About Wenar

If you see Split-Brain messages it means that the heartbeat between both peers are missed. In the worst case both devices stay active and you network will go down. Please check your cables and network devices between the HA 1 port if they are still working without problems and configure a backup heartbeat over another interface. ... View more

Hi, in my tests it didn't work to use radius groups in security rules. I think the device only looks up the groups for the user if they try to authenticate. After that the groups of the user are unknown. I didn't get an official answer from palo alto for this problem but I never had the request to use radius groups in policies. ... View more

Hi, from my understanding the option Retrieve user groups doesn't retrieve the groups and lists them on any tab. It's just so it will ask the radius server for the VSA #5 like you already linked. The Radius server will send the attribute back and has to match the "user" (groupname in auth profile) I never worked with FreeRadius but you could follow this guide Adding vendor-specific RADIUS attributes (BlueCoat ProxySG) | David Vassallo's Blog and change everything to the Palo Alto attributes There is no guaranty that this will work. I hope this helps a bit. ... View more

I don't see a way to create an exception for one IP-Address or Subnet. The zone protection applies to the whole traffic in this zone. You could deactivate the zone protection and try to add a DoS Protection Rule which is configured like the zone protection. ... View more

I got the information from our SE that it should be possible to deactivate RC4 Cipher, SSL1.0, SSL2.0 and TLS1.0 Algorithms in PanOS 7. ... View more

If you already use SSL decryption or the the method with the url proxy, you should keep in mind that it won't work if the user surf through another proxy: Block Pages are Not Displayed When Using SSL and a Web-Proxy ... View more

I got the information that this bug will be fixed in version 6.0.7 ... View more

I have seen this when I did a factory reset over maint mode. But it wasn't very often. ... View more

If you can't clear enough disk space you have to open a case with palo alto because they are the only people who have access to the root partition. They will help you to clear enough space to login again. The last time I had to do this was because the endcustomer has activated access over https/ssh on the public dataplane interfaces and every try to access the device over the public interface is logged on the root partition. Palo recommended to create a portforwarding with a not standard port to the management interface if you want to access it over the internet. ... View more

It looks like there is no way at the moment. There was an old discussion about this topicRe: URL Sync to Peer for Active-Passive Cluster. You should open a feature request with your SE for this. ... View more

What do you mean with "blocked by captive portal"? The captive portal should only be shown if the user is unknown. If there is already a user mapping the captive portal rule should not match. Even local accounts should be possible to ignore. Is there a user mapping for the ip if the client is blocked? ... View more

I'm still waiting for a response if it will be fixed in an earlier release. I will post it here if I get an answer. ... View more

Suspending one device is probalby the same as a split brain situation. Understanding Split Brain in Panorama > I have changed the Primary to Passive and the Secondary to Active, made a change to the Active/Secondary and then reverted the M-100's back to Active/Primary - Passive/Secondary. If they are still able to see each other like in your first test, you should see a commit job on the passive device. You should open a case if you don't see a commit job on the passive device after you commited changes on the active one. ... View more