General Topics

Exchange 2010 CAS in the DMZ

Aside from being not supported by Microsoft, has anyone placed an Exchange 2010 CAS server in a DMZ? It looks like the reasoning behind it was because you'd have to punch so many holes in the firewall, it wasn't worth it. But since the PAN has a little more flexibility, I wouldn't think it would be a problem.

Result - Stuck in PENDING

Hi,I have an antivirus download schedule and install job, but it seems PA FW isstuck in the Download action. Sine 2 days I have the same result as below.Enqueued ID Type Status Result Completed--------------------------------------------------------------------------22:00:10 2 Downld ACT PEND ...

Block Pornographic Images in Google

Is there a way we can filter pornographic images in google?Hope you can help me with this one.Thanks,Rex

Safari Security Errors

I have suddenly started getting security certificate errors while using Safari. I am not using a Captive Portal and have no certificates on the PAN, however the certificate errors always point back to a self-signed certificate by the PAN. I am attaching a screen cap as an example, however please note that the ip #'s it lists vary and they are ...

Resolved! Problem Creating Rule for IKE Traffic

I think it's my phase II re-key traffic being dropped. I tried to set up a rule source untrust with a specific IP, dest untrust with my Firewall's IP, application IPSEC, service application default, Action Allow.It never gets hit and my udp/500 traffic gets dropped by my clean-up rule.I am brand new to Palo Alto and probably don't fully understa...

Conficker DNS Request Question

So we have some conficker infections here where I work. The problem is that the PA sits at the edge, so all I see are Conficker DNS Requests that get proxied through our internal DNS Server to the Internet. I guess there is no way that PA can see what IP the original request came from ?Any creative thoughts on how to do this ? What I've been doi...

ipv6 interface

Hi, I can't assign an IPv6 address to a L3 interface of a PA-500 in 3.1. But I can add IPv6 addresses to the objects DB, and there is a 'IPv6 firewalling' flag in the general device configuration. Has anyone played with IPv6 on a PA? Is there any limitation?Thanks

Resolved! Security Rule order

Lets say I have rules set up like this...First rule uses a URL Filtering Profile on just port 80/443, and another rule below it that uses the Antivirus and Spyware profile also on just port 80/443. If the first rule allows traffic through, will that traffic be checked by the next rule down(Antivirus/Spyware profile)?? Or is it, once the rule al...

Resolved! User Agent timeout and expiration timer

Hello,I have configured Age-out timeout to 720min and configured "<enable-full-expire>1</enable-full-expire>" on config.xml.There is the way to check the timer for a particular users to check how last for expiration ?If I restart the PAN-Agent services, does the timer for users will be set to 720min or they will continue as no restar...

Resolved! ARP Question

When logged in via CLI on the PAN 500 and I view the ARP table, it says maximum of 500 entries. Does this mean that the PAN will only support 500 unique connections at a time?I'm still trying to track down a problem I've been having with some machines unable to actually get out to the internet for a few minutes at a time and then they suddenly ...

Weird blocking behaviour..

Greetings.I have a user who is using a specific protocol - FTP with explicit TLS or otherwise known as FTPES (not to be confused with SFTP or SCP), and for some reason my firewall is blocking it.The PA identifies the transaction as SSL - which I would expect - but both FTP and SSL is explicitely in my allowed protocol/application rukle - yet the...

Resolved! Panorama/ Report Creation...

...suitable for presentation. I guess I don't understand what I'm seeing or I don't understand what I should expect from Panorama. Quickly: I have 2 PA-2020's logging to a single Panorama instance where I attempt to create "consolidated" reports. Ver 3.1.4 for all componants.1.) I generate a raw report using filters within Monitor/URL Filtering ...

Resolved! performance data

Hello team.can you please tell me where I can have perf data w/ Smartbits, IXIA or avalance?I'm in the tender process to some customer, this is required from that customer like..PA-4020, PA-4050 etc.64 byte, 128 byte,256byte,512byte,1024byte,1500byte-requirement1. performance data2. latencywould you please help me out?thank youBH Lee

processor specifications?

HiI want to know, how many processors of each device, which marks are the processors and how fast they work?I thank you very much any help I can give. Best regards...

disk quota limitation for each log items.

Hi all.PAN 4.0.x is able to change disk quota for save log. And Disk of PAN for save log has been allocated about 46GB as a max even though disk space is a 160GB.If I want to change disk quota for save log, does it have size limitation?For example..Total disk size is a 160GB.Log for traffic has been allocated 14GB and unused disk space is a 146...