This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About bambox
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About bambox
05-30-2022
13Posts
1Like
0Solutions
May 30, 2022Last Visited
User
Activity
User
Profile
Latest posts by bambox
| Subject | Views | Posted |
|---|---|---|
| 243 | 04-06-2022 10:18 AM | |
| 342 | 03-17-2022 12:52 PM | |
| 302 | 03-07-2022 09:49 PM | |
| 348 | 03-07-2022 08:06 PM | |
| 328 | 03-04-2022 03:09 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 03-04-2022 03:02 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 02-05-2021 07:24 AM |
| Date Last Visited | 05-30-2022 10:27 PM |
| Posts | 13 |
| Total Likes Received | 1 |
04-06-2022
10:18 AM
I have my production firewalls in HA active/passive mode. My question is if I have suspended the passive firewall, what would be the interface status, would it be down or showing up ? I do understand it will not be forwarding traffic but what would you see in the GUI when checking the interface state.
... View more
03-17-2022
12:52 PM
Hi, I am trying to configure a path based monitoring for a static route on a virtual router X, now on the VR X, there is multiple interfaces, is it usually recommended to use one of the interfaces IP address as a source address for the monitoring rule when pinging google or better to create a loopback on that VR and use that instead. Thanks.
... View more
03-07-2022
09:49 PM
Perfect but just to confirm, if I have a static route monitoring on Apps VR pointing with its default route to next hop being Default VR if Google is reachable, would that still be working fine assuming I set the source interface from an Apps VR interface? The reason of my question is in the documentation it says "Path monitoring doesn’t apply to static routes configured between virtual routers.", I couldn't really understand that part.
... View more
03-07-2022
08:06 PM
Hello, I need to implement a static route monitoring where route A with metric 5 is only applied if google is reachable, route B with metric 10 is backup link through WAN, and both routes are on VR default. I have another VR, Apps VR, where I need to make sure the default route (0.0.0.0) in this VR also has a static route monitoring where if Internet (Google) is unreachable, to use a secondary route through WAN network. All routes on both VRs (Default and Apps) will have monitoring sourced from an interface on default VR. My question is if implementing the static route monitoring on both VRs does make me achieve the objective or I might be missing something here. Thanks everyone.
... View more
03-04-2022
03:09 PM
Hello, In the plan details on Azure, it mentions that PAYG usually have a 30 day free trial, my question is if in these 30 days, would I be charged for usage in any case, in other words, is there certain level of usage that I should stay under before being charged hourly. Thanks.
... View more
03-04-2022
03:02 PM
1 Kudo
Thank you and everyone for sharing your experience. I managed to migrate the configuration with no issues except that unfortunately the configuration file that PAN documentation mentioned in the process does not usually contain Shared objects which has caused commit issues. For everyone trying to migrate in the future, the only file that contains Shared objects is the one in the config bundle, you have to extract it and get the Panorama xml file which contains all configuration including shared objects.
... View more
02-27-2022
09:55 AM
I need to migrate the configuration of a Panorama X to another Panorama Y where I need to split several devices on their own panorama (Y). The plan according to several discussions is to export the config of current panorama X, import into Panorama Y while changing IP address, hostname, etc. This is the step where I am trying to see if it can be done more efficiently, I now plan to change the IP of the Panorama Servers section on the firewall to be the new IP of Panorama Y but my question is, can I for example, set the second field to be Panorama Y IP address, commit the changes, and once I am sure everything is working properly after pushing changes from Panorama Y, I then remove the IP address of Panorama X from the Panorama Servers sections or that could cause issues. Thanks.
... View more
- Tags:
- panorama
02-27-2022
09:46 AM
That was it, thank you so much for your help!
... View more
02-20-2022
09:57 AM
Hello, I do have a connection flow for Microsoft Teams direct routing domain sip-all.pstnhub.microsoft.com where I do have a NAT rule and a security rules for bidirectional traffic with the Microsoft domain from our DMZ. The issue is that the firewall sometimes allows the traffic from one of the IP addresses that it resolves to (e.g. 52.114.76.76), and other times like a min or two after for the same IP address, for the same exact flow (src and dst Zone, interface, IP address, port etc) it is denied with application (not-applicable). Taking a live packet capture shows the exact behavior that traffic was just policy denied. I would really appreciate if someone please let me know if anyone had experienced this issue before.
... View more
04-18-2021
11:20 AM
We noticed last month that a core firewall PA-3060 has started reporting the same error message as in this link. Application being already in use. We have provided tech support files to PAN support but they are still unable to determine the reason that we keep getting these error messages when we commit to the firewall. https://live.paloaltonetworks.com/t5/general-topics/validation-and-commit-error-after-panorama-upgrade/td-p/157859 Has anyone come across similar issue and have been able to resolve it. We are still not sure why this error message has appeared even though changes done on these firewalls are mostly policy and nat rules and no change on Application content. Your help is highly appreciated.
... View more
03-10-2021
02:51 PM
Thank you so much. I had asked the client to telnet to a hostname instead of an IP for us to create the signature based on the SNI field and it worked!
... View more
03-10-2021
06:34 AM
Hi Team, We have a client who do not have SSL decryption and has many third-party applications working over SSL on different ports other than 443. The client has a security requirement that all applications need to be categorized by Palo alto firewall, so they do not wish to use any service ports in the Service column field. Also, they do not wish to use the Parent App field where a security rule must exist to allow the Parent App for the custom app to be working. So, we have decided to go through that route and create a custom application for their app working over SSL port 8443. And added this signature http/1.1 in hex \x 68 74 74 70 2f 31 2e 31 \x. And this is where everything went downside, all SSL traffic stopped working and all traffic started being recognized as the custom app. Since the amount of information SSL hello is limited, we couldn't find any additional information to add to the custom app. What do you guys suggest to use for custom apps running SSL traffic when you do not have decryption.
... View more
02-05-2021
07:34 AM
Hello everyone, We have an upcoming project where we need to upgrade our 5060 firewalls to 5250. I was unable to find a document that explains like items to consider to do the migration. This is actually my first project so I am trying to think of maybe a guide or a tutorial that I can start with. The main requirement that I have not been able to find information about is they need to have both 5060 and 5250 on the same heartbeat network where they can test the behavior for sometime and ensure there are no issues then make the switch to 5250 and replace the 5060. Have you had any experience implementing this before, and was there any issues during implementation. Also, I am still not sure if interfaces being different could cause an issue during the migration. Any items that you feel important to mention would be highly appreciated. Thanks.
... View more
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks