About kbrazil

Hi dagibbs, You can always lock the ports and src/dst ip's down while you are performing the application investigation phase.  Then you are no less secure than a traditional firewall until you get the information you need to further lock down the application(s).  It's also very simple to filter the logs by src/dst to see all of the relevant conversations and weed out the others while testing. Cheers, Kelly ... View more

Well, if I have to change the IP for the "sister" network on the PAN that shouldn't be a major problem, as long as I can keep the subnet the same.   It's only 4-5 servers and I can just change their default gateways to a new IP. My biggest concern was that traffic would somehow get mis-directed, but if I'm using two separate VRs I don't really see how that would be possible. The larger concern was that the remote VPN'd systems are all pointing back to individual IPs (I have no idea why they didn't use hostnames), so I'm stuck with the 192.168.1.x subnet for the sister company until we can hit all of the remote sites and change the computers to connect to Citrix via hostname/etc.  Since we are going to have to do that when we transition their data onto our network anyway, I'd rather NOT have to change when the equipment is moved over here, only when we do the actual data migration. ... View more

Hi Kelly, thank you for the feeback! Since entries with subnet mask notation were accepted under service route configuration (also after commiting), I assumed it was a valid configuration. I tried entering single IPs and it did the trick. The (host) routes also seem to take precedence over the services as described in the configuration guide. Now I can use the services without having to have internet access via the management port. Ingo ... View more

The logs for DoS protection should show up in the threat logs. ... View more

Hi there, Log forwarding profiles can be enabled per policy, so you can create a Security Policy rule that allows "remote-access" applications with an application filter.  Then attach a log forwarding profile that emails for every session.  Since the emails will only apply to applications that match that rule, you effectively get an email every time a user completes a remote-access session. You can also turn on session logging at start for that rule so you get the email as soon as the session is identified as a remote-access application. Cheers, Kelly ... View more

thanks for your help guys. ... View more

Your best bet might be to create a template of a simple config you want to use for rollouts and then do a "request system private-data-reset" (or factory reset).  Then upload your template config. Clearing the logs does not clear the old reports in the system.  To do that you can use the "delete report ..." command.  I'm not sure if you can use wildcards or if you need to delete each one individually. Cheers, Kelly ... View more

Hi, I believe there will be a separate App-ID for traceroute including UDP. Please defer to your Sales SE to determine ETA/Roadmap. Regards, Renato ... View more

Hi there, Glad you figured it out.  Another way to do this in PAN-OS 3.1 and later is to create an outbound source-nat for the server/service and configure the source-nat as 'bidirectional'.  This will create the secondary inbound destination-nat in the background.  It will essentially be a hidden rule that looks like this: source-zone:  any dst-zone: source-zone of the outbound bidirectional nat rule destination-nat: source-nat ip of the outbound bidirectional nat rule This guarantees the same IP for inbound and outbound initiated traffic. Cheers, Kelly ... View more

Thanks this helped out a lot! ... View more

Hi there, The next major release will include tagging functionality for policies that will give you similar organizational capablities. Cheers, Kelly ... View more

Hi there, It looks like the next major release will have this capability. Cheers, Kelly ... View more

Hello, This capability will be available in the next major release. Cheers, Kelly ... View more

An incomplete session means either the 3-way TCP handshake never completed or if it did complete there were no further packets.  This typically happens when the firewall only see's half of the traffic.  This can be due to asymmetric routing or perhaps a firewall rule/acl downstream from the Palo Alto firewall. If you check the details of the session you will probably see only 1 packet was recorded which would also indicate that the firewall is not seeing the return traffic for some reason. (or maybe the return traffic is coming back on a different interface in another zone?) Cheers, Kelly ... View more