Palo Alto Networks: AI assistant (LLM)

Paste this into your AI assistant to have it help configure PAN-OS to allow the RTA's outbound connection. It still pauses for your confirmation and for anything your version does differently.

Configuration prompt

You are helping me configure my Palo Alto Networks firewall (PAN-OS) so the Sophos
Remote Testing Appliance (RTA) can reach its endpoint. Work through the steps in
order and show me the pending change before I commit anything.

CONTEXT:
- The RTA makes one outbound OpenVPN connection over TCP/443 to
  connect.remotetesting.secureworks.com, which resolves to the static IPs
  3.33.194.251 and 15.197.255.2.
- A plain "allow 443" is not enough on PAN-OS: SSL Forward Proxy decryption resets
  the OpenVPN session, and App-ID may classify the flow (openvpn / unknown-tcp) and
  deny it under a default deny-all rule.
- Some appliances also register over HTTPS to get.remotetesting.secureworks.com.
  Allow that destination by FQDN (its IPs are not static), and exempt it from
  decryption too.

STEPS:
1. Create an FQDN address object. Go to Objects > Addresses > Add. Name it
   rta-connect-endpoint, set Type to FQDN, and enter the value
   connect.remotetesting.secureworks.com.
2. Create a decryption exception so SSL Forward Proxy does not intercept this
   destination. Go to Policies > Decryption > Add, name the rule
   no-decrypt-rta-connect, add rta-connect-endpoint on the Destination tab, set
   Action to No Decrypt on the Options tab, and place it above any existing SSL
   Forward Proxy decrypt rule. (If I decrypt by custom URL category instead of
   address objects, add connect.remotetesting.secureworks.com to my no-decrypt URL
   category instead.)
3. Allow the application in security policy (recommended path). Go to
   Policies > Security > Add, name the rule allow-rta-openvpn. Set Source to
   <RTA_SOURCE_ZONE> (the zone or subnet where the RTA lives). Set Destination zone
   to <INTERNET_ZONE> (my internet/untrust zone) and add the rta-connect-endpoint
   address object. Under Application add openvpn, plus ssl and unknown-tcp as a
   safety net in case App-ID reclassifies during a content update. Set Service to
   application-default, Action to Allow, and place the rule above any broad deny
   rules.
4. Only if App-ID keeps dropping the session after step 3, consider an Application
   Override (Policies > Application Override). Warn me first: Application Override
   disables App-ID and all threat inspection for the matched flow, so treat it as a
   last resort and keep it scoped to this destination only.
5. If my appliance is an activation-mode platform, also allow
   get.remotetesting.secureworks.com by FQDN (never by a hardcoded IP) and add it
   to the same No Decrypt exception.
6. When the pending configuration is ready, show it to me. After I confirm, tell me
   to click Commit (top-right) and wait for the commit to finish before testing.

VERIFY:
- From a host on the RTA's network segment, run:
  nc -vz connect.remotetesting.secureworks.com 443
  A success looks like: Connection to connect.remotetesting.secureworks.com port
  443 [tcp/https] succeeded!
- In Monitor > Logs > Traffic, filter on
  ( addr.dst in connect.remotetesting.secureworks.com ) and confirm the Application
  column shows openvpn with an allow action, not a deny.
- In Monitor > Logs > Decryption, confirm no sessions to this destination show a
  decrypt action.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a menu, command, or option does not match what
  is written here (versions differ), STOP and show me what you actually see. Do not
  guess at equivalent settings or invent CLI syntax.
- Make the narrowest change that allows this one destination. Do not broaden an
  existing rule to "any", and do not disable, bypass, or pause the firewall, TLS/SSL
  decryption, or threat inspection globally to make it work.
- Allowlist connect.remotetesting.secureworks.com. Its two IPs (3.33.194.251 and
  15.197.255.2) are static, but get.remotetesting.secureworks.com (used on some
  platforms) is not, so allow that one BY FQDN, never by a hardcoded IP.
- Do not apply, commit, or deploy the change until I confirm. Show me the pending
  configuration first.
- Change only what these steps describe. Do not alter unrelated rules, objects, or
  policy, and do not touch anything outside allowing this destination.