About HULK

Add to it: Using a Custom Response Page to HTTP Redirect Customizing Response Pages Re: How to create custom response pages Hope this helps. Thanks ... View more

Hello COS, You may export the default "response page" and modify with the new logo. Then import it again. Thanks ... View more

Hello Mandar, From the above mentioned logs, it looks the SA key is getting deleted pre-maturely. Hence the tunnel is trying to establish multiple times. Could you please confirm below mentioned information here: 1: what value has been set for IPSec phase-1 and Phase-2 lifetime for this VPN tunnel..? 2: could you please take a packet capture on the PAN external interface between 2 IPSec gateway IP and verify, who is initiating the ISAKMP SA deletion messages..? 3: could you please confirm, if DPD and tunnel monitoring is configured on this PAN firewall, same setting has been defined on the other end device as well...? 4: if DH key is configured on PAN for IPSec crypto, make sure same DH group has been configured on the other end firewall as well. Thanks ... View more

Hello COS, Please find below the observed behavior: I have added new NAT rules. Before commit, if iclick into the "Highlight unused rule", The feature works as expected. However, once commit is done in the PA, it is not highlighted. There is a BUG open for this: Bug 65553 - After commit, Highlight Unused Rules does not wroks for NAT rules Resolved in:PAN OS 6.1.2 Hope this helps. Thanks ... View more

Hello Cos, It looks the "Highlight unused rule" option is working for Security Policy but not for the NAT policy on my PAN firewall. So, the CLI command mentioned by bat would the right way to determine it. Thanks ... View more

add to it ++ Once you will configure HA ( High Availability) active/passive setup, then data-plane interfaces will be not accessible. In that situation, you can only access the management port to manage the Passive FW and also to download/install dynamic-updates. Thanks ... View more

Could you please double check the session details ( from your machine and exchange server) from the CLI of the PAN firewall: admin> show session all filter ssl-decrypt yes count yes admin> show session all filter source x.x.x.x destination y.y.y.y  >>>>>>>>>>>>> there should be a "*" symbol which will confirm that the session is getting decrypted 366417       msrpc          ACTIVE  FLOW *  >>>>>>>>>>>>>>      Thanks ... View more

Hello Cos, Is there any way to access the FW through CLI (console), and check the disk space on this PAN firewall. Thanks ... View more

Hello gabrielhill, Could you please let us know, if the Exchange server is connected with an SSL connection, then you might need to implement SSL-Decryption, in order to inspect the content of the email. Thanks ... View more

Hello Mike, Could you please let us know the case ID. To investigate this issue, PAN TAC should take below mentioned information: ---- A full session pcap for RX, TX, FWW, DROP all 4 stages in PAN firewall. ---- Flow-Basic, App-ID Basic. ---- pcap at the soucre and destination as well ( if possible) ---- session details (between source and destination) --- >show session id xxxx Thanks ... View more

Jut to add to it: gmail.com doesn't have its own cert, it uses a SAN cert, but does a redirect partway through the transaction. Thanks ... View more

As per the above mentioned NAT policy, Company A (192.168.1.1 to 192.168.1.63) will translate ( source NAT)  to public IP 10.X.X.1 Company B (192.168.1.64 to 192.168.1.127) will translate ( source NAT)  to public IP 10.X.X.2 Company C (192.168.1.128 to 192.168.1.255) will translate ( source NAT)  to public IP 10.X.X.3 Thanks ... View more

Hello, You can configure one IP address on the interface i.e 10.X.X.1 Configure the NAT rule as mentioned below. NAT RULE-1 Zone TRUST Source address  192.168.1.X to 192.168.1.Y (X could be 10 and Y 50) Destination ANY Zone UNTRUST Destination address ANY Source NAT: Translation type: Dynamic IP and port Address type: translated address Address:10.X.X.1 ================================= NAT RULE-2 Zone TRUST Source address  192.168.1.A to 192.168.1.B (A could be 64 and B 128) Destination ANY Zone UNTRUST Destination address ANY Source NAT: Translation type: Dynamic IP and port Address type: translated address Address:10.X.X.2 ================================= NAT RULE-3 Zone TRUST Source address  192.168.1.M to 192.168.1.N (M could be 129 and N 255) Destination ANY Zone UNTRUST Destination address ANY Source NAT: Translation type: Dynamic IP and port Address type: translated address Address:10.X.X.3 Thanks ... View more

Hello, bat is correct. You may follow this discussion from prxy ARP feature: Re: Proxy-Arp behavior and NAT's ARP Proxy Thanks ... View more