About HULK

Recommended and a stable release is 5.0.9. ( PAN recomended). For 5.0.10 and 5.0.11- Limited info from field at this time. Appears to be a stable release. No major issues reported at this time Thanks ... View more

Recommended and a stable release is 5.0.9. If you want to upgrade the PAN-OS for your production firewall, i would recommend you for 5.0.9. For 5.0.10 and 5.0.11- Limited info from field at this time. Appears to be a stable release. No major issues reported at this time Regarding 6.0.0 ---- Needs more time in the field to get all feedback from customers. Thanks ... View more

Hello, While those groups (IP range\VLAN) are accessing internal resources, is the same traffic passing through the PAN firewall....? If so, then you can create a policy to block internal resources base on user-group or source IP subnet. Thanks ... View more

Hello David, PAN does not have an option at this point of time to export policies to a CSV or PDF reports. There is a feature request has been submitted for the same. See below FR details: Export security policies as CSV or PDF format Customer wants to check security policies by hard/soft copy more visually as csv or pdf format. Current xml-base or set-base configuration list is difficult to see/check, especially if there are a lot of entries. Priority: Low FR ID: 842 As a workaround, you can collect the "set" command from the CLI: admin@PAN> set cli config-output-format set admin@PAN# edit rulebase security [edit rulebase security] admin@PAN# show OR Export the running config in a XML file and capture the required security policy config. Hope this helps. Thanks ... View more

Hello Sir, 1. Please follow the below mentioned documents, it will help you to understand and configure DOS/ZONE protection profiles on PAN firewall. Understanding DoS Protection Few related docs to troubleshoot: a. CLI commands to verify the DOS functionality on Palo Alto Networks Devices b. What are the Differences between DoS Protection and Zone Protection? c. Global Counters Triggered by a Zone Protection Profile 2. You can create a custom report under ACC tab ( Application Command center). Please see the example below: Next, click into the application, where you want see the source and destination IP details: Hope this helps. Thanks ... View more

Please follow these docs, It might help you. Custom Application Signatures      >>>>>>> Page no 4 Creating Custom Threat Signatures Thanks ... View more

Hello Sir, You can configure the tunnel interface with any IP address as long as the IPSEC Peer is configured with the appropriate proxy ID/route (not necessary should be part of same subnet i.e. 192.168.0.2). For example, you can set the tunnel interface to 10.10.10.100/24 - this would require the peer to have 10.10.10.100/24 or 10.10.10.100/32 configured as the remote(PaloAlto) proxy ID ( Along with protected resources 192.168.0.0/24). Also, when configuring an IP address to 'monitor' you will want to set an IP address in the peer's proxy ID so the traffic will get pushed through the tunnel. Hope this helps. Thanks ... View more

Hello, You are correct, if the current traffic passing through the tunnel, it will come up automatically. Thanks ... View more

Related discussions on similar topic: Re: Traffic log database exceeds alarm threshold is reach Question Regarding Traffic Log DB Quota Hope this helps. Thanks ... View more

Hello Sir, For SSL decryption, we only support SSLv3, TLSv1.0, and TLSv1.1 (TLSv1.2 will be downgraded in forward-proxy mode as of 4.1.9 and 5.0.0) Supported cipher suits: RSA-AES256-CBC-SHA RSA-AES128-CBC-SHA RSA-3DES-EDE-CBC-SHA RSA-RC4-128-MD5 RSA-RC4-128-SHA Hope this helps. Thanks ... View more

Hello Sir, While SFTP is connected through the PAN firewall, what application is showing on the session..? Is it showing Application as SSH or unknown-TCP (SFTP is FTP using SSH [TCP port 22]). I hope it is hitting the default TCP timeout (3600 Sec)  value somehow. Thanks ... View more

Hello Sir, I would request you to try with below mentioned options, in order to improve the performance through the VPN tunnel. 1. Can you verify what Encryption Standards are being used? Group 5 ( Asymmetric Key Encryption ) and AES ( Symmetric key Encryption ) Standards are more CPU extensive than Group-2 or 3DES. Does the performance improve with Group 2 and 3DES? 2) Slowness of Transfers across VPN tunnels are usually seen when the ESP packets are either fragmented, or when the packets themselves come out of sequence before they are being encrypted. ( the firewall performs checks for the TCP anomolies before it can encrypt these packets in the ESP headers ). Please check for any asymmetric routing issues. 3) If the performance is still not that great, an alternative  to create a custom app for required traffic, and use it under an app override. With this setting, we bypass the signature check for this traffic, and hence can expect better results. Refer to the below doc for configuring Application override for certain traffic. How to Create an Application Override Policy NOTE: As you said before, after enabling "Adjust MSS" you lost the connectivity through primary ISP, do you have an alternate path to troubleshoot ( not through ISP-1 or ISP-2) which will not close the SSH or GUI session at least. Thanks ... View more

Hello Sir, You can create a custom application with a longer timeout value and also define the port/protocol etc. Here is an example of a custom-application to open TCP port 6000 and UDP 7000 to 8000: You can only clone custom application on the PAN firewall and not for the default app signature.. FYI. Hope this helps. Thanks ... View more