5 votes
Accepted

Problem with getting IKEv1 tunnel between Cisco and Palo Alto to establish a tunnel more quickly

It seems you have a wider issue that this specific message. 10 minutes to re-established a tunnel is totally abnormal. Here is a few points you should check: don't use IKEv1 anymore, switch to IKEv2 ...
JFL's user avatar
  • 19.7k
3 votes
Accepted

Palo Alto PA-3250 default credentials at PA-HDF login prompt (after factory reset)

Summary I opened a Palo Alto support case. According to Palo Alto tech-support, you have to: A) Connect an RJ45 serial cable to the firewall's console port at 9600-8N1. Typical light-blue Cisco RJ45 ...
Mike Pennington's user avatar
3 votes

Paloalto:Same segment but different zones

That’s an invalid configuration. You can’t have two zones (and interfaces) in the same subnet.
Ron Trunk's user avatar
  • 67.5k
3 votes

Link Aggregation from Cisco to Palo Alto using 10 gig interfaces, port on Cisco shows "waiting to be aggregated"

The problem turned out to be two different types of physical interfaces on Palo Alto. PA3020 has two different types of SFP ports (1 gig abd 10 gig) which I forgot.
Ankit Badani's user avatar
2 votes
Accepted

New RMA'd PA-3020 failing Auto Commit

In my experience replacing a device in HA with different PanOS version, I encountered problem exporting config from a device and imparting it to another with different version. There are small ...
KorXo's user avatar
  • 1,152
2 votes

What kind of address is this? 0:0:0:0:0:0:0:0/10

That appears to be a very strange IPv6 prefix. The IPv6 address 0:0:0:0:0:0:0:0 (canonically represented by ::) is the Unspecified Address. I have no idea about the mask length of 10 that is ...
Ron Maupin's user avatar
  • 99.6k
2 votes
Accepted

How to configure u -turn nat in palo Alto firewalls

Essentially all you need to do is set the source zone to your internal zone, the destination zone to your external facing zone, the destination interface to be "any", the source address to ...
Jesse P.'s user avatar
  • 4,690
2 votes
Accepted

NTP Sync issues between Palo Alto 3260 and Juniper MX10003

This was resolved after modifying the format of the authentication key in the Juniper router. We had to enter the key a specific way. For example, if the key was ...
Ben's user avatar
  • 157
2 votes

Palo-Alto Interconnection

Dudes, thanks for your answers. Solved the problem. But I forgot to write here. I should have configured mgmt profile for pinging PA interface and besides that, I forgot to configure netmask.
Simral Abdurahim's user avatar
2 votes

Why configuration file of Palo Alto doesn't contain local policies?

This article from Palo Alto details how to export a config to an XML file. Essentially, you just run the command: save config to <xml file name> if you're using the CLI. From there, it's just a ...
Jesse P.'s user avatar
  • 4,690
2 votes
Accepted

Traffic sent to GRE Tunnel fails, but GRE Tunnel is up and OSPF adjacencies are formed

It turns out the Palo Alto tunnel inspection policy was the root of the issue. Once I disabled the policy in each firewall, I was able to ping through the tunnel. I used traceroute to verify from ...
Ben's user avatar
  • 157
2 votes

Paloalto:Same segment but different zones

Firewall can ensure connectivity among different zone by framing security policies among different zone and allow communication between different zone But in your scenario trust zone & DMZ zone is ...
Sagar Uragonda's user avatar
1 vote

Palo Alto 440 and FS 5860 Switches -- L2 Loop/Spanning-Tree issue

Your are trunking VLANs 1 and 600 across the Palo Altos on the bridged ports ethernet1/2 and ethernet1/3. However, the PAs are apparently not taking part in the RSTP. If we assume they're not ...
Zac67's user avatar
  • 84.4k
1 vote

Switch Port channel down but firewall did not log the port down event

From Cisco: Error Message ETHPORT-5-IF_TRUNK_DOWN: Interface [chars], vlan [chars] down Explanation: Interface [chars] is trunking, VLANs [chars] are down Recommended Action The following ...
Ron Trunk's user avatar
  • 67.5k
1 vote

Palo Alto Firewall: Why is double NAT needed?

Apparently, your border router (BR) doesn't know 192.168.x. network. It only knows 172.16.1.0 network and how to route it. Also, Palo Alto has demarked 192.168.x space as private (secured) so it doesn'...
Rais's user avatar
  • 352
1 vote

Ikev2 ipsec issue between Asa and sonicwall (issue resolved) but need understanding

These are the default settings that appear when you go through setting up a site to site via VPN Wizard. These are the default settings that appear when you go through setting up a site to site VPN ...
Jason Owens's user avatar
1 vote

Palo Alto monitor bandwidth usage using SNMP

We are monitoring Palo Alto 3020 with Solarwind NPM and able to get in BW usage logs for both VLAN & physical interface. You can refer the below link for detail config https://knowledgebase....
shailendra harinkhede's user avatar
1 vote

Why do i need to link a VR to a Vsys?

As I understand it, a Vsys is a virtual instance you can assign your virtual routers (VR) to. You can't connect them since a Vsys is the scope of a VR. Check Virtual Systems: DEFINING VIRTUAL SYSTEMS ...
Zac67's user avatar
  • 84.4k
1 vote

What kind of address is this? 0:0:0:0:0:0:0:0/10

0000::/8 is reserved by IETF, so 0:0:0:0:0:0:0:0/10 is not a valid address/prefix currently - see RFC 4291. 0000::/96 had previously been defined as the IPv4-compatible IPv6 address prefix, ...
Zac67's user avatar
  • 84.4k
1 vote

New RMA'd PA-3020 failing Auto Commit

EDIT: PA TAC declared buggy behavior and blamed it on to the OS version. The process to sync a 5.0.12 with 6.0.6 was not recommended. Later post upgrading the standalone box to the latest version (as ...
Rounak's user avatar
  • 43
1 vote
Accepted

Unable to login palo alto firewall post rebooting the device!

PA TAC confirmed this as a bug with the software version and had intimated other customers post our feedback. Thank you all for assistance.
Rounak's user avatar
  • 43

Only top scored, non community-wiki answers of a minimum length are eligible