About kbrazil

Hi Bart, Did you try doing a "show counter global | match drop" and check to see which drop counters were increasing?  This is one of my favorite troubleshooting commands.  From there you can also filter the counters to narrow down whether that is the issue for the flows you are investigting.  The counter names are typically pretty self explanitory, though I'm not sure how they would show up in this case. Here's my cheat sheet: Set a filter to control what traffic is counted debug dataplane packet-diag set filter match <criteria> debug dataplane packet-diag set filter on  Show the drop counters (absolute or relative to last time command was run) show counter global packet-filter yes | match drop show counter global filter severity drop packet-filter yes delta yes Hope that helps, Kelly ... View more

I've done this several times using external ports with BGP and OSPF.  Inter-VR OSPF will definitely not work without the external ports, but it might be possible BGP would work without the external ports.  I would try a clean setup first using external ports and the external port IP addresses as the BGP peering endpoints instead of the loopbacks. Also, since you are running BGP to the loopbacks, I wonder if you are running into a TTL issue.  I believe by default the eBGP peers are setup for only two hops.  If you configure it for a higher number it might work since you are actually going over 3 hops using loopbacks on either side.  If you are doing iBGP then this is probably not the issue as by default the TTL should be 254. Cheers, Kelly ... View more

Most of the models will allow 32 total QOS nodes per interface.  The bigger boxes (PA-5060, PA-5050, and PA-4060) will allow 64.  The list is processed first match top-down. Cheers, Kelly ... View more

Double check the Peer settings under Incoming Connections and Outgoing Connections.  Make sure Remote Port and Local Port are set to 0 and Allow is checked on both. Also, doublecheck the policy in both VSYS to make sure there aren't any cleanup rules that might be blocking intra-zone traffic. Cheers, Kelly ... View more

There are new proxy apps coming out all the time.  Please submit the application via the site so we can write a signature.  App-ID allows a single signature to cover 'families' of proxy avoidance applications. (i.e. php-proxy)  This is much more effective than URL filtering, but it can also be a cat and mouse game as new proxy apps come out. Cheers, Kelly ... View more

Hi there, How is the application being identified in the logs?  If it is an application that is already in the App-ID database and it is not being identified correctly, then a support case should be opened.  If the app is not yet covered you can submit the app to the Application and Threat Research Center: http://www.paloaltonetworks.com/researchcenter/submit-an-application/ Cheers, Kelly ... View more

There are App-ID's for various software updates.  You can allow file downloads for those App-ID's.  If your particular malware update is not covered by an App-ID you can either create your own custom one or put in an App-ID request to Palo Alto Networks:  http://www.paloaltonetworks.com/researchcenter/submit-an-application/ Cheers, Kelly ... View more

If the clients and the servers are on the same LAN then the response from the server is likely going directly to the client and not back through the firewall.  The client is receiving a response packet with the internal address instead of the external one so it rejects the packet as unexpected.  To fix this scenario you can set up a Source-NAT + Destination-NAT rule from the client subnet to the servers so the return traffic is forced back to the firewall and correctly processed for NAT and security before it gets to the client. This concept is known as a U-Turn NAT Rule. Cheers, Kelly ... View more

The recommended release is typically the release with the largest last number (the maintenance release version).  For now, I would recommend 3.1.9 unless there is a specific reason to use 3.1.8. I'm not sure of any gotchas, though you should check the release notes to see if anything is called out.  You will need to upgrade to 3.1.0 before upgrading to 3.1.9. You might consider working with Support to go over any known issues, but it should be pretty straightforward.  Remember to backup your config file. Cheers, Kelly ... View more

Hi Kevin, There are many GUI improvements in the 3.1 and 4.0 releases.  You should upgrade to 3.1 since 3.0 is no longer supported.  If you require the new features in 4.0 you might consider that as well, but I would consider 3.1 the most stable branch. Cheers, Kelly ... View more

Looks like a name resolution issue.  Make sure you have the correct DNS info under Device->Settings. You could also try pinging a public host by IP address instead to see if the network layer is working: ping host 4.2.2.2 Cheers, Kelly ... View more

Hi there, You might check out this document and see if it points you in the right direction:  https://live.paloaltonetworks.com/docs/DOC-1357 Cheers, Kelly ... View more

You might explore using the UserID XML API to map RADIUS users to IP addresses: https://live.paloaltonetworks.com/docs/DOC-1348 You would still need to use LDAP or AD to get user to group mappings. Cheers, Kelly ... View more

Hi Bjaming, You would select "Application Default" in the Service column in this case. Cheers, Kelly ... View more