About cfnavarra

It logs as a counter on the interface,  show counter interface ethernet1/1. For a detailed log you need to make a debug , follow this document Packet Based Troubleshooting - Configuring Packet Captures and Debug Logs And you get something like that, Packet received at ingress stage Packet info: len 78 port 36 interface 269 vsys 1   wqe index 266614 packet 0x0x8000000419b930e2 Packet decoded dump: L2:     3c:08:f6:2d:e6:c0->00:1b:17:00:02:24, VLAN 319 (0x8100 0x013f), type 0x0800 IP:     213.4.35.220->176.12.86.33, protocol 1         version 4, ihl 5, tos 0x00, len 60,         id 605, frag_off 0x0000, ttl 122, checksum 16214 ICMP:   type 8, code 0, checksum 19796, id 1, seq 7 Flow lookup, key word0 0x1000700100100 word1 0 No active flow found, enqueue to create session IP:     213.4.35.220->176.12.86.33, protocol 1         version 4, ihl 5, tos 0x00, len 60,         id 606, frag_off 0x0000, ttl 122, checksum 16213 ICMP:   type 8, code 0, checksum 19795, id 1, seq 8 Session setup: vsys 1 Packet dropped, IP spoof on interface ethernet1/21.319 Packet dropped, Session setup failed ... View more

Hi PMC, We had a problem on Panorama M-100 with the log messages received from the firewall. Panorama discarded all the log messages so we had to roll-back to version 6.0.8. ... View more

Solved. The problem was a misconfigured route the dns proxy works fine. Sorry. ... View more

Este foro esta en ingles así que si escribes en español no te van a contestar. Palo Alto no tiene funcionalidad de cache ni de proxy inverso por lo que una migración directa no es posible. Para los accesos remotos utiliza global protect, pero es una filosofía distinta y es difícil cambiar los hábitos de los usuarios. Ahora ha sacado una solución específica para móviles llamada MDM, pero requiere un appliance adicional. Nuestro caso es parecido al tuyo y todavía tenemos un ISA 2006 para publicar exclusivamente los servicios de Exchange. La evolución natural es a un balancedor, publicador, waf tipo F5, Radware o similar. TMG tiene soporte hasta 2015 por lo que todavía tienes margen. En el resto de cosas PAN esta a años luz de lo que hace TMG. ... View more

You could try to re-establish the mapping when the problem occurs. #debug software restart user-id ... View more

Buenos dias: Tienes que preguntar en Inglés en castellano no te van a responder, mira esta consulta que habla de pppoe https://live.paloaltonetworks.com/message/2490#2490 , aunque no se si es lo que necesitas. ... View more

The ftp server was misconfigured and was using explicit ftps connection on port 990, detected as unknown_tcp on PAN device since version  261-1092. Problem solved with an application override rule. Iñaki ... View more

+ 1 ... View more

It's not solved in version 3.1.9. ... View more

Hello: We have the same issue here, we always get it after an authentication error on captive portal. We have PAN 4020 3.1.8 Iñaki ... View more

Finally I’ve solved the authentication issue, I’ve created an Authentication profile and added manually admin user names on Additional users. On administrators I’ve created a new administrator with the same name as the AD user, after I assigned the authentication profile below, and administrator rights. But I don’t want to create a new administrator for each admin user, I want to use AD groups. Thanks ... View more

I can only select shared Authentication Profile when I configure an Administrator, and I can’t add users because I don’t get to see them on the shared Ldap profile. Thanks ... View more