VM-Series in the Public Cloud

Welcome to the VM-Series in the Public Cloud Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

how to setup palo alto for dual stack for IPv6 internet

Hi, I have configured PAVM in azure with IPv4 and everything is working fine. so I decided to add IPv6 as a Dual stack. And Azure provided me single Public IPv6 and it configures on the Azure load balancer and mapped with an untrust interface on the firewall with my private IPv6 range fd6e:8b94:25ca:b001::/64, and on trust interface range is fd6...

GP vpn slow perfomance is AWS N virgina region

Hi User reporting Global protect vpn perform slowness even in spilt tunnel while accessing the AWS resource , palo alto vm deployed in AWS us region and all AWS resource are on US region.

AWS keypair failing authentication to PA-VM

AWS ssh publickey failing while connecting to PA-VM, falls back to password authentication which obviously fails. I suspect some of this behavior is due to macos and openssh deprecating ssh-rsa, PAN-OS 9.1.14 offers ssh-rsa which is rejected by default, -oHostKeyAlgorthms=+ssh-rsa will avoid this issue. Also tried -oPubkeyAcceptedKeyTypes=+ssh-r...

Azure multiple public front ends on load balancer

Using multiple front end IPs to split my internet facing applications. Seemed to solve the health probe issue with splitting static 168.63.129.16/32 azure routes between virtual routers, but inbound traffic doesn't seem to know where to go. Single public application worked no problem, as soon as second front end IP is added, the VM series stops ...

FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

I have a "HA" pair of firewalls in Azure sitting behind an external Load Balancer. I have a FTP server that I have to configure behind the firewalls. I am able to connect locally to the FTP server and it works as expected, but when I point the FTP client to the Public IP address of the LB, I am able to connect, but not get the directory. I am ...

Azure NAT Rule closing VPN Tunnel

Good Afternoon,We have a VPN tunnel established b/t an Azure VPN GW and a PA 3020 running 9.1.10.We need to add a NAT rule on the Azure side. When we apply the NAT rule, the tunnel closes.Azure docs on this topic are less than helpful and I have not found an article or guide here yet. Appreciate any recommendations. Thanks.

VM-300 Inaccessible and Failover Occurred

Hello all, Currently, my customer is working on 9.1.12-h3 and they experienced Inaccessible and Failover Occurrences in VM-300. Therefore, I looked around TSF and found out that failover proceeded after the message pan_hash_init(pan_hash.c:113): nbuckets 2000 is not power of 2! MP and DP are stable.[sysd.log]2022-09-29 06:09:51.126 +0800 De...

Deploying Panorama to Azure gaining initial access.

I am deploying a Panorama VM into Azure. I setup the VM according to the documentation at https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/install-the-panorama-virtual-appliance/install-panorama-in-azure but have not been able to gain access to the machine as of yet. I made it to...

Cannot connect VM series firewall to Panorama in AWS

Hello, We are trying to set up a new deployment in AWS consisting of two firewalls managed by a Panorama server. For starters, we deployed one firewall and one Panorama instance. They are in the same VPC, different subnets. Security groups currently allow all TCP to/from the Panorama server and the firewall. Both Panorama and the firewall ha...

Palo VM-Series

Is it a requirement that the subnets within Azure be named "Trust" and "Untrust" I currently have them named to Inside and outside and wanted to make sure this wouldnt case something to not work/route etc...

Is there a document related to azure HA Link and path monitoring function support?

According to the Admin guide, there is a phrase that does not support link path monitoring in the case of aws, but the contents of Azure are not mentioned https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/device/device-high-availability/ha-link-and-path-monitoring But Azure doesn't seem to have this function either Is t...

Configure global Protect with AWS VM series firewall which is working with AWS Gateway Load balancer

I have deployed two separate VM series firewalls (without HA) on AWS with AWS gateway load balancer. east west traffics are seams to be fine. But for the global protect VPN configuration with the AWS gateway load balancer not working.

Are you using certificate profiles for Azure SAML authentication?

Setting up SAML authentication for the first time from a new Azure instance and having multiple issues. I had an idea how it would work, that Azure would provide an internal CA and SAML gateway (IDP) certificate, and then assign us a certificate (w/private key) to use on the firewall. However, we are only getting a self-signed certificate for th...

Overlay routing for specific VPC

In AWS, I know how to enable overlay routing using the following commands: request plugins vm_series overlap-routing enable yes, but can we have VPCs in a specific account handle overlay routing and VPCs handle overlay routing?Is there only an option to handle full overlay routing?https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deploy...

AWS instance admin admin not working after reset

As per the subject line I had to do a reset on an AWS PA VM and admin admin is not allowing me to access the command line.The reset was done by the following command:>request system private-data-resetAny hints or tips on how I can access the device?

Discussions