About HULK

Hello Sir, I do agree that 10,000 packet/sec would be high compared to the current packet rate. But, also I would recommend you to take a statistics of packet rate for last 7 days and accordingly configure a safe limit on your production PAN firewall. Thanks ... View more

Related discussion thread: Zone Protection Flood Protection Max Packets per Sec And new sessions per second values. Re: Apply zone protection - to which zone? Thanks ... View more

Hello Sir, You will get the packet rate from CLI command: admin@PAN> show session info | match rate Packet rate:                                     4/s  >>>>>>>>>>>>>>> New connection establish rate:                   0 cps Session accelerated aging:                       True   Accelerated aging threshold:                   80% of utilization Pcap token bucket rate                         : 10485760 You can use the ACC report  to get traffic trend through your PAN firewall ( based on session, Byte,Threat). Protection profile settings apply to the ingress zone (i.e. the zone where traffic enters the firewall). Zone protection settings apply to all interfaces within the zone for which the profile is configured.: For your reference: Threat Prevention Deployment Tech Note Understanding DoS Protection Note: Zone protection is only enforced when there is no session match for the packet. If the packet matches an existing session, it will bypass the zone protection setting. Thanks ... View more

Hello, Is the PAN firewall is default-gateway for end users( pc)..? 1. Could you please verify whether the end machine is learning the correct MAC address on his ARP table for default gateway..? From laptop's cmd prompt: >arp -a 2. While the user loosing internet connectivity, are they able to ping their default-gateway ( both LAN side and WAN side IP address of the PAN)..? Thanks ... View more

Hello, Are you using any external certificate to access web-browser..? Thanks ... View more

Hello Sir, I do agree with you. The PAN FW is blocking this URL with below mentioned information under "data-filtering" log. The specified URL contains  some of the windows batch files output on this discussion. I hope that triggers the signature to block the content, because the PAN firewall is signature based not based on file-extension/URL.  For example: If you transfer a txt file which contains signature of a EXE file, the PAN will identify that file as EXE not TXT. Thanks ... View more

Hello Radoslaw, I dont think you have too many policy on this firewall. The Max numbers are given below: admin@21-PA-2020> show system state | match policy cfg.general.max-cp-policy-rule: 1000 cfg.general.max-di-nat-policy-rule: 6000 cfg.general.max-dip-nat-policy-rule: 200 cfg.general.max-dos-policy-rule: 1000 cfg.general.max-nat-policy-rule: 1000 cfg.general.max-oride-policy-rule: 1000 cfg.general.max-pbf-policy-rule: 500 cfg.general.max-policy-rule: 10000 cfg.general.max-qos-policy-rule: 1000 cfg.general.max-si-nat-policy-rule: 1000 cfg.general.max-ssl-policy-rule: 1000 Do you have custom signature/custom URL filtering configured on this firewall, It could take longer commit time than expected. I would request you to verify the management plane resources of this PA-2020 firewall with below mentioned command: > show system resources follow    ------- Please verify if management server or any other daemon taking much CPU cycle or memory. For the time being you can apply CLI command:   > debug software restart management-server  ----- It will reset the management-server process and it would not impact to your production traffic ( you will lost the SSH connection to the management-plane for few minute). I hope it will improve the commit time or response time. Thanks ... View more

Content version 418 is not yet released. Most probably, it will be available before today EOD. Thanks ... View more

Hello Dan, Are you looking for this doc: GlobalProtect Configuration Tech Note Thanks ... View more

Yes, It should terminate the active session on the PAN firewall. As per the DOC How to Clear Sessions from the Session Monitor , clearing a session from session browser is as good as clearing it from CLI ( > clear session ID xyz). The session you have cleared from session browser, could you please verify the same from CLI also. > show session ID xyz Example: Thanks ... View more

Hello Matt, Using a single GP portal, you can specify multiple  "User/user Group" , where you have an optionto define different connect method. Example: For Untrusted user select connect method= On-demand                   For trusted user select connect method = pre-logon Hope this helps. Thanks ... View more

Hello Carl, I hope it will be type "Antivirus Block Page". You can easily test with www.eicar.com and download a test file to confirm the same. Thanks ... View more

Hello Sir, (A) If you are planning to change the config from Virtual-wire to Layer-3,  you need not to re-write all security policies again. 1. You have to change the interface type, from vwire to Layer-3. 2. Change the Zone type from vwire to Layer-3 Example: (B)  If i understand your query correctly,you can create a new virtual router for a Layer-3 interface and It would not impact on your existing routes established by your physical router. Until and unless you are not pointing any route to that/from Virtual router. Virtual router is a logical separation of routing table inside the same physical device. Let us know if you need further information on this. Thanks ... View more