General Topics

Fragroute Evasion Attack - how to find source process/application?

Hello

Last days one of my computer started generating strange  traffic that is blocked by Thread Prevention (ID35111)

I have access to this computer, but how to find and remove this program that is genrating such traffic?

Regards

Slawek

URL Filtering Log show Action block-url

my palo alto I see url-filtering log

---in columns action show block-url

---in columns rule not show

and I don't add url-filtering profile to all security rule

why url-filtering show action block-url

help me pls.

PA5020 PanOS5.0.12

PAN-DB

Default threat ID correlation for action

Hi all,

I was searching for a while and could not find the answer to this question.

By default, does a Palo Alto block every instance a threat ID (that is enabled) is seen or does it wait until 1 threat ID hits 5 times in 1 minute (for example).

I would

Xbox Live with dynamic public IP

I know that this topic has been discussed before, but I cannot seem to find an exact scenario match since I am dealing with a dynamic public IP address.

Interfaces

ethernet1/1

• Primary internal network
• Default virtual router
• 172.16.50.1/24
• Zone: Internal

eth

forward connectivity

Hi friends,

How to forward connectivity  when our VPN connectivity down or leasedline down.

Regards

Satish

Troubleshooting tools

I am new to firewalls and new to PA so I really need to find some tools and technique to be able to troubleshoot issues on my PA

configure SNMP(Port 166)

Hi Friends,

How to configure SNMP(Port 166) for monitoring firewall from Zebbix Tool with example.

Regards

Satish

Statistics Service Setup

Hi,

When we check "Unknown categories by URLs" will this option help Pan-DB and Brightcloud to be updated their databese (for unknown urls) related to which we use ? Or just one ? Or none of them ?

Thanks.

Doubt about security rule

Hi,

I have to create a rule bidireccional between two of my servers. My question is, do i have to create two rules to allow the connection in both flows, or i could only create the rule TRUST TO DMZ and the way back would be permit too?

Its a bit trick

Rate limit port forwards

Hey guys,

Some of the iptables servers I'm replacing with Palo Alto firewall provide port forwards to RDP servers. In order to prevent abuse, they were rate limited, such that a single IP can only connect a few times before being blacklisted for a few

ldap user authentication in security policy not working

i have configured  ldap server profile with "base=" and "basedn=ldap string " and domain= blank.

in group mapping under available groups only groups are there and no users can be viewed. i have included two groups here. which  is added in security pol