About licenselu

Hello, According to my local SE, TLS 1.2 decryption should be supported in release train 6.x... Regards, HA ... View more

Hello, If the vpn is stable, try to reduce the TCP MSS (value like 1420 should be OK) and test again... Regards, HA ... View more

Hi, A have a cluster of PA500 running 5.0.8 since 12 days. No problem at all. Much more stable than 5.0.7... Regards, HA ... View more

Hello, An active cluster (PA500) running 5.0.7 goes "offline" this afternoon. -  Some webs sites working and others no - HTTPS traffic was blocked to all financial web site. After failover, everything was OK Rollback to 5.0.6. Regards, HA ... View more

Hello, Even if the MTU seems to be the same on both devices, you probably have a MTU mismatch (what's on you see in the log). On the Cisco device, you can add the following command under the "faulty" OSPF interface: ip ospf mtu-ignore This command should be also present on the PA device, except that PA doesn't support this feature ! REM: For PA team, please add the support for this feature on your device. As I can see you're using sub-interface on the PA. So the MTU will not match the physical interface of your cisco device... PS: If you are using subinterface on the Cisco device, MTU should match Regards, HA CCIE#13029 (R&S, Security) ... View more

Hello, We are Skybox partner. From my own experience, Skybox integrates correctly BUT not fully support Palo Alto. Fully supported partners are: Cisco, Checkpoint, Fortinet and Juniper. Working features ------------------------ - collecting rulebase, - detecting overlap/hidden rule in the rule base, - collecting routing table (except routes from tunnel interface, see below), - support rules with application (so even if port 23 is open but in the rulebase but Telnet application is blocked, skybox understand that Telnet is blocked by the rulebase), - understand NAT and authentication rule, Missing Features ------------------------- - support of tunnel interface, - compliancy check (NIST or PCI) of the rulebase, - rulebase usage (object statistics, etc) REM : should be available soon I had the opportunity to test Firemon, it's very far away from what Skybox can do.... Regards, HA ... View more

Hello, The best way to solve this problem is to configure the FTP client to send command (like NOOP) over the control channel at regular time. Regards, HA ... View more

Hello, Running 5.0.5 or 5.0.6 on many PA500 (cluster or standalone) without any issues... Regards, HA ... View more

Hello, "Another problem is that the identified appid could be just "http-proxy" instead of the true app being used if you have Client <-> PA <-> Proxy." That's completely FALSE !! Even if the traffic is going though a proxy (User-> PA -> Proxy) you can still apply application rules to the traffic flow ! Instead of seeing 'web-browsing' as application in the log, you will see 'http-proxy' but all the other applications (ms-update, etc) will be recognized correctly ! If you need SSL exemption (for specific domain), you must use DNS format (like *.google.com) not IP. Regards, HA ... View more

Hi all, Is the problem limited to 5.0.3 or it affects all releases ? Regards, HA ... View more

Hello, PA 500 with around 100 users behind it top - 16:01:41 up 44 days,  6:37,  1 user,  load average: 1.11, 0.36, 0.19 Tasks: 100 total,   2 running,  98 sleeping,   0 stopped,   0 zombie Cpu(s):  2.9%us,  2.0%sy,  4.3%ni, 90.1%id,  0.6%wa,  0.0%hi,  0.1%si,  0.0%st Mem:    995872k total,   963276k used,    32596k free,     6576k buffers Swap:  2212876k total,   477108k used,  1735768k free,   206268k cached As I can see from your output, in your device, the swap area is not used. Do you see any difference when you commit (time, etc) ? Regards, HA  ... View more

What I mean by MTU is MTU mismatch between OSPF  neighbor. ... View more

Hello, One possible reason why OSPF adjacency cannot be completed is MTU. Check it on both devices... Regards, HA ... View more