About kbrazil

I'm not sure what you can do here since the file is first identified as ZIP, then unzipped and further identified as a DOCX file.  To allow DOCX you will also need to allow ZIP files. You might be able to create more restrictive Security Policy rules above the existing ones and only allow ZIP and DOCX files to/from certain sources and applications. Cheers, Kelly ... View more

Also, do you have any custom Vulnerability, Application, or Data-Filtering signatures?  Those can take a while to compile during a commit, depending on the changes made. Cheers, Kelly ... View more

Hi Eugene, I believe your question was answered above with ARP Load Sharing.  This does not require an L4 switch as it shares the load between the active units automatically.  This really only works well with directly connected hosts initiating traffic outbound. The intention for Active/Active HA is not to share the load for higher performance but to address asymmetric routing scenarios. The directly connected HA3 links in the cluster will make sure traffic is correctly forwarded in cases where the traffic was delivered to the wrong firewall. You may need to have a further discussion with your local SE to get more information on how to design and configure an Active/Active cluster if you find that design is really necessary.  Try to stick with an Active/Passive design, if possible, as it is much more simple to design, config, and troubleshoot. Cheers, Kelly ... View more

Hi Sam, It looks like we only control Youtube safety-mode and uploading today. For more information, see https://live.paloaltonetworks.com/docs/DOC-1451 It might be possible to create custom app-id signatures for categories if Youtube exposes that information in any of the headers. Cheers, Kelly ... View more

This is certainly an interesting design! I don't see two physical interfaces with IPs in the same subnet very often. If the ISP cannot change your external addressing or you cannot use just a single outside interface, then you might try the following: Create two Virtual Routers (You can have overlapping subnets using multiple Virtual Routers) and put each external interface into its own.  Call them Default and Server.  Both have a 0.0.0.0/0 route next hop of 100.100.100.100. Create three L3 interfaces: Inside interface goes into Default Virtual Router, Inside zone .198 goes into Default Virtual Router, Public zone .197 goes into Server Virtual Router, Public zone Create your NAT rules as you have defined in the diagram Make the Server rule static, Bidirectional Make the Client PC rule dynamic-ip-and-port Create two PBF rules: Inbound PBF rule for the Server:  from .197 interface, then send to Internal interface Outbound PBF rule for the Server: from 10.1.1.2/32 address, then send to .197 interface Create an any any allow Security rule to test Seems like this should work in theory. You are basically using normal routing for the bulk of the traffic and PBF to force the Server traffic over the other link. Cheers, Kelly ... View more

Your best bet might be to create a template of a simple config you want to use for rollouts and then do a "request system private-data-reset" (or factory reset).  Then upload your template config. Clearing the logs does not clear the old reports in the system.  To do that you can use the "delete report ..." command.  I'm not sure if you can use wildcards or if you need to delete each one individually. Cheers, Kelly ... View more

I think using different zones for interfaces 1/3 and 1/7 might make this work.  This way the firewall will see the packet coming from a different zone and will not match the original PBF flow. Just be careful about the return traffic, though.  You may need some creative security policies to make this work. You might even consider having the external device not send the traffic back through the firewall, if possible. Cheers, Kelly ... View more

I believe you cannot do PBF by destination interface or zone because the device only knows the egress interface after consulting the routing table, but PBF is performed before routing.  You can configure PBF by destination address, however. Cheers, Kelly ... View more

Hi there, Can we get a screen capture of your PBF policy?  If the policy is correct, it might be a bug and I imagine you could work around it by putting e1/7 into a new zone and using the source zone in the policy instead of source interface.  Alternatively you could exempt PBF forwarding for traffic sourced from 10.2.43.20 with another PBF rule above the existing rule. Cheers, Kelly ... View more

One point of clarification - when you add a second SSD hard drive of the same size to a PA-5000 device it automatically becomes mirrored in a RAID 1 configuration. Cheers, Kelly ... View more

Absolutely - all policy rules are evaluated top down and terminate on match. Cheers, Kelly ... View more