About santonic

You don't calculate max sessions. It's a hardware specifications which depends on PA appliance you have.  ... View more

It's useful for scenario with IPSEC redundancy on FW with mutliple ISPs. Set a VR for each ISP and one for local networks. And then use intra VR routing for traffic between them. ... View more

I'm afraid that setting is the same for all administrators (Setup->Device->Management->Auth Settings) ... View more

Hmm, I wouldn't be satisfied with this solution. You need to have all your signatures up to date for PA to do its function of protecting your network properly.   If it was some newly released threat (IPS, AV..) signature causing issues it's either a genuine threat or false positive. In first case you have to be aware of it in second case you need to make exception and keep on updating signatures. If it was app signature causing issue you either have an application you aren't aware of in your network or there is some broken applicaion signature. Both situations can be dealt with by fine tunning your security policy.  ... View more

I would suggest checking all (traffic, threat, url...) log files first for blocked events. Because turning off security profiles is not a solution. ... View more

Even if it's been there always you can optimise it and turn off logging for non interesting traffic.   But to find the source of spike of events: PA FW saves these reports daily. I guess you have to check past reports, find out on which day there was a spike, which rule recorded it and (in the unlikely case you still have logs for that day) you can find out which traffic caused it. If you don't have logs you can check other automated reports and look for possible causes.     ... View more

Are you saying that your PA date keeps changing to 2013? ... View more

Adjust the date to proper date.   ... View more

There is no such built-in function.  But it shouldn't be too difficult to write a script which parses XML config file and rewrites it as CSV as XML is nicely structured. ... View more

You can change the 'TCP timeout' option on the aplication which is recognised for that traffic. Or even better; make app override for that traffic and change the setting on this new app.     ... View more

No, interface can not belong to 2 VRs. But you don't need mutliple VRs for simple route failover. Check policy-based forwarding (PBF) if it can help you with your scenario. ... View more

Reports are basicaly queries on log files for specific information. So they are sort of an extract of log files. And I believe they are stored seperately from log files so they don't affect log retention directly.   ... View more

Transfered bytes are irrelevant for logging. Log entries are generated per session so look at seesions counter values. A single http download session which transfer 3Gb means one log entry same as a DNS query for this site which transfers only few bytes.   Check the most used rules and see if you log some non relevant sessions like DNS and ICMP or boradcast traffic and similar.  ... View more

You can't in that case.   What do logs say? Does traffic stop just for 1 client or more? Check reachabilty of gateway from that client. Check reachibilty of DNS server. Check some internet address by IP. Etc.     ... View more