Next-Generation Firewall Discussions

User Identification Agent Error Access Denied

This is the error I'm getting when I have runed a command

- less mp-log useridd.log

2025-05-12 13:56:46.879 +0530 Error: pan_user_id_win_wmic_log_query(pan_user_id_win.c:1688): log query for AD-Server failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Acces

To force NGFW login using SAML/SSO

Is it possible to use SAML/SSO login instead of manual credential username/password. 

Currently in the GUI page, we can either use manual credential / and SSO, but is it possible to force Admin to used SSO method instead.

Packet Flow Sequence KB is Missing

Hello community,

There was a very good KB explaining the packet flow sequence on a Palo Alto firewall. It was an excellent resource both for study and tshooting because it contained a detailed list of steps on how the firewall processes the packet fro

AZURE Entra MFA for admin access via CLI

We are easily able to setup MFA for the Web UI for the management port vial SAML and Entra SAML auth. We have run into some challenges I was surprised exist. First here are the requirements and goals

• PA VM series firewalls in  AZURE.
• No On prem AD, IS

URL games allowed through while blocked

HI Gang,

Fairly new palo user here 

I'm having a headache where I have configured URL filtering to block students from accessing games. I have decryption in place however they are freely accessing those games (the site is both categorized as low

Bottom most Explicit deny all policy not capturing URLs for Url filtering logs.

So we have a URL filtering profile, which when enabled i can see URL filtering logs for a any any test policy, however there is a Deny All policy we created at the bottom most in policy, I have enabled URL filtering profile for that rule. I am seeing

PA 850 ETH1/1 disabled

Need your help we setup a new PA850 to replace our PRIMARY FW in EUR. Now the config has been push to the device however, i'm seeing the eth1/1 is disabled for some reason.

Is there a command that I can forcefully enable it? even on GUI it shows RE

Ipsec tunnel monitoring issue

Hello All,

Iam having a issue with paloalto tunnel monitoring.

I have configured tunnel monitoring between Paloalto and fortigate firewall,

Inside tunnel i have 6 to 7 proxy ID.
one proxy id i have created for tunnel ip traffic and remaining all are norm

The same traffic is getting allowed by one rule and blocked in firewall by another (please refer scrnshot)

So we have a explicit Deny all rule at the bottom most, and there is another rule by which the same traffic is also getting allowed.

The allowed rule has dest as any and has URL category in it with service as https.

So if u can see the screenshot s

URL Filtering: Categories for Suicide Promotion/Self-Harm Promotion

Hi!

Unless I've been dumb enough to miss them, the Palo Alto URL filtering database lacks a category for suicide/self-harm promotion sites. I've now been asked for a second time if we could block such sites. As a higher education institute, we're r

Meraki clients unable to access internal resources

I'm having an issue where devices on the internal network cannot access internal resources. Ping works, but browsing on 80 or 443 does not.

Devices are on the same vlan, subnet and Palo Alto security zone as the wired devices. Wired works, wireless

Palo alto denying the traffic randamly

A simple rule is created in my firewall, where the traffic is allowed from our servers to the fqdn which is reaiding in internet. Application is as any and in service 443 is allowed.

Sometimes firewall is allowing the traffic , sometimes it is denyin

Issue with Path Monitoring on Secondary ISP in Palo Alto Setup with Three ISPs

We’re using three ISPs (Primary, Secondary, and Tertiary) in our Palo Alto firewall setup:

• Primary: Ethernet 1/1 – Metric 10 (Path monitoring enabled with conditions set)
• Secondary: Ethernet 1/2 – Metric 20 (Path monitoring enabled with conditions set

Ha failover for A/A firewall

Hello All,

We have a setup of Active/Active firewall running with eBGP towards  router 1 and router 2 respectively  and static route for  Lan segment (subnet 1 and 2).

eBGP with As-path prepend for subnet 2 at firewall 1 and As-path prepend for subnet

Vlan extend layer 2 - Pair of firewalls HA (Active passive) in differents Sites

Is it possible to extend a VLAN across two pairs of Palo Alto Networks firewalls in an HA (active-passive) configuration located at two different sites (Site A and Site B), while allowing each HA pair to use the same virtual IP address range?

What are