About licenselu

Hello, That's the reason I upgrade from 4.1.7 to 4.1.8... Regards, Hedi ... View more

Hi all, Upgrade to 4.1.8. Cross fingers... Regards, Hedi ... View more

Hello, Same problem on a PA 500 running 4.1.7. After one hour, disconnect... Regards, HA ... View more

Hello, I also upgrade one customer (cluster of PA 500) from 4.0.x to 4.1.x. The first release I tried was 4.1.6. It runs...3 days. A reboot was required every week (2 times at minimum). Then I moved to 4.1.7 since 10 days. Three days ago, I was unable to login into the active (backup one was working fine) firewall. Management plane didn't respond correctly. Because some rules are on based User-ID, some policies didn't work... 4.0.x is VERY stable now. 4.1.x still need some fix in my point of view. I will probably wait for 4.1.8 or 4.1.9 before upgrading other customers... How do you restart the authd service from the CLI ?? Regards, HA ... View more

Hello, This is answer is receiver from my local SE. "TLS v1.1 should be supported as of v4.0.x. I found a note that if diffie hellman is used in the key establishment we can’t decrypt." "v1.2 seems to be targeted for the next major release (5.x)." Regards, Hedi ... View more

Hello lancom, Did you find a solution to the lifetime timer (3660 sec). I run into the same issue... Regards, Hedi ... View more

Hello all, After upgrading to 4.1.6, I can confirm PA is NOT ABLE to decrypt TLS 1.1 or TLS1.2. I'm waiting an OFFICIAL answer from PA now : When will it be supported ??? Regards, Hedi ... View more

Hello, First, thanks for your answer. The document only mention SSL2.0, 3.0 and TLS 1.0. No infos about TLS 1.1 or TLS 1.2... In my case, we don't have any problem with the certificate itself because the SSL interception is not doing it's job... I will upgrade 4.1.6 and keep you inform if it's solved or not... Regards, Hedi ... View more

Hello, I tried the Excel using XML API method. It works BUT it's not friendly as the Checkpoint Tools... Regards, Hedi ... View more

Hello, This message is targeted to PA team... It would be nice to provide an official tools to export firewall rules, NAT rules, Decryption rules in HTML, PDF format. Checkpoint has an official tools called Web Visualization tools. PA, please help us... Regards, Hedi ... View more

Hello, Just give me my own experince with PA. I'm woking some in security area with more than 10 years with firewall vendors like Cisco, Juniper, Fortinet, Checkpoint, Sonicwall and...PA PS : PA, Checkpoint and Fortinet are the only product we distribute now... First, bug free IS IMPOSSIBLE ! Second, if possible and if you don't need it, avoid installing Early release software. Also avoid selling new hardware modem. Wait 2 or 3 releases patch.. If some critical features (like SSL VPN for example) for your business are required maybe it's better to choose another device (sometimes brand) to handle this function (in the SSL VPN case, we use Juniper SSL VPN). We have already deployed many PA (PA-500, cluster or single) firewalls and ALL of them are working fine. Some people complains about slow commit, slow GUI BUT never had production/business impact... Regards, Hedi ... View more

Hi, Let's clarify a little bit. 1) You have a default route pointing to the WAN router : OK 2) You say " but there isn't actually a remote network at all.  It's a single host and a single IP at that endpoint of the tunnel.". In my point of view, this kind of configuration never work because you try to encrypt IP traffic to the same IP address of the tunnel endpoint. How do you deal with routing ? Sorry I have no idea regards, Hedi ... View more

Hello, In the initial post, I saw that the timeframe between the reboot and the autocommit is 15 minutes !! It's the normal boot time for PA 2000 series ?? PS : all my PA 500 series boot in less than 6-8 minutes. Twice for PA 2000 series ?? Regards, Hedi ... View more