@MP18 Thanks for the suggestion, there is catch in implementing this plan of action, when I try to SSH into CLI via putty after entering credential the putty session disappears, so I can't update the anti-virus via CLI.   The traffic log shows TCP-FIN under traffic log when trying SSH into CLI.   Also, I noticed the clock is one day behind to actual date, since the"setup" tab not available I can't change that either. ... View more

Sorry I was not checking the forum for long time, Thanks for your suggestion, will share the output once we implement the proposed change. ... View more

@Brandon_Wertz    Thanks for the reply, today we had received a request from client end asking to block the traffic coming towards Palo alto which is with TCP option 76, because traffic flows in following order,   1, Email Server 2, Palo Alto 3, Riverbed 4, Internet 5, Cisco ASA  6, Email server   Riverbed configuration similar to below details,   ======================================= Details Steelhead appliances use following   TCP options: Option 76: Riverbed auto-discovery probe. Option 77: OutOfPath NAT. Option 78: WAN visibility transparency option. ================================================= Cisco ASA: Here is a configuration example to allow tcp-option 76 through 78.   access-list riverbed_tcp extended permit tcp any any class-map tcp-traffic match access-list riverbed_tcp   tcp-map allow-probes tcp-options range 76 78 allow policy-map global_policy class tcp-traffic set connection advanced-options allow-probes   service-policy global_policy global   Can we configure the Palo Alto firewall in the same way? ... View more

@gpsriram Have you found solution for this case yet? because we ran into same kind of problem, if you have solution already please post it here. ... View more