Cloud PKI and Global Protect user authentication

Hi, We are trying to deploy the user authentication for Global Protect using Cloud pki Azure certificate. Anyone has deployed this successfully. A certificate has been generated in Cloud pki and imported to Palo alto VM-100. Also we have pushed the certificate via intune to client devices for testing. it didnt worked. any idea?

VM-series Failover issue

We have deployed Palo Alto VM-Series firewalls in Azure in Active/Passive mode. When the active firewall fails, the passive firewall successfully becomes the active one. This behavior is reflected correctly in both the firewall interface and the floating IPs within the Azure portal, and the traffic flow is unaffected during this transition. Ho...

AWS VM Series GWLB with Overlay routing - outbound and inbound

Hi, I’m using 2 active VM series firewalls for outbound sessions with overlay routing, with GWLB and Transit Gateway (TGW) between the Application VPC and the Security (firewall) VPC. This is working as expected. Inbound connections fail to establish. The need for overlay routing is for managing NAT and VPNs on the firewall. An external (3rd pa...

PA-VM in AWS with Decryption Rule - server side connection kept open

Hello, running 11.1.2-h3 on AWS with decryption rule. The setup is: Windows Client --> FW --> Web-Proxy --> Internet Firewall decrypts the traffic (so firewall itself acts like proxy). After the client side connection is closed with TCP-FIN, the firewall keeps server side connection to Web-Proxy and both firewall and Web-Proxy exchanges...

Ingest Palo Alto logs to SIEM tool (Splunk) using Eventhub

Hi All, We're looking into some sort of cloud-based solution to route our Palo Alto firewall logs to across our customer base. I was intrigued by the Event Hubs (https://azure.microsoft.com/en-us/products/event-hubs/) solution as a way to push logs to it and then ingest them from there into our SIEM (Splunk). Is there a way, we can directly pu...

Palo Alto VM series deployment in Azure Cloud

Hello Everyone, We are planning to deploy two VM series firewalls in our Azure landing zone. In our case, Palo Alto firewall is like a data center firewall and we have a Fortigate in the perimeter. All outbound traffic from cloud servers will hit the Palo Alto first and then move to the Fortigate and then to the internet. All inbound traff...

Does PA VM-Series Firewall support Sub interfaces in OCI Cloud?

firewall deployment in Azure Vmware solution (AVS)

Hi All , We are exploring options to deploy PA VM series firewall in AVS setup . Could you please share any document which we can refer to start our deployment . Thanks ,

PaloAlto integration with Azure GWLB

Hello!i'm trying to integrate 2 PaloAlto VMs with Azure GWLB. i found out this guide from PaloAlto: https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/deploy-the-vm-series-firewall-with-the-azure-gwlb i didn't use the ARM template, so i'm trying to configure manually the gwlb parameters i...

Palo VM - The system is shutting down due to masterd initiated

I have a VM series Palo running 10.1.11-h4 and the system log is showing that the device has a system shutdown with a description of the following: The system is shutting down due to masterd initiated. I have not had much luck researching this error or why the Palo VM keeps shutting down due to this error. It was sporadic in nature but has bec...

VM-Series from Azure Marketplace: Unable to select existing VNet

I am trying to deploy the VM-Series Next-Generation Firewall from the Azure Marketplace. I want to deploy it on my existing "hub" VNet. If I select the "Single VM" plan, the Networking tab in the deployment wizard allows me to select my existing VNet. But if I select the "High resiliency with Load Balancers" option, I can only proceed if I sele...

Public ENI not showing up on VM Palo Alto Firewall

I have a vmseries firewall deployed on an ec2 instance. I have and private ip assigned to the internal and external interfaces via dhcp. I have attached a EIP to the external facing ENI. Once I assigned that EIP to the external ENI I rebooted the firewall several times and the public address is not showing up at all. I tried building a Dynamic N...

Route internal EC2 with public and private address through private PA to the web

I have an EC2 instance in a private vpc that I'm trying to route through a security VPC hosting a palo alto firewall. My issue at the moment is getting the traffic to pass through firewall to th IGW on the security VPC. I have been able see traffic trying to get through but is timing out. the Untrusted Interface on the firewall does not have an ...

Required CSSP ID for Palo Alto device hosted on GCP

We need to access support for Palo Alto, for that we're registering our devices to the Palo Alto portal and for that we need CSSP reference Id which is a google marketplace specific Id for the devices.