About Y-alwaysMe

Hi A_Adamski, Thank you for information. I suspect the problem will potentially be the unknown-tcp, when you enable Bytes Sent & Bytes Received and look the unknown-tcp between the src and dst IP addresses, I am guessing there will be actual data that is eq or more than 200 bytes in the sent and received columns, which could potentially explain why it would randomly stop working as most packets are normal TCP/1556 packets, and then every now and then unknown-tcp will be sent and it will stop working against the application rule. Because the application rule you allowed only contains netbackup and you did not define unknown-tcp in your application rule.   I personally think there are two options use the L4 service-port based rule or look at custom application / app override - see that article by Reaper. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clc6CAC ... View more

Hi Thilina,   To my knowledge the client authentication rules are processed/evaluated from top-to-bottom.  1) What I would personally do is and I think this is also what is recommended. Configure more specific rules at the top and generic catch all at the bottom. This method will ensure your specific rules are matched first and if there is no match it will match the generic catch all rule at the bottom.   hope that answers your question, and in case you meant using different authentication source such as, LDAP and if LDAP is not available falling back on another authentication source such as local DB, then consider using Authentication Sequence, and also that is processed from top-to-bottom.       ... View more

Hi Jonathanb,   To my knowledge you cannot configure latency threshold on a) static route monitoring, b) BFD monitoring, c) PBF rule with Monitor profile. All of the 3 above options monitor failures and not quality of the link/path.   In your scenario there are other options that might suit your needs. consider these two options below.  1) QoS and assign different application different priorities. 2) ECMP load balance the traffic between multiple ISP and if required assign weights to each specific ISP link.   ... View more

Can the 2nd Access Point that cannot access instagram access other sites/internet? if you filter the logs with source IP of 2nd Access Point and Application instagram-base what do you see?   ... View more

Hi Sanketm,     sorry to hear you having problems with Instagram access, to understand the problem you're facing, when you check the logs for instagram or instagram-base which rule is allowing/blocking the traffic? the specific logs I am referring are the Traffic & URL logs             ... View more

Hi Khalid,   Did you recently connect this firewall to the Panorama? if you did, you might need to  Select  Panorama > Setup >Operations >  Export or push device config bundle   If you did not connect this firewall to panorama recently, does it show connected and In sync for Templates? ... View more

Hi Guadalupe,   For VPN users the firewall is the default gateway. In a normal configuration without PBF the VPN users will rely on routing configured on the firewall.   If you configure PBF to destination 'Any' without excluding RFC1918 addresses 10.n.n.n 192.168.n.n 172.16.-31.   a)  First that overrides that routing table for src networks   b)  second because the firewall is default-gateway for VPN users & the PBF rule has destination of 'Any' will act as the only route & default-route, and VPN users will have all their traffic including 10/8 routed via 0.0.0.0/0 ISP 1 using PBF rule.   c) If PBF did not break you normal office traffic, the firewall is not acting as default gateway for your office users, and their is another L3 device that the traffic will use before reaching the Firewall.   I personally exclude/negate RFC1918 address when using multiple ISP's.  in your scenario the negate option tells PBF route for everything using PBF, Except for 10.0.0.0/8 network. For Network 10.0.0.0/8 use the normal routing table configured on the firewall and for everything else rely on the PBF rule.     ... View more

Hi RamyashreeMada,   Your XDR agent settings determine what your users are allowed do or see, and in general if this is configured correctly they shouldn't not be able disable the agent.   To answer your question there is agent audit section, where you can see when Palo Alto XDR agent has been stopped or disabled etc.  1) see XDR Console --> Settings   →  Agent Auditing that is if you are on the console. 2) To ensure you and your colleagues stay informed about XDR agent activity, you can  Configure Notification Forwarding  to forward your Agent Audit log to an  1)email distribution list,  2) Syslog server, 3 ) or Slack channel.   See  Monitor Agent Activity • Cortex XDR Prevent Administrator Guide • Reader • Palo Alto Networks documentation portal           ... View more

Hi A_Adamski,   I agree with you, you should only need 2nd rule as it contains all ports you included in screenshot. that is a weird problem, two question if you don't mind. 1) what is your application version on the dash board - is it  Application Version 8699-7991 (04/19/23) ? 2) when you look at the logs for the first rule, which application(s) do you see in the logs?   ... View more

Hi Sysint,   I can confirm this process outlined in this KB works for the problem you're experiencing. As I have had exact problem in the past and it worked for me.   Please see KB https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMntCAE   ... View more

Hi Paul,   The 10 minutes in your case is probably too long if it is resulting in loss of connectivity after a certain period since PAN-OS 9 the timeout can be reduced to seconds and that is probably what will fix the problem for you. see this kb article. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cmq0CAC ... View more

Hi SalvatoreDangelo,   Why not use the dedicated  HA1-A and HA1-B ports?   ... View more

Hi Allan, I have not seen one for version 10 but version 9 of threat prevention course is still very useful. https://live.paloaltonetworks.com/t5/blogs/training-optimizing-firewall-threat-prevention-edu-114/ba-p/276286 https://beacon.paloaltonetworks.com/student/path/642694 ... View more

Hi Pharney26,   Were you able to import the then load the config file to the new firewalls and also Commit the change successfully?   a) If the change was committed successfully whatever password is in backup file configured should work.   b) if not committed successfully then the initial password that you created for new firewalls should work.     ... View more