About dpenhall

Any chance you can supply those as filter updates in a format that the 6.0 UserID agent can use ? We are a long way off updating to 6.0.0 on the gateways so getting this feature in the UserID agent is great...its just getting it to work is a problem. Cisco ISE filters would be great as well . ... View more

Hey Hulk,       Thanks for that, should have also mentioned the we are running Panorama so figured had to run these commands on that device. - set cli config-output-format set - configure - show device-group "Policy Name" pre-rulebase security rules Key issue is that match command doesnt work here so had to manually copy from the CLI output and search via notepad. ... View more

Thanks for the reply. Since we have multiple different vulnerability profiles, under the policies tab ( as below ) I want to show in the rulebase GUI where each vulnerability profile is used. Similar to if I was looking for a address object I would put the objects name in the search bar of the policies tab and the rule base would then only show me rules where that object is in use. I was looking for away of NOT having to check each vulnerability in a 200 rule + config by manually having to check each rule and what vulnerability profile is assigned. Does that make it clearer ? Screenshot taken from home PA, not work policy in question. ... View more

Ok, created 2 new servers running the latest agents and manually set them up for equal load. Servers running the older version 4 User agent are still having issues and version 5 servers are stable. Upgrading the original servers to User agent 5.x tonight. Thanks for the info Alex, worked well. ... View more

Sounds interesting to use version 5.x agents on 4.1 devices and it works. I have never had to much luck with backward/forward compatibility with different parts of the PA platform ( talking around the threat management space there ). Will update one agent and see how that goes. Dan ... View more

Hi Greg,     I was reading the notes for 4.1.7 and was planning on doing that in a week or so after my company wide change freeze is over. Is there any other suggestions you can put forward ? ... View more

I agree with this as well. With 1000+ rules it can be complex to manage a rule base. We migrated our rulebase from Checkpoint which was nicely order and group and the last 6 months on the PA it has been difficult to find existing rules if not TAGed. NAT rules do not use TAGs either so if you have a lot of them its even harded. We have already asked for this as well through the correct channels ( as well as other usability features ) so hopefully something will be in coming releases. ... View more

Hi Ben,          Excellent, thanks for that. Exactly the work around I need. I will forward the suggestion on via the correct channels. Daniel Edit: No actually. That doesnt work.Used on Panorama version 4.x u318125@PA-Panorama-UAT> set cli config-output-format set u318125@PA-Panorama-UAT> configure Entering configuration mode [edit] u318125@PA-Panorama-UAT# show shared address set shared address Gbl_nfwtn01 ip-netmask 10.49.254.242/32 set shared address Gbl_nfwtx01 ip-netmask 10.254.6.242/32 set shared address Gbl_srv-dmzn-msecdrf01 ip-netmask 192.168.125.201/32 set shared address Gbl_srv-dmzn-msecprd01 ip-netmask 192.168.125.200/32 set shared address PBNEPLKAPP4001 ip-netmask 10.70.169.161/32 ... View more

Hi Benjamin, thanks for the feedback. Surely there must be a simplier approach than what you have described ? I should have specified that the subnet that I want to check availabiltiy for is a external facing subnet ( public IPs ) that are all NATed on our firewall. i.e. Website hosted behind our firewall. Why must I examine the traffic logs for this and NOT looking at the actual address objects ? Seems a bit counter-intutive to me. ... View more

Hi Bryan,     Thanks for that. Exactly what I was after. Daniel ... View more