About FarzanaMustafa

Hello,   On 14th November at 4:53PM AEDT, we were receiving the following syslog message: "Request made to PublicCloud server returned with HTTP response code : 502" We kept on receiving this message every 5 minutes approximately till 21:46 on the same day.   No change was made at our end, we were still able to browse the Internet, Licenses are valid, we could check the license and dynamic update files therefore I am unable to determine what the consequences of this alarm are.   Can you please confirm if there was any issues on the public update servers?   ... View more

We got certificate tree like this: the public certificate (Trusted root CA) from Digicert, Intermediate cert (Digi root) and then the SSL/TLS cert (DigiVPN). This DigiVPN is going to expire soon and we use it for GP portal and GW. The server cert is by itself and got a tick next to CA column. It is valid till 2023 and used as cert profile in GP.   Just want to know if DigiVPN certificate has to be installed on each client/end machines or only required to be updated/renewed on Panorama. Thanks in advance.   ... View more

Hi there,   I am trying to add a new firewall to panorama management following this guide: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management.html At step 5.2; Export or push device config bundle,  when I choose this option, I cannot see the firewall in the list. I can only see another gateway that is currently managed by this panorama instance.   Under Panorama > Managed Devices > Summary > the new firewall is listed with device state as Connected   Panorama panos:  9.1.2-h1 Fw panos:  9.1.3   Please help! ... View more

Will Path monitoring kick in if Enable HA is not selected? One of the KBs mentioned path monitoring failure which cause the loop condition.   ... View more

What I am wanting to know is if I can add a range of IP addresses to a vulnerability exception. This would be the entire 1-254 range, rather than 1 IP address at a time.   I have already checked the links below and they talk about adding IP addresses one at a time as an exemption. Rather than allowing the vulnerability for the entire site, I would like to allow it for 192.168.1.0/24 for example.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm60CAC   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClhcCAC   ... View more

We have a PA that is displaying this message every 60 seconds for some reason.   "highopaque: DO NOT CHOOSE WMI in ADGMEL03 FOR YOUR USE CASE IF SEE THIS LOG AGAIN"   What is it indicating and how to turn it off? ... View more

How  to force users to download the latest global protect to stop them using old versions? ... View more

Currently we can only see the logs for the files being blocked. Can we set up the logs to allow us to see the successful transfer of a file?   Does Alert/Continue Action of File Blocking Profile log entry in the Monitor > Logs > Traffic?     ... View more

We are currently running a Panorama virtual appliance in PANORAMA mode running on the ESXi host. Based on the predictable logs per second (LPS) estimation, we have allocated 16 CPUs and 32GB memory while the virtual appliance initially built up.   At the moment, we only have one managed firewall connecting to Panorama and sending logs to the Panorama log collector, we noticed that the Panorama CPU utilisation baseline is around 1-2%.   Advised by Palo Alto (reference) that "If the minimum resource requirements are not met for PANORAMA mode   when you Install   the Panorama Virtual Appliance, Panorama defaults to Management Only mode", I would like to know that   after we have successfully install the appliance running on PANORAMA mode, can we then reduce the CPU below the resource requirements and keep it running on PANORAMA mode?   That will be great if we can dynamically resize the resource of the PANORAMA appliance and keep it with the PANORAMA mode, as currently the oversubscribing CPU from the ESXi host will cause the waiting time of other VMs, while the Panorama virtual appliance doesn't need that many CPU resource with the current usage.   Would you please advise? Thanks   reference: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/setup-prerequisites-for-the-panorama-virtual-appliance.html#id4430de3f-a44c-4b24-b9c3-52cef1f0bc96 ... View more

We are using VM-100 and would like to use this as a load balancer for our Web services.   We have checked the link below and would like to know if this  EMCP load balance incoming traffic to Web servers? Or does this just load balance egress traffic between 2 different ISP’s?   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClF8CAK   ... View more

  HIP object is correctly setup.   We are testing the missing patches HIP check object and noticed that an VPN endpoint is showing 3 missing patches (on the HIP report). However the machine is showing it's installed these patches already. How does Palo detect the missing patches as Windows is showing them as installed?   Using ver: 8.1.10 ... View more

Currently in User-ID, one ip address is associated with three usernames. Two of which are the hostnames of the computer and not the user so when the staff tries to access something, they are getting blocked. Do you have any suggestion to fix this? Clearly AD is pulling this information. Do I need to adjust something on Active Directory to fix this?     ... View more

Is there a session limit on number of active connections while using GlobalProtect advanced features?   Currently the PA box 3220 supports 1024 concurrent SSL connections and has a GP Gateway Advanced license installed. ... View more