VM-Series in the Public Cloud

Welcome to the VM-Series in the Public Cloud Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

How to setup VM-Series behind Azure Public Load Balancer using Loopback

I'm trying to set up two firewalls behind an azure public load balancer. I found a set up on Git Hub that basically says you can do it if you use active/standby and floating IP and you essentially map the front side of the load balancers IP to the firewall on a loop back. The health checks keep the secondary box down because it's in standby mode...

VM-100 model cannot download software.

Hi, Recently, two VM-100s in my operating environment have encountered the problem of not being able to download software through the GUI.The situation I encountered is that the download speed is very slow, and then the result will fail.Other external updates of the firewall, such as app-id update and clicking "check now" to check the software v...

AWS GWLB integration with Palo VM and PBF to tunnel interface

AWS Palo VM can integrate fine with AWS GWLB. It can receive GENEVE packet on eth0 and overlay route to untrust interface to reach internet. when we try to steer the 80 and 443 traffic to a tunnel on that Palo VM for proxy inspection, our packets are not leaving tunnel interface on the firewall. TAC found its a bug . Does any one able to ac...

Can I make a security rule with XFF IP in source address?

Hi Community, I already set XFF configuration via guide documents. So I can look at XFF IP in Traffic logs and URL Logs. I would like to make a security rule to allow only A.B.C.D XFF IP in source address. Unfortunately, I don't know how to set it. And there isn't any document detailed. Can you help me to fix it? Thanks in advance.

The decryption performance of one-arm deployment will be lower than that of two-arm deployment mode ?

The customer deployed VM-300 with one-arm deployment in AWS (one vpc) and enabled decryption function, but found that the decryption performance was much lower than the deployment mode of two arm. Does anyone know why this is?

Best option HA Palo Alto AWS - VPN Site to Site - Full fail over no balancing charge -only FailOver -

Best option HA Palo Alto AWS - VPN Site to Site - Full fail over no balancing Hello, how are you doing, I hope you are well. In your experience, those who are clear about it and those who are not, what is the best way to implement an HA in AWS? I understand that for full Native HA from Palo Alto, it can be done in two ways according to a Pal...

PA-VM Recommended PANOS Version

Hi Community Please can someone point me in the right direction. I am trying to find out what the current recommended PAN-OS Version is for a PA-VM Series Firewall. Thanks in advance for your assistance.

How to configure ingress to Azure Load Balancers with PaloAlto-secured network

We have a setup where we're using PaloAlto to secure outbound traffic from Azure. I have two Azure load balancers sitting in front of PaloAlto; "palo-alto-external" in front of the Untrust interface that has a private IP address on the frontend, and "palo-alto-internal" in front of the Trust interface that has a public IP address on the frontend...

Palo Alto On AWS - Ipsec VPN IPSEC Site to Site connection - NAT-T - IP Mapping

Hello Live Community, how's it going, I hope it's going well. One question, I have the following doubt. Soon I have to generate a Site to Site VPN connection, between a Palo Alto On-prem and another Palo Alto that is in AWS. I understand that the Palo Alto on the AWS side, the Palo Alto does not have a direct public IP on the interface, ther...

Latest PAN OS

Hi, Could some one please share the latest stable PAN OS version for VM series NGFW and Panorama.

PANOS upgrade VM-100 over KVM Virtual environment

This is the our internet firewall hosted by our ISP in the cloud. I am currently in PANOS Version 8.1.3 on PA-VM-100. The VM mode is KVM. And now they have the new PANOS version 9.0.0, when I tried to download, it reaches half way and fails with: Failed to download due to generic communication error. Please try again later.Does anybody has solu...

Location of new versions for AWS Palo Alto version

Apologies for asking such a basic question. Where can I find new versions of Palo Alto OS (also updates) for an AWS EC2 installed Palo Alto firewall. I need to manually download all files. Also if you accidently attempt an incompatible OS type will the existing system warn you ?

AWS PA, error on SSL forward decrypt

Dear all I am trying to configure SSL inspection on a Palo Alto in AWS. Despite the configuration with client certificate and device CA and SubCA is (as far as I can verify) the same as the one on the on-premises environment, I still get errors like. Received a fatal warning CertificateUnknown from the client. Received a fatal warning UnknownCA ...

Redeploy VM-Series in AWS using existing subscription

We deployed a VM-Series firewall bundle in AWS with an Annual subscription but it's primary IP address is in the wrong subnet. How can we redeploy the the firewall using the existing subscription agreement? Thanks

Hosting a private python package manager in Azure or AWS

I work in a small team of Python developers and our aim is to create a private package manager to store our packages. I came cross pypicloud and following its tutorial I've successfully been able to upload and install packages stored in AWS-S3. That's fantastic.However, the private package manager is launched and hosted locally typing pserve ser...

Discussions