram access other sites/internet? if you filter the logs with source IP of 2nd Access Point and Application instagram-base what do you see?

Y-alwaysMe · ‎04-22-2023

Hi Sanketm, sorry to hear you having problems with Instagram access, to understand the problem you're facing, when you check the logs for instagram or instagram-base which rule is allowing/blocking the traffic? the specific logs I am referring are the Traffic & URL logs

Y-alwaysMe · ‎04-21-2023

Hi Khalid, Did you recently connect this firewall to the Panorama? if you did, you might need to Select Panorama > Setup >Operations > Export or push device config bundle If you did not connect this firewall to panorama recently, does it show connected and In sync for Templates?

Y-alwaysMe · ‎04-21-2023

Hi Guadalupe, For VPN users the firewall is the default gateway. In a normal configuration without PBF the VPN users will rely on routing configured on the firewall. If you configure PBF to destination 'Any' without excluding RFC1918 addresses 10.n.n.n 192.168.n.n 172.16.-31. a) First that overrides that routing table for src networks b) second because the firewall is default-gateway for VPN users & the PBF rule has destination of 'Any' will act as the only route & default-route, and VPN users will have all their traffic including 10/8 routed via 0.0.0.0/0 ISP 1 using PBF rule. c) If PBF did not break you normal office traffic, the firewall is not acting as default gateway for your office users, and their is another L3 device that the traffic will use before reaching the Firewall. I personally exclude/negate RFC1918 address when using multiple ISP's. in your scenario the negate option tells PBF route for everything using PBF, Except for 10.0.0.0/8 network. For Network 10.0.0.0/8 use the normal routing table configured on the firewall and for everything else rely on the PBF rule.

Y-alwaysMe · ‎04-20-2023

Hi RamyashreeMada, Your XDR agent settings determine what your users are allowed do or see, and in general if this is configured correctly they shouldn't not be able disable the agent. To answer your question there is agent audit section, where you can see when Palo Alto XDR agent has been stopped or disabled etc. 1) see XDR Console -->Settings → Agent Auditing that is if you are on the console. 2) To ensure you and your colleagues stay informed about XDR agent activity, you can Configure Notification Forwarding to forward your Agent Audit log to an 1)email distribution list, 2) Syslog server, 3 ) or Slack channel. See Monitor Agent Activity • Cortex XDR Prevent Administrator Guide • Reader • Palo Alto Networks documentation portal

Y-alwaysMe · ‎04-20-2023

Hi A_Adamski, I agree with you, you should only need 2nd rule as it contains all ports you included in screenshot. that is a weird problem, two question if you don't mind. 1) what is your application version on the dash board - is it Application Version 8699-7991 (04/19/23) ? 2) when you look at the logs for the first rule, which application(s) do you see in the logs?

Y-alwaysMe · ‎04-20-2023

Hi Sysint, I can confirm this process outlined in this KB works for the problem you're experiencing. As I have had exact problem in the past and it worked for me. Please see KB https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMntCAE

Y-alwaysMe · ‎04-20-2023

Hi Paul, The 10 minutes in your case is probably too long if it is resulting in loss of connectivity after a certain period since PAN-OS 9 the timeout can be reduced to seconds and that is probably what will fix the problem for you. see this kb article. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cmq0CAC

Y-alwaysMe · ‎04-17-2023

Hi SalvatoreDangelo, Why not use the dedicated HA1-A and HA1-B ports?

Y-alwaysMe · ‎04-17-2023

Hi Pharney26, Were you able to import the then load the config file to the new firewalls and also Commit the change successfully? a) If the change was committed successfully whatever password is in backup file configured should work. b) if not committed successfully then the initial password that you created for new firewalls should work.

Y-alwaysMe · ‎04-17-2023

Hi SujithGovindaraj, (a) I believe at a minimum DNS needs to be configured on the firewall (b) The PA FW needs to be able to access the DNS server ( security rule ) if applicable, and (c) Palo alto updates need to be allowed from FW to Palo Alto update servers (security rule) and these applications configured paloalto-updates & paloalto-wildfire-cloud and others if needed

Member Since	‎05-04-2022 02:41 PM
Date Last Visited	‎02-28-2025 08:05 AM
Posts	31
Total Likes Received	9

Online Status	Offline
Date Last Visited	‎02-28-2025 08:05 AM

About Y-alwaysMe

Re: DNS Server Profile on a vsys

Re: The allow security policy configured with the app-ID "netbackup" and an "application-default" as a service doesn't work correc

Re: Globalrptect VPN Portal Agen COnfiguration

Re: Path Monitoring - latency

Re: Instagram allows but does not display the login page

Re: Instagram allows but does not display the login page

Re: . Failed to generate selective push configuration.

Re: PBF Rule breaks internal network access when connected to VPN

Re: Disbaling Agent Notification

Re: The allow security policy configured with the app-ID "netbackup" and an "application-default" as a service doesn't work correc

Re: DNS Server Profile on a vsys

Re: PA 3260 Policy Rule losing DNS resolution to FQDN-defined site - 4.19.23

Re: PAN-DB URL Filter expired even if Advanced URL filtering is still valid

Re: The allow security policy configured with the app-ID "netbackup" and an "application-default" as a service doesn't work correc

Re: Can I set NAC with Mac address or device information in Pan-OS?

Re: Not able to see all ASA firewall interfaces on Expedition tool

Re: Move firewall to new Panorama

Re: Can I upgrade pan-os after support license expired?

Re: Update software for a new Palo Alto 5260 FW through Panorama

Re: DNS Server Profile on a vsys

Re: The allow security policy configured with the app-ID "netbackup" and an "application-default" as a service doesn't work correc

Re: Globalrptect VPN Portal Agen COnfiguration

Re: Path Monitoring - latency

Re: Instagram allows but does not display the login page

Re: Instagram allows but does not display the login page

Re: . Failed to generate selective push configuration.

Re: PBF Rule breaks internal network access when connected to VPN

Re: Disbaling Agent Notification

Re: The allow security policy configured with the app-ID "netbackup" and an "application-default" as a service doesn't work correc

Re: PAN-DB URL Filter expired even if Advanced URL filtering is still valid

Re: PA 3260 Policy Rule losing DNS resolution to FQDN-defined site - 4.19.23

Re: Cannot see an option to select the management interface for HA1 backup link - PAN-OS 10.2.4

Re: Palo Alto Migration

Re: getting system alerts

Unlock your full community experience!

About Y-alwaysMe