General Topics

Resolved! Unable to install Applications / Threats 360-1705

Hi all,Is anybody else having problems installing Applications / Threats definitions 360-1705 please?One half of my HA pair of PA-2020s has installed this OK but the other has not. The install and push completes OK but the active version remains at 359-1703.Both devices were running OS 4.1.6 but these have both been upgraded to 4.1.9 today. I ...

Who has deployed dynamic address objects?

What have you found to be the work effort involved and how did it work out? Is this likely to be used often or just in some specific cases?

Resolved! Mega service

Is programmed a content update during next week for the new application mega (mega.co.nz)? Right now the service is recognized as ssl, web-browing and unknown-tcp and becomes urget its new calssification due to the high bandwidth consumption and downloading legal issue. Brighcloud classifies correctly as personal storage but an application-based...

What to do with Large Logfiles

I have two PA4060s and Panorama on our internet border. I need to retain logs of all outbound traffic for at least three months. After watching the log retention on Panorama for a couple of weeks and running the debug log-receiver statistics command, doing calculations from it, and by watching the amount of data stored and knowing the size of ...

Resolved! Panorama Logging Backfill

I have had to upgrade both my firewalls and Panorama from 4.1.9 to 4.1.10 about a week ago. I updated the firewalls and subsequently cleared the logs for them, however, I failed to do that with the Panorama. Yesterday, I realized this important missed step and subsequently went to export the current logs. The transfer finished this morning and I...

Resolved! All user activity for last 30 days

Hello,I've done some searching and also have engaged support but I believe I've hit another black mark for our PA. Has anyone figured out a way to get all user activity for a certain frame exported?I need simply:userDate/timesite visited (full url, not IP)bytes transferredThe user activity report only shows blocked activity for me, I need allow...

Resolved! Creating Custom Applications

Greetings,Am I missing something, when creating a custom application why can't I create my own custom category and subcategory? Also, I'm surprised PAN doesn't detect intouch (wonderware) as an application?thx,Bill

Wildfire Depth

The first question I have is how many layers will the file blocking inspect? For example, a zip in a zip has an exe that is malicious. If the PA doesn't inspect that far down wouldn't I be able to get through the firewall inspection?If the above is true and I am the security network guy that wants to block this behavior, could I set up wildfire ...

Resolved! IPSec VPN Proxy ID setup with multiple encryption domains on a policy based VPN peer

I need to establish VPNs from a PA5050 to Cisco devices where there are multiple encryption domains at the Cisco end.I understand using one proxy id on the PAN to match one encryption domain on the Cisco, i.e. connecting route based to policy based VPN devices.My question is how to set up multiple Proxy IDs from a PAN device to match multiple en...

Issues getting ip-user mapping with probing error

Hello,I've got UI agent 4.1.6 configured on PanOS 4.1.9.We have around 3000 users and in agent we see only around 700 user-mapping count.in the logs we get the below error for a lot of IPs and i guess that's why we dont get all users. I've tried to disable WMI but still doesnt work.Have anyone experienced a similar iissue?2/22/13 08:17:29:688[ I...

miniduke

I got the question from de security dept, to investigate miniduke.This was is detected by kaspersky labs, as an exploit of an Adobe flaw CVE-2013-6040I dont' find anything on PaloAlto about miniduke , or CVE-2013-6040

Report on attempts to access unsuitable content

Hi AllI have been tasked with creating a report that shows if a user has attempted to access or find a way of accessing unsuitable content. While I can obviously run a report on pages that have been blocked by the filtering system we want to see any attempts to try and access blocked content, such as certain keywords withing search engines etc.A...

Resolved! Eicar and Palo Alto threat-db

First a question:Where and how can I see what is the default action for a particular threat, vuln or spyware threatid?Preferly from within the box itself...And now for an observation:I tried searching for eicar in the threat vault and obviously there are four different (?) eicars registered:2739329 Virus/Win32.eicar-av-test.b2459563 Virus/DOS.ei...

Resolved! Getting an application definition modified?

Folks.I have run into an issue with the way a specific application passes the firewall, and I need to put in a request to Palo Alto to have it modified.The application is Subversion, and when I set the firewall to allow only "application default" services, the firewall blocks connections because this particular installation is running off an Apa...

URL Filtering - Continue Action on Terminal Server

Hi,I have a customer who has deployed a PA-2020 with 3 Terminal Server agents at this seems to be operating well with one exception.They have configured a URL filtering policy that has a Continue action on a number of categories.When a standard LAN user accesses these sites, the continue operation works fine. The problem is when a user on a Term...

Discussions

Resolved! Unable to install Applications / Threats 360-1705