We are not able to access passive firewall on web gui and ssh. HA1 is configured on Dedicated interface. In high availability status , peer ip is not showing. What could be the reason.       ... View more

We are not able to connect VPN hosted in vpn_dmz zone. We have deployed third party vpn in vpn_dmz zone and configured inbound nat for same. Its old setup , all of sudden we are unable to connect vpn intermittently.   did pcap for vpn public ip , showing below counter after running "show counter global filter packet-filter yes delta yes severity drop" command tcp client reset via TCP responding rst: ... View more

We are import PA5220 firewall backup ( selecting import shared object)  into Panorama VM , but stucked at 99% since last 48 hours.   If we unselect import shared object , job is completing in minutes. But while selecting shared object option its taking time. There are 16000 objects in PA5220 firewall.  What could be the reason for slowness in import job ? Is it because of object counts or Panorama resource ? ... View more

We are using proxy solution for url filtering for which we have deployed ipsec tunnel with cloud proxy server. If we are filtering ACC report for interface and zone we are not able to get proper utilization report. Hence we are trying to export report for tunnel interface as we can see in pan chrome tunnel interface runtime bandwidth is 30 mb upload and 50 mb download.   Is there any alternative way  ?     ... View more

Can we integrate clearpass as a radius server for Global Protect 2FA ? ... View more

We are using standalone M-200 for 5 locations firewall and created collector group with single local log collector of M200.   We are deploying our new M-200 at another location and it will be in HA with our existing M-200. This new M-200 will be Active-Secondary panorama and we will add local log collector of it in existing collector group.   So in existing collector group there will be one local log collectors of each M-200.    Q. If we add secondary peer local log collector in collector group , is there any impact on stored logs ?     ... View more

CVE-2021-3031 PAN-OS: Information exposure in Ethernet data frame construction (Etherleak) Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information from these packets. This issue is also known as Etherleak and is detected by security scanners as CVE-2003-0001.   https://security.paloaltonetworks.com/CVE-2021-3031   Workarounds and Mitigations There is no workaround to prevent the information leak in the Ethernet packets; however, restricting access to the networks mitigates the risk of this issue.   This issue fixed in latest software versions , but we need some workaround.   Can we restrict data plane interface access of NGFW as workaround for this security advisory. ... View more

We want list of users of particular group who are connecting Global protect. Reason behind this requirement is to get number of users from particular group who are connecting GP. So accordingly we can purchase the licence for 2FA from third party vendor. We have added multiple groups for GP authentication , if 100 users in HOD group and from them only 50 users connecting GP. We want list of those 50 users. ... View more