General Topics

Resolved! Application recognition inside http-proxy traffic

Hello!Is it possible to make policy rules for web applications which are inside proxy traffic? In our company proxy is mandatory 😞I positioned PAN firewall in front of the proxy to see users, but now I don't see which web applications are used. If I put PAN behind the proxy, I'll see applications, but I won't see users.Workaround may be URL fil...

After upgrade to OS 4.0.1, can we still use back UIA 3.1.x and SSL VPN Client 3.1.x?

Hi All,After upgrade to OS 4.0.1, can we still use back LDAP 3.1.x and SSL VPN 3.1.x?Because the web site didnt release UIA or SVC for PAN OS 4.0.1... Anyone encounter this issue?

Resolved! Does active-active HA imply that panorama is required for complete reporting?

Looking at the new features in 4.0, it is not apparent whether the reporting in the GUI would have a complete picture in an Active Active HA configuration. Would it? Or would panorama be needed to do aggregated traffic and activity reporting?

Resolved! Removing Custom Reports?

Hello all,I have a number of old Custom Reports I'd like to remove from my PA-500. The Report Templates are long gone but the Reports remain on the left-hand window under the Monitor tab.Anyone know if there's a way to clean unwanted reports out from that window? Thanks!EDIT: My original question isn't quite as clear as I'd like...really what ...

UDP Conversations for VOIP

Hi All; I have an outside VOIP server running H323. The phones internally use a keep-alive mecahnism over UDP 5000 as a destination and varying source ports. The server on the untrust side of the firewall will send the same keep-alives in response. This is known by some firewalls as a UDP conversation or sometimes is necessary in transparent m...

Resolved! admin password change

Hello Community,when I change the admin password, no commit is available...PANOS <= 4.0.1Bug or feature ?Regards,Christian

Convincing Domain Admins to cooperate with PAN User-ID Agent

If the security organization would like to use Palo Alto Networks firewall features for tracking user behavior in a more meaningful way, that alone should be enough to get cooperation from all Domain Admins. PAN User-ID Agent should be given an account to use which has read-only access to Active Directory (and PAN Terminal Services Agent similia...

Difference in URL block categories between panorama and device

I have 2 PA-2050 being managed by panorama, all running 3.1.6. I am using the brightcloud url filtering service we paid for and both devices are up to date.When I do a commit all from panorama it shows "commit all succeeded", however when I check the details of the commit I get a list of messages similar to "member arts is an invalid reference"...

Resolved! How to choose a context of deivce and vsys on CLI

(Panorama 3.1.7)Hi Suppport Team,Could you tell me how to choose a context of deivce and vsys on Panorama's CLI?Regards,Tomoyuki Komure

Hide protocols from display in ACC?

Does anyone know of a way to hide protocols that would normally display in the ACC? Let's say there is an organization that generates a lot of ICMP traffic. This is all known good so they would like the capability to hide it from displaying in the ACC and Dashboard.

Resolved! URL Filter Log Size in PAN 4

I just upgraded to PAN 4.0.1 in hopes of using the new feature that allows the configuration of log sizes. However, the log I am interested in enlarging is the URL Filtering log and it does not appear on the list of configurable logs. Is it included as part of the Traffic or Threat log size configuration or is the URL Filtering log just not one ...

Configure Active Directory on PAN OS 4.0.1

Hello all,I am a new Palo Alto user and have just booted up and setup my PA2020. I currently am running on virtual wire and so far everything looks fine. I'm trying to link the device with my AD Server using the User ID Agent and I got no errors so far yet the logs still aren't displaying the users.For reference here is some info:AS Server IP: 1...

Resolved! Common Criteria certs

How much longer before PA gets the EAL2, EAL4, FIPS140-2 Level2 and ISCA FW certifications? Just curious.

Resolved! Terminal Services UserID on x64 servers

Is there any ETA on when the TS UserID client will support 64-bit Windows? I have a 6 server Citrix farm, all running 2003R2 x64 and can't use the main "killer" functionality of the PA device because I can't differentiate my users...We'd be happy and willing to run a beta release and/or help test software if there is anything available.

IPS False Positives

We are constantly seeing false positives like this. The victim is a Windows ActiveDirectory Server. I believe we need to add some sort of intelligence to the IPS in order to reduce these kind of false positives to an minimum. Would it be possible to extract some intelligent information from the Firewall itself ? I mean basic information like Op...

Discussions

Resolved! Application recognition inside http-proxy traffic

After upgrade to OS 4.0.1, can we still use back UIA 3.1.x and SSL VPN Client 3.1.x?