About kbrazil

I'm not sure if it will work for reports, but in logs you can filter on the following: not (addr in '0.0.0.0/0') Cheers, Kelly ... View more

They should be the same now (160 GB).  I suspect the 2020 shown is an older model that used to come with a smaller HD. (I think it was 80 GB).  Only the PA-5000 has the option for 120 GB and 240 GB SSD. Cheers, Kelly ... View more

I don't specifically need any new features in 4.x right now. I don't have any issues with 3.x that won't be fixed that might force me to upgrade to 4.x to get them fixed. Per the recommendations above it sounds like you should stay on 3.1.x. Cheers, Kelly ... View more

If the SSL VPN client is already installed an upgrade will not require Admin privileges.  A new install does require Admin rights to the machine. To silently deploy the client you could push out the msi package using Group Policy.  See the following KP article for information on extracting the msi. https://live.paloaltonetworks.com/docs/DOC-1206 Cheers, Kelly ... View more

Yep, just configure the interfaces as L2 and then create a new VLAN interface in the same VLAN as the L2 interfaces.  That VLAN interface is where you will configure the IP address. Cheers, Kelly ... View more

Along with our standard AV and Spyware signatures and known-malware URL categories, we have introduced a new "drive-by download protection" feature in PAN-OS 4.0.  Basically this gives you the capability of setting a "continue" action on a file-blocking profile.  For instance, you can set all executable downloads as "continue". This keeps malicious web pages from automatically downloading and installing fake antivirus and malware detection programs when users inadvertently hit the page.  Instead they will get a warning page pop up that you can customize.  If the file really is legitimate, the user can continue the download at their choice and the session will be logged. Cheers, Kelly ... View more

Hi there, There is no usable/beneficial memory information to gather via SNMP since all memory is preallocated at boot time.  This is very different than a typical server system where memory is dynamically allocated to processes.  You would basically see a straight line graph showing all memory being used and no free memory.  Not much use to that. Disk utilization is very similar.  You never run out of disk because once it fills up, logs rotate out.  Again, you will quickly see the disk fill up and stay full forever. Cheers, Kelly ... View more

Hi Manfred, Have you tried blocking the "flash" application in the Security Policy? Cheers, Kelly ... View more

One more thing - in the mean time you can create an App-Override policy to control the application by IP/Protocol until an App-ID signature is created.  Create your own custom Application and tie it to the App-Override policy. Cheers, Kelly ... View more

Hi Tauseef, You can submit a new App-ID request here:  http://www.paloaltonetworks.com/researchcenter/submit-an-application/ You can also request an App-ID through Support.  They will typically ask for a packet capture of the traffic to expedite the process of creating the App-ID signature. Cheers, Kelly ... View more

Actually, Virtual Wire acts a bit like an inline tap.  Any packets that are seen on the interface are forwarded out the second interface in the Virtual Wire.  If you are out of SPAN ports you can put the PAN device in between an existing SPAN port and another device using the SPAN with a couple interfaces in Virtual Wire mode and allowing all traffic to pass via open security policy. Cheers, Kelly ... View more

Hi Stuart, It might be possible to consolidate rules if your public and private addresses match up contiguously.  Then you can create a single dst-nat rule for the entire subnet and match that up with a single UTurn NAT rule for the subnet. e.g. 1.1.1.1 --> 10.5.5.1 1.1.1.2 --> 10.5.5.2 1.1.1.3 --> 10.5.5.3 1.1.1.4 --> 10.5.5.4 etc... Cheers, Kelly ... View more