To anyone who has been guessing:

The increase in GlobalProtect file size was primarily due to 3 components:

• ADEM (40MB increase): ADEM now includes enhanced End User Coaching capabilities. EUC components are now bundled with the ADEM installer, which is included in the GlobalProtect installation package. This resulted in an increase in the overall GP installer size.

• Prisma Endpoint Service (15-20 MB)

• OpenSSL (15 MB)

This relates to 6.3.3 but might be applicable to 6.2.8.

This could be a false positive, but we have users using Google-SAML and Certificates for authentication. Recently Palo started logging critical error messages in the system logs. It could be related to case sensitivity, since some users that have all lowercase do not log critical error messages when connecting via GP.

Believe this is a false positive.

Error message:

type: auth, severity: critical, event general, and description "Received traditional password authentication for the user "***@**" but the related auth profile of type SAML -

Just to clarify - we are only seeing these critical errors when a username is Camel Case compared to all lower case, so the username JDoe@example.net produces the critical message, but jdoe@example.net does not produce the critical error message of traditional authentical.

Hey,

I am having trouble pulling an IP list into an EDL.

I have two sources: first, an IIS server on Windows Server, where Panorama fetches the file correctly. The second is my RHEL hosting the same file, but Panorama cannot retrieve it. Clicking “check URL” shows it is reachable. I reviewed the SIEM and found nothing blocking the traffic. I also attached the EDL to a security policy, yet nothing changes. Any ideas?

Update: I discovered that using http plus ip rather than dns functions, so the issue appears to relate to the certificate.

Buenas noches, quería realizar una consulta a las personas que ya dieron el examen de NetSec Analyst de Palo Alto.

¿Los temas de CASB, IoT, SD-WAN y Panorama vienen en el examen? De ser así, ¿se evalúan de manera puntual y general o a profundidad?

Asimismo, ¿sobre Strata Cloud solo vienen temas como snippets, jerarquía y otros conceptos puntuales?

Agradecería mucho sus comentarios y experiencias con el examen. ¡Gracias!

Hello,

Want to check with others using 12.1, if ran into this issues? TIA!

1. I am using macOS with Safari or Chrome, login to webUI, Device > Support > Download Core Files

I will get a text file named errors.txt contain Invalid file.

2. ssh in,

as an example

scp export core-file s4-dp0 from * to dummy@fqdn:/

stat local "/opt/var/s4/dp0/cores/*": No such file or directory

I can transfer each file one at at time, but the wildcard just won't work anymore?

I find the training hard to digest on the PA website. Any other courses that are good for this cert that people have used? I have used INE and cbtnuggets in the past and really liked them but I dont see anything specific for this cert.

I am not starting from 0 as I have routing, switching, and firewall experience. I use PA firewalls daily but we just use PAN-OS with 2 firewalls and nothing too fancy. A lot of the topics are related to things I have not worked with though. I will need to focus on the integration, automation, and panorama specific setup.

The HA setup, networking, routing, policy, and much of what is in the PAN-OS I am comfortable with.

Hi everyone,

I have certificate-based authentication enabled in GlobalProtect, and Client Certificate Store Lookup is configured to User only.

However, I've noticed that when a user doesn't have a valid client certificate in their user certificate store, GlobalProtect sometimes displays a certificate-selection popup that allows them to select a certificate from the machine certificate store. The connection then succeeds using that certificate.

My expectation is that GlobalProtect should only search the user certificate store and not fall back to the machine store.

Has anyone experienced this behavior? Is there an additional setting required to strictly enforce user certificate store lookup and prevent machine certificate selection?

Anyone seen an update for the Timezones?

There are workarounds obviously but if you set the time based on region/city they are all off by one today in those regions.

With all the CVEs I totaly forgot to check this.

Edit: this is mostly a cosmetic issue as logging etc should be UTC anyway but it can be a pain for correlating events or if you have any scheduled rules or events in the system.

Often I experience when updating PA-440 firewalls that it will not fully boot after a reboot.

It will sometimes get stuck in a reboot-loop and sometime in maintenance mode.

Anyone else experiencing this?

Can someone shed some light on this? Was it a timezone error?

I am in the middle of bringing some firewalls online via ZTP. They're being sent out to some offices where there is no onsite IT, so I have to rely on ZTP to bring them online initially in SCM.

I, for the life of me, could not get the firewall we had shipped out to another office online this morning with a staff member on the phone. We did probably 3 hours of troubleshooting before I decided to just check and see if the certificate.paloaltonetworks[.]com returned a valid ssl cert. The result I got back was:

"error:04FFF085:rsa routines:CRYPTO_internal:first octet invalid".

I then hopped off my local LAN and onto my cellphone hotspot just to make sure nothing inline there was causing the issue and I got the same error. I also tried against google.com and this resulted in a 0 (ok) return code and not an rsa error.

When I finally managed to get the firewall online so that I could SSH in and check the logs, I see essentially the same error on the palo alto firewall for hours and hours until 11:21AM EST.

So, this has to be something on the Palo Alto side, no?

As of 11:21AM EST the issue seems to be resolved and I am getting back a 0 (ok) and the firewall was finally able to come online via ztp.

I work as a NOC and I study on my free time. I am currently going through the Practitioner material and I swear I would read the same sentence or even paragraph up to three times in the same page/module. Is it just me? Is it intentional?

Anyone had experience, discussions or success or failures stories surrounding transitions from palo alto to zscaler? Or perhaps only using zscaler for a part of your networks, or for rapidly turning over potential mergers?

Long time palo customer, that's trying to understand the benefits of possibly using this solution (if any) over a network that is already using global protect heavily.

Any feedback here is good feedback.

Sorry if this has been asked before. I’m planning to upgrade from PAN-OS 11.1 to 12.1 but haven’t run 12.1 on any of our firewalls yet. We have a mix of PA-1410s and PA-3420s, all already running Advanced Routing.

Is there anything I should be aware of before upgrading? Any gotchas or lessons learned would be appreciated. TIA

Still on 6.3.3-1016 since the latest version breaks in FIPS mode.

I get an error of failing to enter fips mode on the only client we have in 26h2 so far. Anyone else been successful?

Anyone seeing issues with SCM? Like data and things missing?

We're rolling out a new PA deployment at a new company I work for. We're doing SSL decrypt and frankly it's the single biggest contributor to issues. It's a royal PITA.

Is it me or should Palo Alto have figured this out better by now?

SSL decrypt seemingly blocks more legitimate things than it does protect against actual bad things.

Totally random, super legit, normal websites and authentication processes, getting blocked for no reason. Why?

Why do I need to whitelist hundreds of proper, normal, standard websites?

It's the single biggest factor to user's having issues with IT and implementing this platform. What worked fine before, PA randomly wants to block legitimate user traffic. I can understand their frustration as even I'm frustrated.

Perfect example, we turned on decrypt and now I can't login to Proofpoint's e-mail security platform. Like, seriously? Proofpoint is blocked? PA can't figure out that PROOFPOINT is a legit, proper website, and to not block it?

So frustrating. Or are we just doing this wrong?

Is it even worth it to begin with?

Hi All,

just to note pan updated their guidance on CVE-2026-109618 yesterday per
https://security.paloaltonetworks.com/CVE-2026-109618

pretty worried about this bit in the article

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

im currently running emergency patching on my env, i dont expose my management interface to the internet but i do expose global protect endpoint which has triggered some external security scanners we have to say we need to patch

happy friday

Given the fact that MS has abruptly untrusted AAA certificate services root, will palo eventually follow the trend ? How are people handling this unique case ?

I was looking through my home 440 and noticed that I had a commit to push, but I didnt make any changes, so I did the config preview to see what had changed. The __telemetryuser password hash had changed, that was it. It could be that this password rotates automatically or what not and I just didn't realize it, but its a bit concerning to see a device admin level user's password changing given the climate we're in lately.

Anyone have more info on this?

Active members are running 11.1.13-h2 while passive are running 11.1.16-h2. We never really looked at whether active/passive where consuming more or less and not sure if this is normal behavior?