Palo Alto device certificates are required for devices that need to communicate with Palo Alto cloud services. There are two ways to install them - one is directly from the firewall itself, while the other one is for Panorama managed devices.
There is a 'funny' situation when installing Palo Alto GlobalProtect client for RA VPN. If you are using SAML to authenticate your users, with the default installation it will use builtin browser to open SAML IdP.
I ran into an interesting problem recently - one of the firewalls I manage had to be upgraded, but the problem immediately showed up when I tried doing an image upgrade: I went to Device -> Plugins and there was the perpetrator openconfig-2.0.0 plugin that was installed. I tried removing the config
Cloud Identity Engine (CIE) is a cloud-based service designed to simplify identity and access management across different environments, including on-premises, cloud, and hybrid setups.
We recently had a situation where firewall was complaining that it can't download software anymore with an error message An active license is required for this feature. Firewall was properly licensed and it was synced with the license server, but for some reason, it was still complaining about it.
IP-tag functionality on Palo Alto Firewalls allows administrators to apply custom labels or tags to IP addresses or ranges. These tags serve various purposes, such as simplifying policy creation and management by grouping similar IP addresses together under a single tag. Additionally, IP-tagging ena
Palo Alto network appliances natively support SAML and can leverage providing identity to a SAML Identity Provider. This can be very useful in multiple ways - granting access to admin GUI interface, authenticating users for GlobalProtect (remote access VPN) and Captive Portal user authentication are
I recently started moving all of my VMs to Proxmox, and even though I already had one PA firewall running under Proxmox, I was not very keen on tackling the task of migrating Panorama. I have two Panorama nodes running in HA in mgmt-only mode, and in addition to those, I also have two Panorama insta
I've noticed on some of the Windows (maybe this happens on macOS as well, but haven't tested it) that even though the App configurations setting for Connection Method was set to On-demand (Manual user initiated connection), it would still try to immediately connect to VPN when user logs into Windows
There is a nice functionality on PA firewalls called DNS Proxy. It basically allows PA FW to act as an DNS proxy for hosts that will use its interface address for DNS queries. The way it works is that you configure it in the GUI by configuring primary and secondary servers and then you point your ho
Recently I started deploying loopbacks on all of my network devices that are somehow participating in routing and I hit a momentary roadblock when I realised that none of my loopbacks configured on firewalls are being advertised via iBGP. The reason for that is because all loopback interfaces are c
