When updating from the web gui in a rush its a bit painful
CLI commands
request system software check (optional, lists all updates without filters)
request system software download version 11.2.7-h16 (download the version we need)
request system software install version 11.2.7-h16 (install the version we need)
Had some issues with palo alto <> azure VPN. The firewall was blocking the VPN traffic due to rule change. Azure gives up after a while and goes into idle mode. Needs to be restarted on azure end
1 - If Azure VPN starts getting blocked by the firewall after some time Azure gives up and goes into an idle mode, has to be restarted on Azure end for VPN to try again.
2 - The ISAKMP (udp 500) session stays open on the palo even through p1 re-keys. Check session browser for your peer IP on UDP port 500, may need to clear it.
clear session all filter destination x.x.x.x
clear session all filter source x.x.x.x
3 - Related to above if the rule that allows the UDP is set to log at end you won't see the new traffic being initiated, set the rule to log at start.
4 - We saw the Azure IP is showing with a geolocation IP of "EU" I'm guessing its related to their HA
show location ip x.x.x.x
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sYzBCAU&lang=en_US%E2%80%A9
Palo on gave 400 series 1mb swap which is full when the device is on.
Swap (and other memory) can be cached/buffered for the kernel. Its not really used but ready to be used, it can be reclaimed by the system when needed.
Monitor physical memory instead (available memory is what you want to look at)
show system resources
Make QoS policies
Policies > QoS
Assign policies to a profile:
Network > Network Profiles > QoS Profile
Assign a profile to interfaces
Network > QoS
The FW needs to see the IP before geoblock can be applied
under monitor > logs > GlobalProtect
( stage eq 'login' ) and ( status eq 'success' )
Also
Network > Gateways, click on the "Remote Users" link on the right
There is also the option to create the NAT for the GP IP only for the geo locations allowed
Have a general security rules with geoblock to/from any deny
Have a security rule to allow access to the GP IP only from the approved countries
Set the countries up in the GP config (portal / gateway)
Config the geoblock on any 2FA you might be using for 2FA as well as another line of defence
Enable the palo EDL blocks and dynamic threats etc, strict IPS
***
GP allow initial connections IP connections
can geoblock here IE (but be careful about your S2S VPNs, maybe make a rule to all S2S peer IPs)
outside > OUTSIDE
D:x.x.x.x (GP public IP)
UDP 500
UDP 4500
UDP 4501
GP allow IE users
outside to outside
D:x.x.x.x (GP public IP)
apps
ike
ipsec-esp
ipsec-espudp
panos-global-protect
ssl
web-browsing
Block everything else
outside to outside
D:x.x.x.x (GP public IP)
any any deny
KBs:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE
https://learn.microsoft.com/en-us/entra/identity/saas-apps/palo-alto-networks-globalprotect-tutorial
Generate the the cert and make it active
Delete the old cert
Wait a few minutes for azure cloud to update
Download the xml
delete old certs from palo
Import the xml into palo this will create cert and SAML IDP profile
Don't tick validate check box
Select the new IDP profile in your azure auth profile
Making a note because its a bit different to cisco ASA
NAT rule
OUTSIDE > OUTSIDE
Public src > Public dst
FW rule
OUTSIDE > INSIDE (counted as inside because of the NAT)
Public src > Public dst
https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/configurable-maximum-transmission-unit-for-globalprotect-connections
The usual fix is to put
portal auth > AD
gateway auth > MFA server
However we found with some OTP/fob code users it wasn't working well
Fix was
Upgrade GP to preferred release (6.2.3 a time of writing)
Enable the authentication cookie settings on GP
Portal > Agent - Generate cookie for auth override
Choose the same cert you use for the GP
Gateway > Agent > Client Settings > clock settings > Authenticaiton Override tab
tick Accept cookie for auth override
Choose the same cert you used in portal
Push policy
Watch out for any AD changes may take 15 mins to update on the palo so if you move a user into another group for testing it might not work for 15 minutes
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004MACCA2&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail
You can use the migration tool to do this
After version 10.1 there is also a log forwarding for security services policy optimizer under
Policies > Security
Policy optimizer in the bottom left
You need to have configured logging and your log forwarding profile in advance
Select "None" to find all the rules with no logging policy applied
click the first rule
scroll to the bottom
hold shift and click the last rule to select all
In the bottom left click "Attach log forwarding profile"
Select your profile "LOG-FWD-PROFILE"
Click ok
Commit
Info found on:
https://live.paloaltonetworks.com/t5/general-topics/log-forwarding-profile-in-all-security-policies/td-p/205426
https://www.youtube.com/watch?v=GxRdPPsIHH8&t=1186s
Identifier (Entity ID) URL: https://vpn.domain.com:443/SAML20/SP
The 443 is needed
Reply URL (Assertion Consumer Service URL): https://vpn.domain.com:443/SAML20/SP/ACS
MFA setting
https://portal.azure.com/
Burger menu top left > Microsoft Entra ID
Enterprise applications
Search global protect app "Palo Alto Networks - GlobalProtect"
From the left expand security > conditional access
You will see the policies here
You can see what polices are being used by expanding Activity on the left
click on Sign in and logs
Make GP connection
Click on entry for more details
In the top right click on Conditional Access
Home > contosos > security|conditional access > conditional access policies
Access controls > Session
Select sign in frequency
Periodic reauthenticaiton
Every time
Check for NTP settings on both firewalls
Saw an issue where the groups were not being downloaded
All config looked good, checked all settings etc
The cmd below was run and it came back
debug user-id reset user-id-manager type user-group
Replacing/renew an existing wildcard cert
You need the .pfx cert with private key bundle
cert password
name the new cert "cert_name_of_existing_cert" or something new "cert_may_2026"
In palo select the cert
click import
choose pkcs12, choose the .pfx file
enter the password
import and commit
Don't forget update the SSL profile (a bit below certs) with the new cert
Test the GP web interface
When trying to import a cert with the private key bundled you get an error:
Import of certificate and private-key CERT-NAME failed. private key doesn't exist for csr.
Importing the signed cert with the same name as the CSR doesn't work. Panorama adds cert_ to the front of the name
You need to port cert_ in front for example if cert is called CERT-NAME you put cert_CERT-NAME
CSR import
Import the CA bundle if not done already
If you make duplicates will have to delete on CLI
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kHyVCAU&lang=en_US%E2%80%A9
tick your pending CSR
click import
give the same name as your csr request
select the pem file
PEM file format
ok
commit
Importing SAML cert
Create new cert and make it active
Delete old/inactive cert
Wait a few minutes for cloud to do its thing
Download the .xml files
In palo delete old certs and commit
Going into SAML IDP provider
Import
Untick validate checkbox
This will import the cert and create a saml profile
User your new saml profile in your auth sequence
Test connection to GP etc
If you have FQDN then you can just add FQDN object in the rule
If you want to add a wildcard or multiple URLs in a group then you can create a custom URL category
Objects -> Custom objects -> URL categories - > Add
Add your URLs
*.mail.protection.outlook.com/
smtp.office365.com/
Always end with a / ending token
Blurb from the palo:
For domain entries, we recommend you use an ending token. Acceptable tokens are: . / ? & = ; +. If you choose not to use an ending token, you may block or allow more URLs than anticipated. For example, if you want to allow xyz.com and enter the domain as 'xyz.com,' you will allow xyz.com and URLs such as xyz.com.random.com. However, if you enter the domain as 'xyz.com/,' you will only allow xyz.com.
More info here:
https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering/url-category-exceptions
CLI
set profiles custom-url-category URL-CC-OSCP-CRL description "Custom URL category for OSCP"
set profiles custom-url-category URL-CC-OSCP-CRL type "URL List"
set profiles custom-url-category URL-CC-OSCP-CRL list [ crl.globalsign.net www.d-trust.net cdp1.public-trust.com crl.cnnic.cn crl.entrust.net crl.globalsign.com crl.globalsign.net crl.identrust.com crl.thawte.com crl3.digicert.com crl4.digicert.com s1.symcb.com www.d-trust.net isrg.trustid.ocsp.identrust.com ocsp.digicert.com ocsp.entrust.net ocsp.globalsign.com ocsp.omniroot.com ocsp.startssl.com ocsp.thawte.com ocsp2.globalsign.com ocspcnnicroot.cnnic.cn root-c3-ca2-2009.ocsp.d-trust.net root-c3-ca2-ev-2009.ocsp.d-trust.net s2.symcb.com aia.startssl.com apps.identrust.com cacert.omniroot.com ]
https://live.paloaltonetworks.com/t5/Customer-Resources/Support-PAN-OS-Software-Release-Guidance/ta-p/258304
Global protect portal and gateway should be setup
Get customer to get DNS record created eg globalprotect.domain.com
Point the record at the global portect portal IP (Network -> Global Protect -> Portals)
Download the wildcard cert and root/chain cert from the cert vendor (.crt format). The windows .p7b format is no good. The chain bundle cert usually publicly available. The wildcard will need to be downloaded via a login may need to get it from the customer.
Install wildcard cert on palo alto firewall
Palo Migrations tool kept failing without an explanation
The tool seems to have an issue with psks on the VPNs
When you load the config from the migration you need to change / update the psks and it will load correctly
Log into your palo alto firewall
On Device -> Support
In the Tech Support File section
Click generate Tech support file (takes a while)
Then download the tech support file
Log into support web site:
https://support.paloaltonetworks.com/
Will have to login with google authenticator
Login with your account.
Select the customer account in the top left drop down
On the left hand side go to tools -> Best Practice Assessment
Click on "Generate New BPA" in the top right
Select the downloaded tech support file
Select architecture classfications
Untrust = Internet etc
Don't enable Inline cloud analysis under anti spyware section of BPA, drops traffic but doesn't show in the logs.
I haven't had much luck with this, it doesn't seem to work as well as packet tracer. It's often returning that the traffic is blocked when in fact it is allowed.
Anyway you can give it a go, its down the bottom in the GUI "Test policy match"
On CLI:
test security-policy-match source 192.168.0.1 destination 8.8.8.8 destination-port 53 protocol 17
test security-policy-match source 192.168.0.1 destination 8.8.8.8 destination-port 443 protocol 6
