About KP

7.0.3 running great here on a PA-200 doing hybrid L2/L3 with SSL decryption, (brightcloud) URL filtering and threat detection.   My last crash is ages ago (6.0 I think)  ... View more

A google search comes up with this more detailed document about PAN OS 6... https://paloaltonetworks.com/content/dam/paloaltonetworks-com/en_US/assets/pdf/datasheets/whats-new/whats_new_pan-os-6.p… ... View more

Darren, so you are using all three components :  Unreal *client*, Unreal *Media Server*, and Unreal *Live server* ? And the firewall between each leg ? I'm not sure if it would be of any help, but I am also using this setup apart from using the Unreal Client, I connect to the Media server using the MMS: protocol which works correctly through the firewall and is supported by Windows/VLC/Android(VPlayer). My experience with the provided client is rather poor (unless you really need authentication which might be an issue with the MMS protocol) Cheers. ... View more

I didn't open a bugreport since I'm not really impacted and find suport through Partner Support a little bit too cumbersome. In EU we're not able to contact PA Support directly. ... View more

See below for a perfect example on how the IPv6-to-country mapping seems to be completely false. It even manages to log different countries for the exact same IPv6 address ! Running 5.0.0 ... View more

I'm quite sure the PA-200 is not fanless, and the noise coming from it can be quite annoying at times. Unfortunately the PA-200 seems to have missed it's silent mark since the fan is spinning at 3800 RPM about all the time. The PA-200 architecture seems to be dual-core, with one core assigned for dataplane, and one core assigned for control-plane (using CPU Affinity). Problem with that is that one core is running the dataplane (pan_task) at 100% cpu contineously, which causes the CPU to be in 'active' state all the time, causing rather high temperatures and the noise involved. Apart from that I prefer a PA-200 anytime to a PA-500 because of the better control plane performance (higher cpu clocks + flash based storage) ... View more

I've seen several times that on 4.1.x, with IPv6 traffic, application detection doesn't always seem to work correctly. Youtube traffic is usually unknown-tcp, and may only be detected as youtube after several hundreds of MB's transferred. Doesn't look like this will be solved with an application update and may need an OS update ....... Hopefully IPv6 will be better supported on Version 5 (application-id, user-id etc.) ... View more

Guess not, no service route configured here and it's working correctly. No DHCP service route exists in the config. The Palo Alto is sending the request via the "Data Plane" interface that has dhcp client configured. ... View more

Sorry to hear that, my problem is resolved so you may be hitting another bug. Maybe try to sniff DHCP (udp 67 and udp 68) traffic for some time and try to correlate this with you PA system log entries. If possible don't use the PA to sniff but for example wireshark, as it *may* be that this kind of traffic (directed to/from PA as well as broadcast) doesn't all show up in the PA captures. ... View more

Just a heads up that 4.1.7 has just been released, with the fix for the problem discussed here. ... View more

Hello, Yes it's possible and it's exactly what I'm doing on my box. FYI, I have a static public IP address and am using many-to-one NAT (PAT) from inside to outside network. Authentications I tried are local, Kerberos and LDAP (so last two with Active Directory integration). All working but the AD integration really helps if you are already using user-id It's a rather basic setup, only captive portal, no NTLM or session cookies. Best regards, Koen. ... View more

You are very welcome, good luck 😆 FWIW, it's a clear bug and the PA's behaviour is clearly non-rfc compliant. Very annoying as well. Other devices (Cisco, PC's etc) have no issues at all either over here. In fact, I am now using a cisco router to renew my DHCP lease, and have given the PA a static IP address = same as dhcp address. As long as the Cisco and the PA have the same IP address, both have the same MAC address (!), and all traffic but DHCP is filtered on the Cisco, it works. Cannot think of a dirtier/stranger way to work around the problem but it works quite well, I too had a lease time of 2 hours and frequent disconnects (I learned the same-MAC-address trick in the days that Checkpoint didn't support DHCP :-)). ... View more

Would think/hope that it would be fixed in the weekly content (wednesday AM CET, tuesday PM USA) Update. Cheers. ... View more

Do you happen to be on a network segment that 'sees' multiple dhcp-servers ? There is a bug in the 4.1.x version where the PA will send it's DHCP renewal to the last DHCP server it sees on the 'broadcast segment', which may not be the correct dhcp server. For example, I experience this problem on the segment behind my cable modem, and when there is a DHCP renewal seen from my Digital TV recorder just before the PA needs to renew, the PA sends the DHCP renewal to this (private) IP address, which doesn't work for renewing it's own IP address. You could try to sniff all DHCP traffic on your interface, and check if the PA sends the renewal to the correct DHCP server. That's how I found the issue. My ticket has been open for more than 2 months now, but from what I've heard this is already fixed for upcoming version 5.0 and will probably get backported to some 4.1.x version ... View more

One additional info : If I'm interpreting right, what you see with 'show system resource' is that amount of memory assigned to the control-plane. The actual firewall has more memory, but what you see is the amount left after assigning some to the data-plane. Might be wrong about this, strictly reverse-engineering from my side. ... View more