topic Re: Is tap mode able to pick up virus or spyware in General Topics

Is tap mode able to pick up virus or spyware

u2290 — Tue, 26 Oct 2010 07:51:04 GMT

Hi, if i deploy PAN in tap mode. Am i able to pick up virus or spyware detection like it is deployed in L3?

Re: Is tap mode able to pick up virus or spyware

migration — Tue, 26 Oct 2010 08:27:06 GMT

Yes you can. You just need to make sure that you have 'threat prevention' license installed on the box.

Thanks,
Sandeep

Re: Is tap mode able to pick up virus or spyware

u2290 — Tue, 26 Oct 2010 08:31:57 GMT

Hi, So basically what i see on PAN traffic on tap is exactly the same as other deployment.

The only difference is that i cant enforce control on tap mode.

Am i correct?

Re: Is tap mode able to pick up virus or spyware

migration — Tue, 26 Oct 2010 08:54:35 GMT

Correct.

Sandeep

Re: Is tap mode able to pick up virus or spyware

kirtis — Thu, 28 Oct 2010 17:19:15 GMT

I had the same question and found this post. If this is correct, then, I can assume my network is in great shape because not a single threat has been detected in 20 days? Highly unlikely in a wide-open college environment, where students bring their computers in for malware infections on a daily basis. Where would I see this activity? In ACC, under URL Filtering, Threat Prevention, and Data Filtering, it's all "No Data Available" We are licensed for URL filtering and Threat Prevention. Thanks.

Re: Is tap mode able to pick up virus or spyware

James — Thu, 28 Oct 2010 17:28:03 GMT

Sounds like a configuration challenge, if licenses are there. This might help:

https://live.paloaltonetworks.com/docs/DOC-1164

Thanks

James

Re: Is tap mode able to pick up virus or spyware

migration — Thu, 28 Oct 2010 18:58:17 GMT

...this very likely seems to be a configuration issue. If the document James forwarded does not correct the issue, please work with your local SE or reseller. As you mention, it is highly unlikely for an open network to not see any threats for several days.

Sandeep

Re: Is tap mode able to pick up virus or spyware

kirtis — Thu, 28 Oct 2010 19:02:23 GMT

Thanks, James and Sandeep. I'll read through this tonight and post back tomorrow.

Re: Is tap mode able to pick up virus or spyware

kirtis — Fri, 29 Oct 2010 12:37:14 GMT

Sure enough - the firewall was configured and working fine through step 3, but no policies had been set up per step 4. Picked up on some interesting activity last night. Thanks for the help.