About kbrazil

jnguyen · ‎12-07-2010

if you are still having an issue with pinging the logical interfaces please create a support case and we'll set up a remote session to further debug.

blacksan · ‎09-20-2010

make sure you are running PA 3.1+ to see the Policy Base Forwarding. (PBF) which is a simply version of Policy Base Routing (PBR).

kbrazil · ‎06-27-2010

I'm not sure how many routes are supported in the Control Plane, but the Data Plane forwarding engine is limited to 20k routes on the high-end platforms, so this will probably be the max routes you want to use with BGP. Cheers, Kelly

kbrazil · ‎06-23-2010

Hi Andre, Today the NAT policy is only local to the device and is not shared in Panorama. Global objects can only be used in shared policies so you need to recreate the objects locally for now. It looks like this will be addressed in the next major PANOS release and NAT policies will become shared. Then you will be able to use global objects in your shared NAT policy. Cheers, Kelly

will74103 · ‎06-19-2010

Thanks for all responses. As an FYI - The current 3.1 Admin guide, 3.1.2 help screen, and the recent 3.1 admin student guide all reference the Spyware Download tab as a current option. Thanks again for help. So far all is looking good.

michael_schumak · ‎06-20-2011

With "multiple agents" it was meant that they are installed on different boxes. So that when one box dies the other can take over... Mike

kbrazil · ‎06-15-2010

I don't have a 3.0 box handy to test, but I believe the export command should not include "debug-pcap" but "filter". A debug-pcap is a special type of pcap for traffic terminating on the firewall (such as DHCP or routing protocol). The "filter" pcap is for the traditional packet capture you are performing. There are a couple of other types of pcaps including application and unknown-application. Cheers, Kelly

grant_sturgis · ‎06-14-2010

Thanks Kelly!

grant_sturgis · ‎06-15-2010

The problem here was that I was choosing "Last Calendar Day" for the time frame, while the user had no activity. Once I switched that to "Last 12 Hours", it worked fine.

mnistal · ‎11-02-2012

Really helpful. Thank you!

kbrazil · ‎05-29-2010

Hi Veera, Try this configuration: https://live.paloaltonetworks.com/docs/DOC-1357 Modify the PBF configuration in this document to have specific sources use each Internet link. Cheers, Kelly

kbrazil · ‎05-21-2010

It sounds like you want to ignore certain users like service accounts. This can be done by creating a text file called "ignore_user_list.txt" that includes the usernames you want to ignore. Put each username on its own line (you do not need to prepend the domain). Put this file in the directory where the PAN Agent is installed. Typically this is C:\Program Files\Palo Alto Networks\PanAgent. Restart the agent and you should be good to go.

James · ‎05-14-2010

Good News!

kbrazil · ‎05-13-2010

I believe you are seeing the memory utilization for the Control Plane and not the Data Plane. They are completely separate and the Control Plane CPU and Memory has nothing to do with sessions or traffic through the box. It is only concerned with the Web GUI, CLI, routing protocol daemons, logging, reporting, and other administrative tasks. To see the resource utilization for the Data Plane use the following commands: PANOS 3.1: show running resource-monitor PANOS 3.0 and below: debug dataplane show resource-monitor The show system resources command will show you the memory and CPU utilization of the Control Plane, as does the GUI widget on the dashboard. Cheers, Kelly

amansour · ‎12-10-2012

Guys the supplicant native to Phones and IPSec in general use XAUTH, certificate authentication. We developed a solution in house that does just that, profiles for VPN and Wifi and connecting them to the PAN agent. Works on Android, Blackberry, IOS and Symbian etc. If your phone has VPN settings the XAUTH is usually the way to go. That way when they upgrade you don't need your VPN client to upgrade as well. Same for Wifi. The key thing here is client auth certificates replace credentials such as Windows etc. General use of a single p12 per client and OSCP or a CRL makes PAN able to use the same cert for Wifi, VPN and SSL Decryption (even wired if you want to go 802.1X).

Member Since	‎04-08-2009 04:41 AM
Date Last Visited	‎08-18-2015 09:06 AM
Posts	217
Total Likes Received	83

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

About kbrazil

Re: Upgrade to 5.x - the good, the bad, the ugly?

Re: multiple interfaces in a Zone

Re: Palo Alto BGP: Conditional Advertising

Re: Can VWire use aggregate links?

Re: Blocking Postal-Receipt.exe

Re: Multicast Packets forwarding

Re: Best practice for OWA and OMA

Re: Need help with BGP in Active/Active HA

Re: Need help with BGP in Active/Active HA

Re: VoIP Traffic, strange behavior, need help to understand please.

Re: Security policy using group in negate form

Re: Policy Export

Re: OSPF A/P HA Config with Floating Static Routes

Re: Can VWire use aggregate links?

Re: Add second Internet coonection

Re: Unable to Ping to Layer 3 interface

Re: NAT question

Re: BGP authentication

Re: Missing Objects defined with Panorama in NAT Policy on device

Re: Spyware Download Tab

Re: How to set up Active Directory user ID?

Re: Packet Capture Question

Re: QoS Question - per session or aggregate?

Re: User Activity Report

Re: Export Object Addresses list

Re: internet load balancing

Re: PanAgent - Ignore specific users?

Re: Panorama and ESX4i

Re: Memory Leak in PAN 3.1?

Re: SSL VPN and iPhone OS 4.0

Unlock your full community experience!

About kbrazil