Questions tagged [palo-alto]

For questions about or involving network products from Palo Alto Networks. For instance, next generation firewalls and advanced endpoint protection.

Filter by
Sorted by
Tagged with
0
votes
1answer
26 views

How to configure u -turn nat in palo Alto firewalls

My requirements is users wants to access public hosted web -sites of same organization from intranet we are having palo alto firewall deployed as perimeter firewalls
0
votes
0answers
31 views

NTP Sync issues between Palo Alto 3260 and Juniper MX10003

I'm using a Microsemi S650 as the primary ntp server and a Juniper MX10003 as the secondary ntp server. I have the palo alto 3260 configured as follows: [edit deviceconfig system ntp-servers] ...
1
vote
2answers
82 views

Palo-Alto Interconnection

I am a novice with PaloAlto networks. For testing purposes, I have connected two PA-220 with each other. I configured the IP addresses from the same subnet. For me, like routers, these devices should ...
0
votes
1answer
34 views

Problem with getting IKEv1 tunnel between Cisco and Palo Alto to establish a tunnel more quickly

I have a Cisco 2901 router that has an IKEv1 IPSec VPN with a Palo Alto firewall. We had a problem with our existing VPN setup where it takes a long time to get the tunnel to come back up when re-...
2
votes
1answer
230 views

Link Aggregation from Cisco to Palo Alto using 10 gig interfaces, port on Cisco shows “waiting to be aggregated”

I am trying to bundle two 10-Gig interfaces on PA-3020 to Cisco Cat9300. Previously, I had bundled two Gigabit interfaces on same devices and everything worked fine. But now, when I try to configure ...
0
votes
0answers
58 views

How do I set per-IP QoS on my router?

I'd like to limit per-endpoint bandwidth on my network to ~10% of available bandwidth, to avoid a single device from consuming all available bandwidth. But I'm not seeing any way to set up a bucketed ...
1
vote
2answers
993 views

Palo Alto monitor bandwidth usage using SNMP

I'm trying to monitor bandwidth usage on my Palo Alto firewall using SNMP. However only the ifInOctets & ifOutOctets counters of VLAN interfaces are updated. The counters for real interfaces are ...
1
vote
1answer
442 views

Why do i need to link a VR to a Vsys?

I'm using a PA-3020 device configured with multiple Vsys and when creating a Vsys I have the ability to assign a specific VR. From my understanding, the connection between a Vsys to a VR is based on ...
1
vote
1answer
166 views

What kind of address is this? 0:0:0:0:0:0:0:0/10

I found this weird address formatting in Palo Alto firewall. Normally this section contains IP Address. This is definitely not an IPv4 Address. admin@PaloAltoFW vsys3(active)> test security-...
0
votes
1answer
379 views

Palo Alto Error Message When Adding a New Tunnel Interface

I am an intermediate, not professional network admin for my own small business. I am attempting to add a new tunnel interface for a new VPN branch. I'm using the same config I have implements many ...
1
vote
2answers
2k views

New RMA'd PA-3020 failing Auto Commit

I have RMA'd PA-3020 which is secondary FW02 for one of the office. PA sent this with 6.0.6 OS whereas my primary FW01 is on 5.0.12. I have configured FW02 via console and later downgraded it to 5.0....
1
vote
1answer
2k views

Unable to login palo alto firewall post rebooting the device!

I would like to give brief background, Please go through the below details:- Palo Alto firewalls have bug for Software version 5.0.12 (Confirmed by PA TAC team) This bug will not hamper the user ...
2
votes
2answers
2k views

Traffic through two firewalls and double-NAT

I have currently configured a PIX501's ethernet0 to DHCP so it gets an IP from my ISP via a Cable Modem. ISP --- --> [ethernet0/dhcp] | PIX501 | [ethernet1/192.168.1.2] --> [Layer 3 ethernet1/1 ...
0
votes
2answers
3k views

Symptoms of an overworked firewall?

I'm working with a customer to resolve some issues with their network, and I have a hunch that their issues is that their firewall is just overwhelmed. However, I've never actually found any ...
1
vote
1answer
10k views

Access a Palo Alto VPN using Mint [closed]

I'm Java developer and sometimes I need to test the development using the database of the client. So they give access using Windows and Mac by a program called Palo Alto Global Protect where I need to ...
2
votes
3answers
4k views

Twice NAT'ing and overlapping subnets

I believe I know the answer to my dilemma, but wanted to pick the NetworkStackExchange community brain. We currently perform Twice NAT'ing for a affiliate we have a peer exchange point with using a ...
7
votes
3answers
2k views

Two ISP bgp topology?

We use palo-alto firewall as an internet gateway. We have 16 static ip-addresses. One is used for outbound traffic (users browse internet) . The rest is used for inbound traffic (mail server, ...
1
vote
1answer
261 views

Palo Alto Router Webserver-log removal

What is the CLI syntax to remove webserver-logs from a Palo Alto router?
2
votes
0answers
650 views

Palo Alto Layer 7 [closed]

I've got the following error for a security policy in PA 3020: L7 processing ; ctd error bypass I tried Googling, but I couldn't find a solution. Does anyone knows the meaning of this? The ...
5
votes
2answers
1k views

How do I remove a rule that was configured on PanOS via Panorama?

I have a problem deleting a rule that was created on Pan-OS via Panorama. I have Pan-OS firewall (5.0.0) that was managed by Panorama (5.0.0), then I added the Pan-OS to a DG and created some rules. ...
3
votes
1answer
5k views

NAT and ACL order - Cisco ASA, Palo Alto, Checkpoint

I've recently begun working with firewalls (Different brands) and what really confuses me is the order the different firewalls check the ACL and NAT rules. For instance, allow HTTP traffic from the ...
0
votes
2answers
235 views

A possibly weird problem

I'm not a network guy, but a system administrator by background. I find myself, now, the sole IT guy at a growing business. (This turned into a long explanation to setup the question, which is at the ...
3
votes
1answer
3k views

Why using Dynamic ip and port when using U-Turn NAT

I have a lab with a palo alto device in a deployment with a host and a server. I set up a mail server in a machine and finally I got all scenarios working fine. The most problematic connection has ...
4
votes
1answer
2k views

Does normal packet flow within a virtual router in a PA firewall require a rule?

I'm trying to understand packet flow within a Palo Alto firewall. Our firewall has one "inbound" leg and three "outbound" legs corresponding to different exterior VLANs. The exterior VLANs are used ...
3
votes
3answers
3k views

Palo Alto - What's the big deal?

Work got a couple of Palo Alto boxes that will be used for a customer. No real gameplan has been issued yet, but I was wondering what exactly sets these boxes apart from, say, an ASA? It appears to ...