About pantac

the only thing you will need to do is allow the application webdav. if this issue is reproducable i would suggest creating a case and a live debug session with support. we'll need to veify if there is anything being drop or being miscategorized by our application engine. ... View more

I would set up a capture on the palo alto device to stage at receive, transmit, drop, and firewall to see if the palo alto is forwarding the packet in a timely manner. also check to see if there were any packets dropped " show counter global filter delta yes | match drop ".  In a previous case we seen that  there's a large number of out-of-order frames on the local side, leading to retransmissions. we can modify these tcp settings with the following commands. " set deviceconfig setting tcp out-of-sync ignore  " " set deviceconfig setting tcp drop-out-of-wnd no" if you need help with any of the above please create a case via the support portal and an engineering will help debug further. ... View more

Pan Agent relies upon Windows Logon events in the Security Event log on the Domain Controller(s). Have you verified that these missing users are showing up in the DC Security Event log? Have you enabled a higher level of logging in the Pan Agent? (File menu -> Debug -> Verbose) If these users are creating logon events in the DC Security Event log are you seeing any errors in the Pan Agent log file? ... View more

you need to be running Pan Agent to retrieve the user/group mappings from your AD environment. ... View more

if your RADIUS profile has the domain field correctly configured with the domain name then the PA firewall will prepend the DOMAIN\ portion of the login when doing the RADIUS authentication process. ... View more

The first thing I would check is that the Interface speeds match to the device they are plugged into.  If the PAN plugs into a switch, and the interfaces on teh switch are froce to 100Mb/Full.  Make sure teh PAN is configured the same way.  If the switch interfaces are set Auto/Auto, configure the PAN the same way. Some relevant commands to run via CLI: show system statistics                  - shows total bandwidth passing through the PAN show running resource-monitor           - shows data plane CPU usgae at different time intervals show system resources                   - shows management plane CPU usage Do you have QOS enabled? What application is the PAN detecting this traffic as? On a related note, only apply url filter to outbound internet traffic. Do not apply URL filtering on your own internal servers. If you continue to have problems you should contact support. ... View more

no. this is an invalid configuration and will fail to commit (the commit process does some checking for invalid configuration settings, marks this as invalid and gives a configuration error). e.g. Logical interface ethernet1/7.2 configured with tag value 2000. No two logical intefaces can have same tag value. Logical interface ethernet1/7.5 configured with tag value 2000. No two logical intefaces can have same tag value. Configuration is invalid ... View more

Zone protection is mostly for setting traffic limits and thresholds. Syn flood: Alert threshold  =  X Packets Per Second Activate threshold = PPS Action =  Random drop or SYN Cookie ICMP flood Alert Threshod = PPS Activate threshold = PPS UDP and Other IP flood, same as ICMP flood. It also allows Port scan and IP scan thresholds to stop dropping packets after X scans in Y seconds. Zone protection does not detect coss site scripting or SQL injection or any HTTP based attacks. Steve Krall ... View more

I assume you are using a pool NAT, where multiple internal systems are NATed behind a single external NAT.  In this situation the XBOX NAT test will come back as strict.  This is normal and the XBOX should still work and users should still be able to connect and play games.  You shouldn't need the inbound ports open, because the PAN should detect the XBOX traffic and be able to handle the return traffic gracefully. You're outbound policy should allow the XBOX live application out.  In the service column you should either be using application default or any.  You might want to create a specific policy allowing XBOX application only. As a test you might try configuring a static (one-to-one) NAT for a device and see if this improves things. What game are they having trouble with? If you still have problems you should open a support case. ... View more

An Application Blocked override page is not avaialble at this time. Pleaes contact your local SE if you would like to set up a feature request. ... View more

To install the root and intermediate certs you will need to open both in notepad. Paste all of the text from the intermedite certificate to the bottom of the root certificate. Then import this new certificate into the PAN device. This can be used for both Captive Portal and SSL-VPN certificates. ... View more

please contact your support provider to further investigate. ... View more

Sam, Can you join the gotomeeting? ... View more

This will require some debugging to determine why you are seeing that but normally this will occur if we are not seeing enough data to determine the application. Are you sure the palo alto device is seeing the entire conversation? ... View more