About HULK

Hello Smi12, So far (with valid BrightCloud URL-DB license), the BrightCloud database is published once a day, but can be updated more often in the event of an emergency (e.g. gross miscategorization).  As a best practice, it is recommended that you set your download interval for BrightCloud to once a day to get the latest updates. As per the Datasheet of BrightCloud® Real-Time Anti-Phishing Service : INTEGRATION OPTIONS: Webroot provides a RESTful web service, as well as an SDK, allowing partners to incorporate the BrightCloud Real-Time Anti-Phishing Service into their own solutions with ease. Hence, this might be added with PAN Fw's Brightcloud in future. I would suggest you to get in touch with your Palo Alto SE to get more detail information on this. Thanks ... View more

Hello Roman, As torm said, if you want to allow all UDP traffic, you may create a custom service profile and allow all applications in a "security Rule". NOTE: UDP is not an application, it's a Transport layer protocol used to application traffic. Hope this helps. Thanks ... View more

Hello Roman, In case of any UDP based Application traffic, The PAN firewall will allow few packets in each direction ( Client-Server and Server-Client) to identify/match the application signature App-ID. Ideally, it will be minimum 4 packets or 2000 bytes. Till that time, the PAN will identify that traffic as "Unknown-UDP" and allow it through. As soon as the application identified by PAN FW,the  appropriate policy/rule will be applied to that traffic. Reference DOC: How to Verify the Application Name Change from Unknown-tcp/udp to Actual App-ID unknown Hope this helps. Thanks ... View more

Hello AhmedSheta, The device will automatically refresh it's cache table with updated information from the cloud. There is a process that executes the attempts to see if any cached entry in the DP URL cache has been updated with new on-device database. Can be manually cleared using the following CLI command from Managaement-Plane: > deletedynamic-url <argument> Can manually set dynamic URL cache timeout value through the following CLI command: > debug device-server reset url dynamic-url-timeout <1-43200> Can be manually cleared using the following CLI command from Data-Plane: > clear url-cache Thanks ... View more

Any progress on this...? Thanks ... View more

Could you please follow the DOC and clear cache from both data-plane and management-plane: How to Handle a URL Miscategorization Thanks ... View more

Split and Full Tunnel in GlobalProtect Causes Users to Connect Through SSL on Loopback Thanks ... View more

Do you have any free public IP from the pool. That can be configured on Loopback. Thanks ... View more

Hello AhmedSheta, By default, any newly registered domain will be "unknown" in PAN-DB until Palo Alto Networks reviews, either manually by the analysis/threat team, or through the crawler (triggered on some event). Once an "unknown" is seen on the Palo Alto Networks servers, it will be put into a prioritized queue for crawling and classification. Once Palo Alto Networks determines a category, it will be included in the next database refresh. Enable global setting to force dynamic-url lookup: # set deviceconfig setting url dynamic-url yes # commit You may clear the cache with CLI command: > clear url-cache all Few related discussions/doc for your reference: resolving Many 'Unknown' Entries In URL Log User Web Traffic Categorized as Unknown Hope this helps. Thanks ... View more

This is really a Good News !!! ... View more

Related discussion for your reference: GlobalProtect Re: SSO Requirements Thanks ... View more

Hello cmateam, If this issue still persist, you could  share SYSTEM logs (subtype vpn) and ike-manager logs from the PAN firewall, while trying to establish the site-to-site VPN tunnel. > show log system subtype equal vpn start-time equal YYYY/MM/DD@hh:mm:ss > tail follow yes mp-log ikemgr.log Also, share logs related to IPsec from your Cisco Meraki  device. Thanks ... View more

Hello VSU_ITSEC, It seems currently the PAN firewall is categorized properly. The above mentioned logs is for 09/22/14. As i said before, we had an issue with prior version and that has been fixed now. That is why, you don't have logs for current date ( 09/23/14-Block-URL). Hope this helps. Thanks ... View more

A good doc for your reference: How to Handle a URL Miscategorization Thanks ... View more

I hope 6.0.3 is the PAN OS version, but what is the URL DB version. You will get this information from GUI dashboard > General Information > URL Filtering version. OR from CLI > Show system Info  --- Thanks ... View more