About rmfalconer

Do you have your browsers configured to use the proxy settings and point them at the PA? If so, I wasn't aware they could do this.  As far as I know, the forward proxy is really meant as SSL decrypt when browsing. Traditional web proxy features like caching aren't available on the PA. Is your HQ accessed over the internet or a private connection like a VPN tunnel? ... View more

Pretty sure that's not possible. The PA can use the XFF entry but can't insert it. Why do you need the PA to insert XFF?  ... View more

What do your logs show? ... View more

You need to have redistribution to get the default between routing protocols. Are you taking full tables from the ISP? What are the other prefixes? ... View more

If you change the management address on a PA, it will update Panorama with the new info automatically. I had to do this recently and it took a couple of minutes for the new addresses to appear in Panorama. ... View more

Let's say the url is 1.abc.vpn.contoso.co.uk, then you would need a wildcard for *.abc.vpn.contoso.co.uk. *.vpn.contoso.co.uk would not work for 1.abc.vpn.contoso.co.uk The * only functions at one level.   ... View more

What's the CN on the cert? If it's *.contoso.co.uk, it won't work. You would need *.vpn.contoso.co.uk. This isn't a limitation of GP, it's the behavior with any certificate.  ... View more

ASA interfaces that communicate for failover need to be on the same L2 segment. ASA also needs a failover interface. Unless you've left some things out of the drawing, I wouldn't expect this to work. Consider putting some L2 devices between the layers. ... View more

Did you create a certificate authority on the PA and then use that to issue the device certificate? The root certificate from the PA would need to be imported into your local machine's certificate store, not the device certificate. For the device certificate to be trusted by your PC, the root that issued it needs to be trusted. For actually generating the certificate, you'll probably need to use an actual name as the CN, not an IP address. Most authorities won't issue with an IP address as the CN. If you want to include the IP as a valid entry, create it as a SAN entry on the cert using the IP field. You should also include the CN in the SAN entry as well. Try this: Create a root authority on the PA: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/certificate-management/obtain-certificates/create-a-self-signed-root-ca-certificate.html Export this root certificate and import to the trusted root store on your computer. Generate a device certificate on the PA signed by the root you just created:  Common name: firewallname.company.com  Attribute Hostname: firewallname.company.com  Attribute Hostname: firewallname  Attribute IP: 172.16.3.30 Then assign this cert to your SSL/TLS profile.   ... View more

I assume the only way a machine can access resources through the tunnel is with static routes. Firewalls need to see everything in the 3-way handshake or they will drop traffic. In your scenario, the PA will not see the syn-ack since the return traffic bypasses the PA and returns directly to the host.   Why use an ASA for a VPN tunnel instead of just using the native capabilities of the PA? It's all standards based PAs connect to many other vendors with no issue. Why is the inside interface of the ASA on the inside of your network instead of in a DMZ off the PA so it can filter the traffic between you and your partner? Also, 8.0 code is end of life so you should think about an upgrade. ... View more

For procedure 1, if you use a firewall self-signed cert for the web management, you're workstation won't trust that cert unless you import the firewall CA certificate on to your workstation.    For procedure 2, you don't need to export/import the device certificate. If your workstation trusts your internal CA, then your workstation will trust any certificates issued by that internal CA wherever they are installed.   What's the message if you click on 'Not secure'? It will usually point you in the right direction for troubleshooting. What does the subject and subject alternative show in the certificate details? ... View more

I've set this up in ISE, not on a Linux server running tac+. I found that I have to pass the first three attributes from that link: service, protocol and PaloAlto-Admin-Role. Each of these are set to type of Mandatory. Without all 3, it didn't work. ... View more

Not sure if it would help in this case but there's also a CLI command to move rules. If you have a list of the zero hit rules exported to csv, you could pretty easily get the correct format and paste them in. move rulebase security rules XXXX bottom ... View more

I think using the GUI would be easier in this case. Filer the security policies with (action eq 'deny') or (action eq 'drop') [or whatever action you want to filter on] and export to CSV.  It shows rule name, src/dst addresses, zones, plus other info. At that point, you can just hide any columns you don't want and you'll have what you're looking for.  ... View more