Hi , If there is asymmetric routing how the firewall process the packet if it is in routed mode . How it process the packet if it is in vwire mode and there is asymmetric routing ? Thanks
Hi all,We are attempting to test global protect with pre-log on in our network and have a number of issues and I was wondering if we might be setting it up incorrectly.The type of set up we require is with windows machines that log on to global protect when they start up prior to users logging on.Now there is nothing in the offical admin guide w...
This my issue !!! During the snapshot same time the source user is not capture by PA and for this issue the internet for specific user is disconnected after 5 min the connection start again and the source user is showing any idea about this problem Many Thanks for all
We have a rule based on LDAP . However after enabling SLDAP on server end, Palos don't identify it as LDAP rather they identify it as SSL based traffic . what is the ideal way of defining the rule for it now 1. To define a rule above with Application- ANY and port and protocol as tcp-636. ? is there a better way to define it 2. To define a rule ...
We have product in place that requires the indicators to be in a text file and verifies if the file type extension is ".txt" ( --> e.g. Pulling from https://ransomwaretracker.abuse.ch/downloads/CW_C2_URLBL.txt diretly works but doesn't when pulling from Minemeld by using any standard EDL prototype --> ..feeds/feedHCWithValue-RSWT1 ). Doe...
I just stood up my Minemeld instance, was able to get it configured and verified it is pulling data from the default miners. When following the steps to secure O365, I am getting an error with the miner picking up the data. It constantly times out. I have read elsewhere on here that there should only be a read attempt each hour or they will l...
Having an unusual problem I cannot find a link that will allow me to download mindmeld.... and for the record there are lots of articles on the PAN site that have links, like this one https://minemeld.s3.amazonaws.com/minemeld-vm-0.9.11-3build2.ova When I click on it the following happens.... AccessDeniedAccess Denied1AA4195C840FC24750SPry...
After reading PAN-SA-2019-00015– Cross Site Scripting (XSS) in MineMeld, I need to upgrade to version 0.9.62 but this is what I get: ubuntu@sfovp-minemeld:~$ sudo /usr/sbin/minemeld-auto-update 2019-06-28 16:45:57,709 INFO:0.9.11 Current status: 2019-06-28 16:45:57,710 INFO:0.9.11 minemeld-engine: current: 0.9.52.post1 latest: 0.9.52.post1 201...
Hey girls/guys. My clients on the internal network, talk to a web proxy on the internet that performs SSL forway proxy. This traffic traverses the Palo Alto firewall - we would like the Palo Alto to see inside this traffic for threats,etc. Note: The web proxy must stay - we cannot move this function to the Palo Alto firewall. Is it possible to i...
Hi Everyone,I would like to create a report that sends me a email either straaight away or on a schedule, that when a user performs a search for a keyword i.e suicide I am alerted. I workout how to create a report if the url contains a keyword, however that is not what I am after. Many thanks in advance for any suggestions. RegardsPaul
Hi,How the packet size impact throughput .Why do we require higher throughput when the packet size is small. How do we identify the packet size during the poc time ?which service will be using the smaller packet size ? Thanks
I'm trying to create an internal gateway to be able to capture User ID fully and start creating User ID based rules. I created the dns records and put the gateway on a loopback interface on the firewall that is in the internal trusted zone. I have done the cert work and confirmed that the name resolution is working. When looking at the logs it...
Hello community, I have an issue and maybe you know the reason. Here the situation:Trying to create an authentication profile to authenticate with active directory but it´s not working.When testing the profile with "test authentication ... " command I get the following error:Authentication to LDAP server at X.Y.Z.E for user "......"Egress: X.X.X...
We have a service account for SCCM (Microsoft's System Center Configuration Manager) which will log onto our user PCs to run a scan to identify what is on the device. At times this account will log on after the user and will make it so the firewall sees the service account instead of the actual source user's ID. I have asked and we are not abl...
