About HULK

Hello Sir, You can define different actions for standard antivirus signatures (Action column) and signatures generated by the WildFire system (WildFire Action column). This is applicable if you have a valid Wildfire license on your PAN firewall. Some environments may have requirements for a longer soak time for antivirus signatures, so this option enables the ability to set different actions for the two antivirus signature types provided by Palo Alto Networks. For example, the standard antivirus signatures go through a longer soak period before being released (24 hours), versus WildFire signatures, which can be generated and released within 15 minutes after a threat is detected. Because of this, you may want to choose the alert action on WildFire signatures instead of blocking. Hope this helps. Thanks ... View more

The signature 33511 will be triggered if there are two netbios packets which length is less than 4 bytes in one session. Some evasion techniques will use this method to get rid of detection, but this signature itself is not a vulnerability.  This is just an indicator that PAN find some evasion packet. It not means it is malicious. Hope this helps. Thanks ... View more

Hello Aamir, As TAC support for UID agent running on Windows 2012 is not available, Also for Terminal Server Agent on Windows 2012, I do see a feature request (FR ID : 3062) submitted to our development team. Topic: Terminal Server Agent / Windows Server 2012 Support Priority: High FR ID: 3062 Please get in touch with your Palo Alto SE for the roadmap. Apart from the above mentioned error, few customers confirmed the set-up running fine into their environment. Refference : https://live.paloaltonetworks.com/message/27804#27804 Thanks ... View more

Hello, As per the PAN firewall's workflow, it will first check Block list > Allow list > Predefine List> Custom List. If you want to set a default action for all URL, you can set the same action in the predefine list. ( ALEART and BLOCK will log the session by default). At the same time, put *.mydomain.com into your Allow list. Hope this helps. Thanks ... View more

Hello Aamir, Are you using windows 2012 server in your set-up..? Thanks ... View more

As soon as PAN firewall will identify the signature of that packet, it will reset ( send TCP RST) the connection ( drop the collection). Also you will be able to see the same information under threat logs. Thanks ... View more

Hello ICarder, Yes, if the default action is "reset-client", then PAN firewall will drop the connection and end machines are protected from the exploit. Thanks ... View more

Hello As-mg, It's recommended to run the signature pattern matching (AHO) on software > debug dataplane fpga set sw_aho yes Thanks ... View more

Hello, Could you please take a packet capture on the firewall, just to verify if PAN is receiving those packets from the client. Because, from VPN point of view, it will install a route on the client's routing table (route print) for forward desired traffic through tunnel. Please verify if the client is having any other virtual adaptor installed on his machine. Thanks ... View more

Hello As-mg, Could you please verify PAN brdagent log through CLI command and verify if matching with below mentioned symptoms. A. PAN> less dp-log brdagent.log 1. Error message like : "need to reset ocelot link as XX error packet seen" 2.  link flap messages similar to above. 3. XGE link error. 4.  Check system logs for critical logs indicating “DP packet descriptor leak detected  on slot 1 dp0” or similar. Thanks ... View more

Hello Sir, If you think this feature is required in your environment, I would suggest you to contact with your Palo Alto SE and submit a "Feature Request" for the same. These are the available options with PAN OS software. Thanks ... View more

It has been released today. Thanks ... View more

Hello Paulo, Coiuld you please verify: 1. "SYSTEM" logs, to see why VPN went down. 2. ike-manager ( ikemgr.log) logs. 3. if the session rematch option is enabled, please disable and try to commit it again. Thanks ... View more

Hello , Have you generated the key: http(s)://hostname/api/?type=keygen&user=username&password=password PFB a helpful document for the same. PAN-OS and Panorama 5.0 XML API Usage Guide Thanks ... View more

IKE phase-I lifetime is not an essential parameter need to be match on both sides. During Phase-I negotiation, it will choose the lower value to established the tunnel. But, as GAFROL said, it would not be a recomended setiings. Thanks ... View more