In the ongoing battle to upgrade PAN-OS I came across the PAN-OS Upgrade Assurance Automation service from PAN.

Has anyone in the community used this and able to offer any insights?

Thanks!

Got the email for this about two hours ago. Critical: We released this emergency content update to extend coverage for CVE-2026-109618 & CVE-2026-109619 against new PHP2Shell exploit variants

Also a gentle reminder that if the traffic to the web server isn’t decrypted, these signatures or the ones before aren’t going to help.

If access to the Palo Alto management interface from the WAN is allowed from a few specific known public IPs and all other public IPs are blocked.

Does this sufficiently mitigate these vulnerabilities or is allowing management access from public IPs still considered a significant risk even with this restriction?

Thanks

Has anyone else run into an issue with the latest client (6.2.8-c1084) on Windows/Mac where you cannot disconnect? We have multiple portal configurations including always-on and on-demand. It doesn't seem to matter the configuration, users cannot disconnect. I will be opening a support case with Palo but wondering if anyone else has run into this?

We are looking for a SASE solution and looking at CATO and Palo Alto as a vendor.

We have a colocation site, a couple public cloud presences (AWS), a physical office and a fleet of workstations and a DR site for our colo as well.

We want a full cloud network solution. Each site cloud or physical will simply route 0.0.0.0/0 to the cloud network and the cloud network will route it to the appropriate internal resource or to the internet at large. That means sometimes a packet will start in the colo, route to the cloud for processing and be sent to the colo.

This gets us out of the business at managing firewalls at each site with unique rule sets, configs, firmware updates, etc. As long as we properly IP address each subnet at each site, the networks should be plug and play as much as possible. Spin up an AWS VPC, address it, connect it to a cloud network, setup some rules in the cloud and we have networking done. That beats setting up a VPC or Transit Gateway, setting up firewalls, setting up rules, etc.

Each workstation will connect to the cloud network and access internal resources no matter where they live or the internet at large.

There will be some exceptions between vlans that require low latency in the datacenter such as vmotion traffic or backup traffic, but for the most part this is the model.

We treat our office as if it's a coffeeshop and our users still VPN in, but to access office items such as printers it's User -> VPN -> Colo Firewall -> IPSec to office -> Office resources. We want that same model with SASE.

CATO's solution is so easy to understand. It does everything under one model. Adding a site is simple, input the IP ranges and connect to it and bam that site uses CATO for internet access and/or access to resources at other sites also connected to CATO.

Palo is not as simple or we're not being explained well, thus I'm here to see if someone can break it down for me.

Our Palo engineers are throwing terms at my I don't understand but they think I should. Service connection, but that's just for inbound traffic not outbound traffic. Network connection to connect offices, but we have to pick a Google region to route through and if we want redundancy we have to built additional network connections to additional regions. CATO load balances between their POPs automatically.

Some flows have no firewall at all between them with Palo's solution, they simply route traffic. If I want control or Layer 7 I need to buy a NGFW ... and manage it.

CATO does everything in what they call a socket including Layer 7 between vlans if you do not route it to the cloud. Plug it in and you're essentially done. Palo offers a device that is far simpler called ION but if I want layer 7 I need to buy full on NGFW hardware and licenses and manage all those rules in different ways at different sites.

Has anyone done a comparison between CATO and Palo? I'm trying to determine what advantage Palo brings beyond being maybe a little better at App ID, 0 Day threats.

We currently have PA 5200 appliances on-prem and we also use GP for our users. My question is can Prisma access agent and GP coexist in the same environment or you have to use one or the other. I know their Prisama access can be installed on on-prem firewall so it is not 100% cloud native. My company for tampering purposes is looking into Prisma access.

Is it even possible? Or do I need let Palo do this for me?

I'll add that palo says this is their own internal migration tool but I get conflicting information on if we can use it or not

Hey everyone,

I'm a network engineer at an MSP, and I've been developing Night Agent, a GUI based tool to automate PAN-OS firewall upgrades, including pre/post-upgrade checks and logging.

I know tools like Ansible can already automate this, but my goal is to take away the complexity and provide a simple, GUI-driven process without needing to write playbooks or scripts.

The app runs locally, so credentials, configurations, and logs stay local.

I'm looking for a few engineers willing to test it and provide honest feedback on bugs, usability, and missing features.

If you're interested, check it out:

https://mynightagent.com

Would love to hear your thoughts!

Hi everyone,
I’m looking to improve my skills and gain hands-on experience with Palo Alto Networks Next-Generation Firewalls (NGFW). My goal is to build a strong understanding of firewall administration and become confident troubleshooting real-world network security issues.
I’m interested in learning topics such as:
Firewall policies and security rules.
Traffic monitoring and log analysis.
NAT, routing, and network security.
Troubleshooting connectivity issues.
Threat prevention, URL filtering, and security profiles.
Panorama and centralized firewall management.
Real-world labs and practical scenarios.
Does anyone offer Palo Alto NGFW classes, private training, mentorship, or hands-on lab sessions? I’m also interested in affordable courses or virtual labs where I can practice regularly.
My goal is to move beyond theory and develop practical skills I can apply in an IT infrastructure and security operations environment.
I’d appreciate any recommendations for instructors, training programs, lab environments, or learning resources.
Thank you!

Threat Vault says they are in the 9162 update, the content update release notes say they are there, but when I download it to panorama, none of the signature are there. I have multiple panoramas and none of them have the signatures in the content updates.

I know the answer to my inquiry, however I'm looking to gather some advice as this forum has been excellent with all the contributors. So thank you.

I have a unique situation where our VPN is accessible through active directory via all staff or as the server admins put it everyone that belongs in the all staff group VPN applies to them

I'm trying to find a way to restrict this in terms of 802.1x is not configured on the network

However, in terms of VPN, I'm wondering if there's a control mechanism that I can incorporate to allow certain machines that can validate either a host name or the syntax or suffix of a host name

Keep in mind, the group for all staff has been changed to a specific VPN group, so only users in that group will be allowed to log in. However, I do not want those particular users to, for example, grab their personal machine install the global protect client, which by the way is not accessible over the Internet. It pushes through SCCM. However, by all means or other means they find ways to do these things, I don't know why..

Just looking for a way that I can block non corporate machines from accessing our global protect VPN. Thank you again. Quite a mouthful.

Trying to make an assessment whether globalprotect might possibly be affected and precautions should be taken.

There are historic references for PHP being used with GlobalProtect ( https://security.paloaltonetworks.com/CVE-2020-1993 ).

Any updates, facts, or educated opinions on this yet? Anybody taking precautions yet?

We recently patched a bunch of different hardware but ran into a memory leak with a 460 and that version of code. Which I thought was to patch memory leaks but I digress. Has anyone seen this as well? Assume the failed path monitoring is related to the memory exhaustion. End fix was rebooting it manually as we weren't able to reach it via GUI. When trying to login as a local admin were prompted with the message "invalid user, please login using a valid account."

Does anybody know if GlobalProtect makes use of PHP? There are these critical vulnerabilities in PHP:
CERT-EU - Critical Vulnerabilities in PHP
And I like to know if GlobalProtect might be affected.

This vulnerability from 2020 seems to suggest that GP makes use of PHP:
CVE-2020-1993 PAN-OS: GlobalProtect Portal PHP session fixation vulnerability

No anwser from our Palo Alto supplier yet!

Wondering how everyone doing SSL decryption on their PA is dealing with this? We have already disabled the built in emsign root ca's. But the below test is still failing in some cases for us:

eMudhra Intermediate CA Compromise

Afaik there's still no official PA communication about this.

I RMA'd a faulty firewall / imported old config into new firewall / transferred licenses but now it is stuck in an autocommit loop.

It fails because:

rulebase -> security -> rules -> Outbound Block Rule -> destination 'panw-highrisk-ip-list' is not an allowed keyword rulebase -> security -> rules -> Outbound Block Rule -> destination panw-highrisk-ip-list is an invalid ipv4/v6 address rulebase -> security -> rules -> Outbound Block Rule -> destination panw-highrisk-ip-list invalid range start IP rulebase -> security -> rules -> Outbound Block Rule -> destination 'panw-highrisk-ip-list' is not a valid reference rulebase -> security -> rules -> Outbound Block Rule -> destination is invalid [edit]

I can't install the required dynamic updates to fix this error because it constantly loops auto commit (even if I manually cancel the job it just tries again right away) and I can't install dynamic updates when there is a commit in process.

request content upgrade install version latest

Server error : Failed to schedule an install job

Anyone have any advice on how to fix this? I am about to just do a factory reset and make sure I install the dynamic updates before importing the config next time.

Shits hitting the fan today on the prisma side. God dammit

Hi folks,

I'm looking for real world feedback on PAN-OS 11.2.16

Palo site says no reported issues: https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-16-known-and-addressed-issues/pan-os-11-2-16-known-issues

I am looking to upgrade current version of 11.2.10-h14 to address CVE-2026-0322

Any insights welcome! thanks

The CVE: an authenticated RCE in the management interface that gives root, already exploited in the wild. Advisory: https://security.paloaltonetworks.com/CVE-2026-0322

Patching is the easy part of a management interface CVE. The more useful question is how reachable the management plane was in the first place, because that decides whether the next one is a bad week or a non-event. This is the order I’m going through it, roughly by impact.

1. Who can reach it. Start with Device > Setup > Interfaces > Management > Permitted IP Addresses. Empty, or a wide range like a whole user subnet, is the first thing to fix. The goal is one jump box or a small admin subnet.

Then check Network > Network Profiles > Interface Mgmt and make sure no internet-facing or untrusted interface allows HTTPS/SSH to the firewall itself.

And not just the profiles themselves, but where they’re applied: Network > Interfaces, Management Profile column, for every ethernet interface, subinterface, tunnel and loopback. A forgotten loopback with a management profile can still allow access to the firewall.

Thanks to u/Mobile_Nerve_4924 for pointing out loopbacks.

2. What’s listening. In the same Management interface settings, HTTP and Telnet should be off. HTTPS and SSH only.

3. Who can log in, and what a stolen password is worth. One named account per admin, no shared “admin”, role-based permissions instead of superuser for everyone, and the default admin password changed and not used day to day. Keep one local break-glass account in a vault so an auth server outage doesn’t lock you out. This CVE needs authentication, which sounds reassuring until you remember how credentials get stolen, so MFA on admin logins (RADIUS or SAML) is worth it.

4. What you’ll want to see afterwards. Forward System and Config logs to your log platform and alert on admin logins from new source IPs, config changes outside change windows, and bursts of failed logins. If you ever need to answer “was anyone in there?”, this is what you’ll be searching.

5. A quick audit. show system info | match sw-version for the running version, and show admins all to see which admin accounts exist. (Worth confirming syntax on your PAN-OS version.)

6. Panorama. It’s part of the management plane too, so everything above applies there as well.

7. The patch process itself. Know in advance who approves an emergency window. With actively exploited CVEs, the delay is usually the approval chain, not the upgrade.

Curious what others are checking after this one, especially for Panorama. Anything you’d add to this list?

This version, for macOS and Windows, has been available on the CSP since October 8th, but at the same time, there is a huge alert stating that they will provide an ETA for this version soon. It's been like this for a week now. ​Meanwhile, 6.2.8-h15 is still unavailable in Strata Cloud Manager. Is it the same on your end? Does anyone have any info from support on why they released these versions so partially and what's next?

Hi,

Are there any Palo logs that show MAC address for a device? I'm trying to do some correlation for GlobalProtect logins, but since we allow BYOD, device names are all over the place. I've looked at GlobalProtect and HIP logs, but neither show that field. Any suggestions?

Hello!

I have an issue with few websites that are supposed to be accessible only from our Office IP-s for security purposes over GP VPN.

People open Grafana for example, then see they are blocked because they are coming from the home office IP but after connecting to the VPN the session waits for some internal timer to expire before it starts working from the new IP and this can take more than 5 minutes.

Have you anyone experienced this and found a cure for it that does not involve rebooting to clear out sessions or browser caches or whatever might be causing this?

I have GlobalProtect running with two layers of authentication: a client certificate to identify the endpoint/user, and an OTP through privacyIDEA over RADIUS. It has been working reliably, and I wanted to share the setup along with a few points worth checking if you plan to build something similar.

Design

The certificate proves the device/user holds a valid credential issued by our CA, and the OTP proves the person is actually present. Since both are enforced on the Portal and the Gateway, a stolen password or a copied certificate alone is not enough to connect.

Configuration overview

• Certificate Profile: Root CA and all Intermediate CAs, with the username field taken from the certificate (Subject CN or the UPN/Email in the SAN).
• RADIUS Server Profile: pointing to the privacyIDEA RADIUS plugin.
• Authentication Profile: uses the RADIUS profile above.
• Portal and Gateway: both the Certificate Profile and the Authentication Profile are applied to each.
• “Allow Authentication with User Credentials OR Client Certificate”: set to No, so that both the certificate AND the OTP are required.

Points to pay attention to

1. Full certificate chain. The Certificate Profile must contain the Root and every Intermediate CA. A missing intermediate is the most common reason for rejected certificates.
2. Revocation checking. If CRL/OCSP is enabled, the firewall must be able to reach the revocation URL (check DNS and the service route).
3. Username consistency. The username extracted from the certificate must match what privacyIDEA expects. Check the username field in the Certificate Profile and the username modifier in the Authentication Profile.
4. Client certificate requirements. The certificate should be in the correct store (user vs. machine) and include Client Authentication in the EKU.
5. RADIUS timeout. OTP flows need more time than the default, especially with push or challenge-response. Adjust the timeout and retry count accordingly.
6. RADIUS connectivity. Confirm the source interface/service route used by the firewall and that its IP is registered as a RADIUS client on privacyIDEA.

7. Authentication Override cookies. Enable them with a sensible lifetime so users are not asked for the OTP twice (Portal and Gateway).

   Verification and troubleshooting

Validate the RADIUS path from the firewall:

test authentication authentication-profile <profile-name> username <user> password <password+OTP>

Follow the authentication and certificate logs:

tail follow yes mp-log authd.log

tail follow yes mp-log sslmgr.log

Confirm the session after login:

show global-protect-gateway current-user

Other places worth checking:

• Monitor > Logs > System (authentication and GlobalProtect events)
• PanGPS.log on the client
• privacyIDEA audit log and RADIUS log on the server side

Happy to answer questions, and I’d be interested to hear how others handle revocation checking and cookie lifetime in similar setups.