indeed! ... View more

in case you were asking about the email forwarding profile, you can change the port by adding : i.e. 10.0.0.1:587 ... View more

both 25 and 587 are listed as default ports, so there's no need to change these ... View more

Apologies, the correct command is  Show running nat-policy   Try the following: > Configure # commit force       ... View more

hi @AmardeepSuri  packets dropped on the interface may not reach the dataplane (where packetcaptures are performed)    disabling pre-parse will effectively cancel out filters as packets are captured before they are parsed (to filter). The drop packets you are seeing may be the mac frames you see in drop stage, are they 'normal' (no malformation?)   you may be distracted from your original issue:   since NAT does not appear to work, did you make sure the new NAT rules are in the proper order for them to match? rules are evaluated top to bottom with the first positive match being used. this could mean rules further down the rulebase are not hit as a preceding rule is too generic and you will need to reorder your rules   you can check if your rules exist on the dataplane by using the following command:   show running nat-rules   then see if the new rules exist or not ... View more

this is a warning that the SSL traffic passing through might be exploited     from threatvault.paloaltonetworks.com: OpenSSL is prone to a man-in-the-middle vulnerability while parsing certain crafted SSL requests. The vulnerability is due to the lack of proper checks on SSL requests, leading to an exploitable man-in-the-middle vulnerability. An attacker could exploit the vulnerability by sending crafted SSL requests. A successful attack could lead to remote code execution with the privileges of the server.     if you go into your threat logs, you should be able to pinpoint where these connections are coming from/going to and take appropriate action (patch server, block connection, add exception)   ... View more

if it's the user-id agent normalization should happen automatically, check for inconsistencies in the domain map, which is used to normalize: debug user-id dump domain-map   if it looks odd, try clearing debug user-id clear domain-map refresh group mapping debug user-id refresh group-mapping all     and wait for new users to pop up 🙂 ... View more

you'll want to look into normalization the authentication profile contains a 'domain' field which should be set to the netbios name 'orgdom' (no extension) ... View more

those need to be re-added in the backend (there's a recertification process for previously decommissioned devices that are resold via second market) you can reach out to your sales team o they can help escalate this to the right team ... View more

since Palo ipsec tunnels are route-based you can do all the same things as a regular interface as long as both spokes (remote sites) have a route leading into the tunnel for the desired destination IP, they will send it into the tunnel if you then apply NAT in the middle, that will work as long as there are no conflicts (using the same IP on both sides)   is there overlap, or are you simply hiding the source subnet? without overlap this is an easy setup (hide-nat behind an IP on the hub) ... View more

packet-diag logging is not stateful (it does account for NAT), so for a flow basic you need to add filters that account for both flows, and also add a filter for 'stray' packets in case the packet is discarded because the firewall can't match it to a session I usually filter like this: 1. privsrc-pubdest-destport 2. pubdest -pubsrc-srcport 3. pubdest-privsrc-srcport     did you check the global counters for drops ? (retry global counters with the above filters as well, in case a packet arrives 'out of window') ... View more

no, minemeld is completely free and those 'minemeld core team' ones are included for free   you can add subscription servie ones also if you find more ... View more