About HULK

For SSH application, PAN FW is having default time out of 432000 seconds. ( for normal TCP/UDP the time out values are 3600/30)  You as a administrator is always having an option to play with this values on PAN firewall. FYI.. Thanks ... View more

Hello Sir, As per my understanding regarding SQL ALG: Protocol Description: Oracle SQL*Net is a network access protocol for Oracle databases. In operation a database client would connect to the Oracle server on the well known port of TCP/1521 or TCP/1525 for SQL*Net V1. The server would then send the client connection information for the actual data communication. The main reason for this behavior is that SQL*Net was developed at a time when there were a very wide range of network protocols in use, and it was designed to be independent of any particular transport. TOP/IP was only one of more then 8 options in the original SQL*Net specification. ALG Behavior: This is a very straight forward ALG. It will parse any replies from TCP/1521 and look for the string “(IP=a.b.c.d)(PORT=x)” in ASCII and then open a pinhole for the subsequent server connection. Nat can also be applied at this point to translate public to private IP addresses and vice versa. ALG Timeout: The control channel on TCP/1521 (1525) is not linked with the resulting data connection. While the SQL session inherits the time out from this connection, they are not linked and the control channel can time out without affecting the data channel. Application overrides, will skip the layer 7 processing on PAN FW, hence PAN will not modify the payload and will not create any pinhole. It will simply route the packet. Thanks ... View more

Hello, ICMP will use source/destination port as Sequence Number/identifier number while to build up the session on a firewall (5 tuple value). Also, it will not have a Layer-4 header on it ( which is necessary to create a custom service). So, you can not allow  icmp and other services in the same rule. Thanks ... View more

Hello Sir, You can create a custom service, based on the destination/source port number and use the same "service" on the security policy. Step:-1 Go to Object >> Services Create a New custom service. Step-2: Apply the same on a security Policy: Place this policy at the top of your policy table. Hope this helps. Thanks ... View more

Hello Klaus, Could you please check the routing table, if there is a valid route available through ethernet-1/5 for destination and sequence of the security policy on policy table. If possible, bring the Unix-admin rule in the top and verify the result. CLI command > test security-policy-match source destination destination-port protocol. Thanks ... View more

Is there any specific yahoo-based application is not identified by the PAN FW. I saw a similar issue for SMTP.yahoo.com for port 465 which is not mentioned on the Applipedia ( Application Research Center ) Could you please explain the issue in details, so it would be easier for us to provide you the exact answer. Thanks ... View more

Hello Daniel, Thanks for your update. As per my knowledge, we can't make a search from the GUI as per "vulnerability profile name". But, you can fetch the same information through CLI. Example: > set cli config-output-format set admin@Subhankar> configure Entering configuration mode [edit] admin@Subhankar# show rulebase security rules | match "Basic AV"  >>>>>>>>>> the profile name you are searching for. set rulebase security rules "Outbound Services" profile-setting profiles virus "Basic AV" set rulebase security rules "Permitted Applications" profile-setting profiles virus "Basic AV" set rulebase security rules "Email Out" profile-setting profiles virus "Basic AV" Hope this helps Thanks ... View more

Have you checked ms.log, while it was failing..? ms.log and system logs should give us some more detailed information, why it was failing to retrieve. Thanks ... View more

Hello Johny, I would suggest you generate a new certificate through the CLI and update the web-server certificate setting to use it and see if the issue clears?    admin@pan.work> request certificate generate certificate-name NewWebCert name NewWebCert admin@pan.work> configure Entering configuration mode [edit] admin@pan.work# set deviceconfig system web-server-certificate NewWebCert [edit] admin@pan.work# commit Thanks ... View more

Hello Sir, I am not clear about your exact query. Could you please explain your requirement in details (with an example). Just an update, we can add a group security profile or individual profile i.e Antivirus, vulnerability, Data-filtering. Example: Thanks ... View more

Hello Sir, Do you have a DOS protection profile configured on your PAN firewall..? As per my knowledge, PAN is not having such inbuilt rule on it. Could you please expand the session details as mentioned below and update here. Thanks ... View more

Hello Sir, After HA failover, do you have an interesting traffic attempting to pass through this VPN tunnel...? PAN firewall will bring the tunnel upon traffic. If there is no traffic attempting to pass through  VPN tunnel, you can manually initiate the tunnel to come up. >test vpn ike-sa xxx > test vpm ipsec-sa xxx Thanks ... View more

Could you please try to upload the file manually to the PAN firewall and then install it. Also, verify ms.log, to get more information while trying to retrieve the file from update.paloaltonetworks.com. 1. > tail follow yes mp-log ms.log 2. System logs ( under Monitor > System) Thanks ... View more

Could you please try to upload the file manually to the PAN firewall and then install it. Also, verify ms.log, to get more information while trying to retrieve the file from update.paloaltonetworks.com. > tail follow yes mp-log ms.log Thanks ... View more

Are you able to see any VPN related logs in PAN firewall  under Monitor >> System: The system LOGS should show Phase-I and Phase-II negotiation information in details. 1. What mode you have configured for this IpSec tunnel , main or aggressive..? 2. Do you have a Public IP address on both side gateway's...? 3. Do you have a policy to allow IKE from Untrust zone to establish this VPN tunnel...? 3. You can also make the PAN as a VPN responder as mentioned below. Hope this helps. Thanks ... View more