Hi @Surese Did you checked this reference doc? https://<panorama-IP>/restapi-doc/ ... View more

@MP18, Just wanted to check if this issue is resolved? All of sudden we have started facing similar issues on few tunnels. Thanks ... View more

Hi @Vijaygvasan ,   You can see all the vulnerabilities details affecting palo alto devices along with vulnerable and fixed versions here. https://security.paloaltonetworks.com/   Hope it helps! ... View more

Hi @stef ,   As it is showing the incomplete and you are facing problems to reach only the  internet, you need to first verify the NAT configuration and check if Source NAT before going to ISP gateway is happening properly. Although the IPSEC is working fine through the circuit, re-verify the reverse path/routing config if it is clear. You need to have routes on the firewall to reach the backend hosts subnet who are sending the internet requests. ... View more

Hi @KurdTech ,   Could you try by adding one more entry under custom URL category i.e. *.youtube.com  ? ... View more

Hi @KurdTech ,   If you want to block it on any kind system, web-browser and/or mobile apps, blocking it using only Custom URL category  should work. Also before modifying anything, could you please check if mobile endpoint's traffic is matching the desired security policy.     ... View more

Hi @iscofate ,   Will the IPT phone on the remote be able to use the DHCP service that is currently working in my boundary to acquire a dynamic IP address via the IPSec tunnel? If not, then what option do I have? - Yes, if there is reachability with the server over the tunnel, this will work. If the SP is providing me with a VPN Leased Line then will I be needing to go further into configuring additional Auth-Encr parameters to get this as an IPSec. -Yes, you need to create site-2-site tunnel configuration on both ends. Both end’s public IPs will act as peer for each other. Below article may help you for the configuration steps on Palo Alto side. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK I have started testing the configuration with one sub interface under my L3 aggregate and I have put it in a new zone. Is this a wise move to start it? - Where is the internet/lease line is terminated? If it is on dedicated interface then don’t need to add sub-interface. Just configure the interface with proper IP address. If you're going to re-use this interface in future for any other connectivity or you want to use existing interface for this connectivity, you can go for sub-interface. Following up on #3, How will my VR look because I currently am using a Single VR for all my routes including Internet connectivity? - In the same VR, you need to add route for the remote office network which is going to communicate via tunnel and pointe that route to the desired tunnel interface. Refer given article. If anyone out here has done it before, would you suggest anything to look out for? Yes, we have one site communicating over tunnel. While configuring tunnel, you need to take care of encryption domain, tunnel parameters, required security policies and routing.   Hope it helps! ... View more

Hi @dtran ,   I tested URL from my one of the test system which is behind palo alto and URL is working. It gets redirected to https://brokercheck.finra.org/     ... View more

Hi @dtran ,   What are you seeing under traffic logs? Traffic logs should give more clarity for this. You can also check few other points like,   1.First, check if traffic for below URL is reaching the firewall. If there are any DNS issues on the source system, you won't see any traffic on the firewall. 2. Check if the required security policy is getting applied to below URL traffic on Palo Alto and if security policy is allowing the traffic, 3. Check if any other security policy profile e.g. URL filtering is blocking it. 4. NAT Policy & desired routing is happening on the firewall while accessing below URL.   Please check these points. ... View more

Hi @t-katsuki ,   First where are you looking for the logs, i mean under Threat or URL filtering section? If you want to see vulnerability protection profile related logs, please check under threat logs tab. Also before checking logs under said tab, you need to have that profile to be mapped to the security policy which is allowing the traffic. Unless you have VP profile attached to the security policy, it wont come into picture while processing the traffic. ... View more