About pulukas

Ask you carrier if they have a bridge only modem option for your DSL.  These devices create the DSL PPPOE connection and hand off a normal ethernet port on the other side.  There is no configuration options on the bridge only modem at all.   I've used these with several of the USA DSL providers over the years and they provide a good option for getting the firewall connected.   The second version of this is to ask if the carrier provided DSL device can be configured into bridge mode.  Here again the device bridges the DSL connect to an ethernet port.  But there is a login and configuration of the modem/router and these then can allow the creation of an authenticated PPPOE session on this device. ... View more

To get copies of files not on the standard download methods, you will need to open a support case.  TAC will help you get the needed files. ... View more

For example:  The current configuration pulled from the showing in set format might have these commands for this sub interface:   set network interface ethernet ethernet1/4 layer3 units ethernet1/4.2 ipv6 neighbor-discovery router-advertisement enable no set network interface ethernet ethernet1/4 layer3 units ethernet1/4.2 ip 10.2.0.1 set network interface ethernet ethernet1/4 layer3 units ethernet1/4.2 tag 10   Convert to delete commands (some adjustements needed for leaf objects removed at the end of the command:   delete network interface ethernet ethernet1/4 layer3 units ethernet1/4.2 ipv6 neighbor-discovery delete network interface ethernet ethernet1/4 layer3 units ethernet1/4.2 ip 10.2.0.1 delete network interface ethernet ethernet1/4 layer3 units ethernet1/4.2 tag   remove from import interfaces: delete import network interface ethernet1/4.2   Convert to interface 1/3: set network interface ethernet ethernet1/3 layer3 units ethernet1/3.2 ipv6 neighbor-discovery router-advertisement enable no set network interface ethernet ethernet1/3 layer3 units ethernet1/3.2 ip 10.2.0.1 set network interface ethernet ethernet1/3 layer3 units ethernet1/3.2 tag 10   ... View more

Looks like you have the zones backwards.  you have the public ip source which would be presumably the untrust zone inbound to your server and the destination the private address in trust.   To allow the connections into the server you will also need to create the security policy to permit the applications or ports you want to allow in to the server as well. ... View more

I would add that the tcp timeout settings are NOT related to you using v-wire mode but the result of the migration from the ASA to a more modern firewall with RFC standard timouts enforced for the session tables.  This issue will occur with pretty much any move off of older firewall firmware styles to any newer model for pretty much any manufacturer.   Part of the application on-boarding process has to be to discover the actual behavior expected from the transiting applications.  Ideally the app provider will be adjusting their settings and programs to operate within RFC timeout specifications.  But this if frequently not the case so custom timeouts will need to be made for specific applications when required. ... View more

There are two methods you can use for this type of operation, load partial from an xml file with the necessary settings and using command set format to add/remove the device settings.   I've only used load partial with configs in Panorama but I assume this is possible with the device direct as well.  This method assumes you have an existing valid xml format and you suck those existing subinterface into the new interface hierarchy.  So you don't have to manually write the xml us import the existing xml into the right spot.   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-duplicate-settings-among-multiple-templates/ta-p/75141   The other option is to get the related sections of the config in the set format from the cli.  These then are much easier to edit than the xml file to change values.  Which you then run on the CLI to change or delete the required settings.   set cli config-output-format set then simply show the right sections of the config or just dump the whole config down in set format as a reference   https://live.paloaltonetworks.com/t5/Configuration-Articles/Viewing-the-configuration-in-set-and-XML-format/ta-p/65757 ... View more

For SMTP related functions you will want to set the action to "block".  This will send a SMTP 541 message to the sending server so it stops trying to deliver the message. ... View more

Do you have a matching security policy that allows the traffic from the public wifi zone to the dmz server zone. ... View more

Firewall lookup from zone to zone is matched based on the ingress and egress interface of the traffic.     so if a zone has no interfaces, the zone and associated rules will never be used for any traffic. ... View more

LSVPN is a Global Protect VPN connection so we would use the Global Protect troubleshooting process on links that do not come up as expected.   https://live.paloaltonetworks.com/t5/Management-Articles/Troubleshooting-GlobalProtect/ta-p/75770 ... View more

If I remember correctly, these drops occur when either the multicast group is not configured for the ip range or the security policy is not in place where the destination address is flagged in the policy as multicast. ... View more