Palo Alto Networks (PAN-OS)

This guide covers the PAN-OS-specific steps needed to allow the RTA's outbound OpenVPN connection to connect.remotetesting.secureworks.com on TCP/443.

Note

For the full background (what the RTA connects to, why an ordinary "allow outbound 443" rule is not enough, and the two failure modes: TLS/SSL decryption and application control), see the firewall troubleshooting overview.

Activation-mode platforms also need get.remotetesting.secureworks.com

Appliances deployed from a generic image (AWS, GCP, Azure, Hyper-V on Windows 11) register and activate over a second outbound connection: standard HTTPS on TCP/443 to get.remotetesting.secureworks.com. When you add the decryption exception and application rule for connect.remotetesting.secureworks.com, also allow this destination and exempt it from TLS/SSL decryption (the appliance does not trust an intercepting proxy's re-signed certificate). Its IP addresses are not guaranteed to stay constant, so allowlist it by FQDN, not by IP. Pre-registered appliances (vSphere, VMware Workstation, VirtualBox, Nutanix, Hyper-V Server) do not use this endpoint.

Choose how to apply the fix

The fix is the same in every case: an FQDN address object, a No Decrypt exception, and a security policy allow rule, followed by a commit. Pick the interface you prefer.

• GUI (PAN-OS web UI)

  Click-through walkthrough in the PAN-OS web interface: address object, decryption exception, security policy rule, then commit and verify.

• CLI (PAN-OS CLI)

  The same fix as configure-mode set commands over SSH, with test commands to confirm the policy and decryption match after the commit.

• AI assistant (LLM)

  A copy-paste prompt that has your AI assistant drive the PAN-OS changes, pausing for your confirmation before anything is committed.