Good Day Team, Trust you are well, We need your expertise and advise. The enviroment we work with is a full on ldap and multiple on-prem AD servers for autjentication , there has been a shift for some time now whereby the infrastructure and cloud teams has migrated most or if not all services to

Good day Team, Trust you are well, We need your help with your expertise please. We are trying to establish a second EBGP neighborship with Azure Express Route for redundancy and we are failing to form that establishment. There are two Express Route provisioned and the primary has already been es

I'm new to Prisma Access and can't seem to figure out how to block IPs, EDLs, etc from even attempting to authenticate to Prisma Access. If it were on a firewall, the security policy that allows or blocks traffic to the portal/gateway could block it, but it seems that none of the security policy sho

HA Condition - Link Monitor Recovery - Time to retake Active Link Monitor role Hello Community, how is everything going, I hope it's going well. I have the following questions regarding HA. Details of the environment. Active - Passive A/P Main - PA-52XX-01-HA - Priority 50 Secondary - PA-52XX-02-H

Jumbo L2 frames ? MTU only L3 adjust - Inherits L2/Vwire Hi, how are you doing, I hope you are doing well. I have seen that at config level there is little or nothing about Jumbo Frames, so the truth is that I have a big doubt. According to the docs the first step is to manually enable global Jumb

USER-ID log from VPN Cisco concentrator Dear community, how is everything going ? Have you ever had to do the following? We have to integrate a Cisco ASA, with Palo Alto, so that the PA receives from a Cisco ASA and/or Cisco ISE the users to be able to have mapper with USER-ID the users that conn

Hello community and master reaper I hope you are well. I have had to configure Global Protect on several occasions but I have a question that I am being asked in this case: Is it possible in S.O windows to use the Always On, filtering that only connects to GP when it detects the connection in an E

I switched my lab box to the advanced routing engine (ARE), and now I can't run the CLI command "test routing fib-lookup" because it wants a virtual router in the argument, but in ARE there are only logical routers now. Does that mean i can't use the command anymore? There's no way to test lookups

Global couter historical blockages or drops due to asymmetric traffic. Hello, good evening, as always thanks for the collaboration. Is it possible to review the history, not what changed in the last hour, minutes or seconds, but the history of the last 6 or 8 hours ? Is it possible ? If I run a

Best option for a Vwire with tagged and untagged traffic. Hello guys, how are you today ? I hope everthing OK thank you very much as always for the collaboration. What is the best option when it comes to setting up a Vwire environment with tagged and untagged traffic, ie. VLANS=====1 Untagged, vla

Hello - First, any recommendations on which 10.x version to go to from 9.1.x? Secondly, are there any special considerations to be aware of when making the move to a new version level? Fairly large environment running Panorama, Loggers, 100+ FW's.

Good day Team, Trust you are well! I have a query for forwarding Global Protect SAML authentication logs to a siem/syslog.We have multiple firewalls that is managed by a panorama .The Panorama acts a log collector and management that forwards these logs to the siem/syslog server.There is a syslog

I never noticed this before, what does "dropped privs to tcpdump" mean and does it mean I'm not capturing the traffic I want to see? > tcpdump filter "host 1.1.1.1" Press Ctrl-C to stop capturing dropped privs to tcpdump tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 b

ECMP - limitations - Path monitoring Next - Routes to next -VR ECMP Hello community, how are you doing, I hope you are well. A doubt, I saw, I can't find now the post, if it was on live, on reddit or somewhere else but I understand that for an ECMP environment. Example: -Route to 0.0.0.0.0/0 by et

Hello masters, how is everything going? I hope all is well. Does anyone have an idea of this issue and if from any version changes, I'm trying in 10.1.X and nothing. The issue is that I have a custom profile for a user that can only unlock other users that have been locked out especially Global Pr

In the documentation it says that with this option panorama exports a backup of the running config of itself and all the managed devices, but is not clear the next: • makes a full back up or only what changed? • if my backup is configured as daily, makes a backup daily even if there was no change?

IPSEC VPN - Palo Alto to Fortigate ( Forti behind a NAT ) Hello community, as always thank you for your collaboration. I understand that it is feasible, I have not had to do it, but I understand that it is possible to do the following. Scenario: -Palo Alto Firewall Static Public IP directly connec

Good day Team, I would like your expertise on some information regarding Two Sub-Interfaces on a Palo Alto Interface being in the same VLAN Whether the sub-interface resided on the same interface or different interface, and they can be on the same VLAN / tag Are there any limitations that needs to

Hello, thank you community, how are you, I hope you are well. I have a huge doubt. We updated Panorama from 9.1 to 10.1.X The firewalls are still at 9.1.1 Now I get an error that: Device Admin Role for the role based admin has not been defined Now I follow the instructions in this KB: https://

Hi, looking for help. We have a fleet of several hundreds Windows 10/11 devices and we have recently updated Global Protect to v. 6.2.4. About 10% of the devices are unable to connect with the following error message: We have been plagued by this issue even with previous versions and Palo Alto Sup

Good Day Team, I wondering if anyone has done this mirgration from an on-prem VMWare Panorama to an Azure ( this will need to be built/spin up in the enviroment). What are the processes / proceedures or any issues that may arise. Is it the case of backing up the current config , import to the new

Hello how are everyone ? I hope it's ok. As always, thank you for your time, tips, collaboration and good vibes. Has anyone made a migration from a Meraki-MX65 to PA? I have made some several other migrations from other vendors, but Meraki has not affected me, in Expedition there is no declared

I have a Panorama in Panorama mode on ESX. I have 2 collectors that collect logs from firewalls. The collectors are not set to forward logs to Panorama, that I know of, at least I don't see where this would be set, anyway. When I look at Panorama, I see current traffic logs. Is Panorama pulling th

I want to block inbound traffic coming from proxies and VPN services, i.e. services such as NordVPN and Hoxx. I barely knew this existed, but there is a region code "A1" for Anonymous Proxy. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFFCA0 So i created a rule, from

Hello PANGURUS, The X-Forwarded-For Headers option has already been enabled and it has been set to Enabled for security policy, but the information is not visible. Something else has to be enabled in the device configuration or in the load balancer? I followed this kb. https://docs.paloaltonetwork

RMA of HA connected to Panorama - PAN-OS 9.1.x Panorama 10.1.x Hi, I hope everything is ok. I have a question regarding the RMA issue. I have a HA, connected to Panorama, where we have to perform the RMA of one of the firewalls. I have reviewed some links of the process that still is not quite cl

Implementing SD-WAN for the first time. The config commits ok and pushes to hub firewalls ok, but on branches I get that generic error "Failed to autogenerate SDWAN configuration". I looked in configd and I see: Error: pan_cfg_pushtpl_autogen_config_merge(pan_cfg_templates.c:7060): Zones node or z

Active Active Vwire IPS - PA Hello, how are you, as always thanks for the support. A client wants to remove their IPS tipping point and place their PA 1410 there, which only uses 3 L3 interfaces, due to load issues, performance everything is fine, it uses hopefully 1 to 6% of the load. Currently

Palo Alto Web-GUI UI Admin - Azure AD Hello community, thank you as always for your time and collaboration. I have a question, some client is asking me and asking if Azure-AD can be used for authentication of administration access to the firewall... Now with Global Protect we have configured it,