Questions tagged [palo-alto-networks]
Palo Alto Networks is US firewall manufacturer and network security company. The company's core product is a series of firewalls designed to provide visibility and granular control of network activity based on application, user, and content identification.
25 questions
0
votes
0
answers
26
views
Palo Alto Policy Issue: A port is Allowed Despite Restrictive Policy
I’m running into a strange issue on our Palo Alto firewall and could use some advice.
We have a security policy set up to allow traffic only on Ports 21 (FTP) and 22 (SSH). The Application field is ...
- 1
0
votes
0
answers
58
views
Palo Alto SSL syslog to LimaCharlie adapter gives error: "conn.Read(): read tcp 10.166.0.29:6514->82.164.196.77:21945: read: connection reset by peer"
I have the following setup:
Palo Alto Firewall ->
Syslog SSL to x.mydomain.com port 6514 ->
Compute Engine Instance with Ubuntu LTS running i Google Cloud with LimaCharlie Adapter ->
...
- 151
4
votes
2
answers
1k
views
Is there a limit of TCP sessions in state TIME_WAIT in Windows?
I am using Powershell to pull data from Exchange via EWS API.
Import-Module "C:\ews_api\Microsoft.Exchange.WebServices.dll"
$ExchangeServer = 'EXCHANGE'
$ExchangeService = New-Object ...
- 377
0
votes
1
answer
926
views
Ansible "hip-profiles unexpected here" Palo alto panos_security_rule
I'm trying to set a security policy on my Palo Alto firewalls using Ansible with the panos_security_rule module.
However, I keep running in to the same error, hip-profiles unexpected here.
I found ...
- 75
0
votes
1
answer
923
views
Exchange 2019 ActiveSync internal network native iOS Mail not working
Im in the process of migrating from Exchange 2013 to 2019. During this process I changed my routings (mail flow, OWA,...) to the new servers.
Public-Routing: Public DNS Record --> Azure ...
- 11
1
vote
0
answers
3k
views
How to connect Strongswan to palo alto firewall
I'm trying to create a tunnel between StrongSwan and palo alto. StrongSwan is running on a digital ocean droplet, Ubuntu. In my ipsec.conf, I have:
conn %default
ikelifetime=28800s
keyexchange=...
- 121
1
vote
0
answers
614
views
GlobalProtect VPN over VPN on MacOS
I am using GlobalProtect VPN client to access my company's network. I also have a personal IPSec VPN server. I would like to access to my company's network after my personal VPN, I mean I want to ...
- 11
0
votes
0
answers
2k
views
Palo Alto dropping Global Protect traffic intermittently
Everyone, hoping I'm posting to the correct forum, Palo Alto support hasn't been able to solve this yet for me.
Users with Palo Alto Global Protect installed are seeing their packets get denied by the ...
- 1
1
vote
2
answers
973
views
Send VM Traffic through Palo Alto Firewall in ESXi
I have a Palo Alto VM Series Firewall that I've spun up in an ESXi 6.0 box. How can I have the PAN act as a transparent firewall to all VM's on the box?
I was expecting that I could use two ...
- 2,228
0
votes
1
answer
728
views
Configuring multiple ISP routers on a PA-850
I am researching an configuration for our Palo-Alto 850 firewalls. We currently have 4 ISP routers coming into our facility (1x MPLS/Fiber, 1x cable and 2 DSL). We would like to connect these to a L3 ...
user560069
0
votes
1
answer
9k
views
Change password on Palo Alto Networks firewall has no effect
By default, the Palo Alto Networks PA-220 ships with superuser name admin / password admin. I can change these (either via ssh > set password or via the Web GUI Device > Administrators > ...
- 241
0
votes
1
answer
852
views
Palo Alto and nfdump: No matched flows
I am new to netflow so maybe I have the problem is about understanding, but I have not found references on what is happening.
I have a Palo Alto PA500 firewall and I am trying to extract netflow ...
- 101
-1
votes
1
answer
1k
views
How do I get a site unblocked from corporate firewalls
I have a pretty new site, nothing shady has ever happened with it, some of my friends have reported that they can't access said site at their company. How can I figure what lists I'm on and how to get ...
- 331
1
vote
2
answers
3k
views
IPSec between Palo Alto and Strong Swan - traffic between tunnel endpoint IPs (used for ESP transport) should pass through tunnel
There is a Palo Alto firwall (which I have to configure) and an industrial controller (they call it CP) which I don't control.
Say Palo Alto has external IP 1.1.1.1 and CP has 2.2.2.2. These are the ...
- 611
-1
votes
1
answer
395
views
DNS static work but DNS dynamic from dhcp pool doesn't work
So we have 2 dns servers,
DNS-Server-A: 20.20.33.82 (normal dns server which I don't have access to it)
DNS-Server-B: 172.30.11.254 (palo alto with dns proxy)
Core Switch DHCP pool configuration:
...
1
vote
1
answer
5k
views
Eventual 504 Gateway Timeouts when Nginx/Puma Rails App server is contacting a PostgreSQL backend through a firewall
I've been running into an issue where a Rails app server (nginx/puma) and a PostgreSQL data server communicate consistently when on the same VLAN on our DMZ, yet when the database is isolated to ...
- 13
0
votes
1
answer
1k
views
iOS Outlook Activesync works, iOS Mail Activesync doesn't
We have a guest wifi network that is in a DMZ-like zone on the firewall. Our Exchange 2010 servers are in the "inside" zone of the firewall, with 1-1 NAT to public IP addresses in the "outside" zone.
...
- 2,873
5
votes
0
answers
6k
views
Palo Alto Globalprotect - connect via cmd
Scenario: Windows box having the Palo Alto Globalprotect vpn client installed.
Is it possible to use commandline or powershell to connect the vpn client to a remote host?
I know this is possible ...
- 153
0
votes
3
answers
1k
views
AWS VPC VPN connection and NEXT-HOP issue
all-
So, I have my VPN tunnel up between my DataCenter and my VPC. The device (terminating) is a PAN200, PAN OS 4.xx
Traffic passes normally; SQL, RDP, AD, DNS, etc and PING from AWS side to DC side ...
- 11
3
votes
0
answers
378
views
RANCID - timeout connecting PALOALTO in HA
When rancid try to connect via SSH to PALO (the active one) i get a time out message.
Connecting manually everything is ok.
I believe is something related to prompt containing parethesis.
add user ...
- 43
2
votes
1
answer
2k
views
Palo Alto PA-4020 cannot connect to terminal through Serial to USB
I have a PA-4020 that I messed up the configuration on, and I am trying to do a factory reset. I went ahead and ordered a few different serial to USB cables, and cannot connect through a Mac App ...
- 643
1
vote
1
answer
3k
views
Palo Alto and 802.1q
I have a Palo Alto firewall connected to a link that runs 802.1q and the provider has assigned a specific VLAN for us to use.
However I cannot ping the other end of the link, if I replace the Palo ...
- 267
0
votes
1
answer
1k
views
How to config Squid SSL bump to let Paloalto PA series firewall recognize App-ID
A Paloalto firewall(PA-2050,POS 4.1x) was capable of recognizing the websites which users are visiting(thru http/https) then flag them with a App-ID and apply application control on the traffic, for ...
0
votes
1
answer
93
views
External Client should use our proxy to get filtered by our firewall
I would like an external client (4.3.2.1) to use our proxy (9.9.9.9) which forwards traffic to our firewall (8.8.8.8) which then forwards the traffic back to our client (4.3.2.1).
So I'm curious if:
...
- 506
1
vote
1
answer
6k
views
Log incoming traffic on PAN-OS (Palo Alto Networks) firewall
Have a Palo Alto Networks PA-200 firewall with the basic setup complete, all outgoing traffic allowed and working fine.
This is showing up in the traffic logs going from the created internal and ...
- 3,480