General Topics

Blocking/Alerting on Web Sessions to IP Address Formatted URLs

One of my customers has asked if it is possible to block and/or alert upon HTTP or HTTPS connections that are made directly to an IP address instead of a dns name. The specific IP addresses or DNS name is not defined, they would just like to alert upon this behavior any time it is seen since some malware can be hard-coded with IP addresses and ...

palalto-updates vs ssl

After years of content update traffic showing up in traffic logs as paloalto-updates application, this traffic suddenly started showing up in traffic logs as ssl application. This all started at approximately 6:40pm Eastern time on 4/1/2017.Has anyone else experienced this and if so do you have any idea why this is?

Resolved! Wildfire file-size-limit

Just installed PANOS6 on a PA200 platform.Did a change at the configuration and tried to commit. While commit I get the message:Validation Error:deviceconfig -> setting -> wildfire -> file-size-limit unexpected heredeviceconfig -> setting -> wildfire -> file-size-limit is invalidTried to change the values at device -> settin...

Configuration Update Descriptions

Hi all, The commit description is potentially really useful for tracking changes and linking back to change tickets, but I can't see where I can display a list of commits with the descriptions, to review what has been done. The configuration log shows individual changes which is good detail, and the config comparison shows the description agai...

Resolved! Query on QoS

Hello, We would like to configure QoS on PA to give priority to VOIP and video based traffic. The Internet connected to the FW is 100Mbps and the connection between the core switch and PA is 1Gbps. If I make a QoS profile and I want a guaranteed bandwidth of 25Mbps, but what about max bandwidth? What do I set? 100 Mbps?If so, when applying this ...

Panorama Dynamic Update overlap

Given the best-practices for Dynamic updates here, how do i configure this in Panorama and not have the commit warning for deployment schedule overlapping with 5 mins of another? Its always going to be the case where Wildfire checking every minute will overlap with all other schedules at some point in time...I thought Panorama in 7.1 could multi...

Can I use PAN-OS 8.0.0 to Study for the PCNSE 7 exam?

Hi guys, I've been looking at getting a PA VM-50 for training puposes but I have been told that the both VM-50 and PA220 ship with PAN-OS 8 and is not backward compatible with earlier versions of code is this true? Is there any reason I couldn't use PAN-OS 8.0.0 to study for the PCNSE7? Thanks Matt

Restricted access to API?

Hi *, I'd like to know if it's possible to restrict access to the API? (ex: to some IP addresses). Example: if remote management is allowed from 192.168.0.0/24, is it possible to restrict the API usage to 192.168.0.1 by example? Is it an option to dedicate a specific IP address to the answer to API requests? What are the best practices to prev...

Proxy filtering or paloalto filtering

Hi All, i have proxy in my network which is responsible for all filtering and categorizaing , also i bought a licnese for url filtering on paloalto so, is there any benefit to allow filtering and categoriziang on both ? or no need for filtering on paloalto since i have proxy

Decrypting OPENVPN?

Is it possible to decrypt openVPN with SSL Forward Proxy? I'm pretty sure the asnwer is no, but I figured I would ask. My problem is that I have a Ubuntu Server running openVPN client behind a VM-100. I would like to continue to use openVPN, but I would like to intercept it, apply some policy on the decrypted traffic and re-encrypt. The server I...

L7 Inspection

Hi All, i migrated my asa to paloalto , but i can see that all policies are assigned service port but not appliation , so how can i get benefit from from application field ? how can i transfer all polices from l4 to l7

miners throwing errors

In both cases below, Minemeld is running via hosted Autofocus App. It appears that the ransomwaretracker miners are running into an error. All three are throwing a "[Errno bad handshake](-1, 'Unexpected EOF'). The source URLs appear to be functioning properly. I also see the dshield miner appears to be having a problem with verifying the SSL...

Securing Access To Chef Deployment Servers

Currently we have a rule allowing the APP "ssl" from many different zones to our Chef Deployment Servers. I am trying to determine if there is a specific APPID for Chef but been unable to fine one. Since the server team says both port 80 and 443 are needed I am considering to setup the policy using APPIDs "ssl" and "web-browsing". Looking for id...

PA200 time out - reason directory / 100%

Hi, We have a cluster PA-200 with error "Session timed out". I just saw this link https://www.pickysysadmin.ca/2015/02/08/palo-alto-firewall-displays-session-timed-out-when-you-try-to-login/ I tried to delete all core files but disk space is still in 100%. Any workaround???

Resolved! Suspicious TLS Evasion Found

PA-3020 Recently I've had several users get a "Virus/Spyware Download Blocked" page on random sites. Normally they get it on google searches. If they refresh, sometimes the error stays, and sometimes it just takes them to the page. It even happened to me the first time I tried coming to this site, but a refresh took me here. Here's an examp...

Discussions

Blocking/Alerting on Web Sessions to IP Address Formatted URLs