About Raido_Rattameister

Security policies are port or application based? Do you see blocked traffic in log? Play around (enable/disable) with SIP ALG inside sip application. ... View more

Hi, You probably don't want to pass traffic through VM if you only care about ACC output. I don't know your VMware setup but basically you have to create span port on your switch, tap interface on VM100, connect them together somehow (if can't do rspan then physical patch cable between switch span port and VMware host), allow promiscuous mode on VMware portgroup), security policy to allow incoming traffic to tap port and then you can review ACC. ... View more

If you don't have any security profiles (security profile none as you mentioned) then you don't see file downloads in logs. Configure file blocking profile to log all and add it to security policy. ... View more

I doubt that you see UNC path anywhere. For example you can't block traffic based on UNC path Dynamic Block Lists and UNC Server Path ... View more

I would start troubleshooting by checking box "log at session start" on policy's Action tab. This will generate log entry for every application shift. And check if anything strange there. No decryption policyes in place? ... View more

So it is SMB traffic (Windows file share)? ... View more

No security profiles added to security policy? What logs show when you filter diferent logs with those filters? Traffic ( action neq allow ) Threat ( action neq alert ) URL ( action neq alert ) Data ( action neq alert ) Anything blocking? ... View more

Yes It depends on application. Go and browse the web. Download some pdf or doc from internet for example. Go and find log entry for this file. And you should see referer link there. If not then copy ip of other side and paste it to URL filtering log. Probably as destination. For example ( addr.dst in 194.106.121.19 ) ... View more

Data filtering log. Click on magnifying glass and bottom right there is url column where you can see full url. ... View more

Objects > Security Profiles > URL Filtering Create new URL filtering profile. Change "action" for every category according to your company policy. Policies > Security Open security policy that allows your users to browse the web. Under Actions tab you can attach URL filtering profile (Profile Settings). If new url is registered it is unknown initially until Palo Alto Networks classifies it. If your users need to access it then you can add it to whitelist and request category change. When it is regategorized then you can remove it from whitelist. ... View more

Hi, Have you checked those links? How to Configure SNMPv2 on the Palo Alto Networks Firewall Monitor the Firewall Using SNMP https://paloaltonetworks.com/documentation/70/pan-os/pan-os/monitoring/supported-mibs.html ... View more

There is difference in size of session table and max decrypted sessions. For example max ssl sessions for 3050 and 3020 are following: Max concurrent decryption sessions 3050 - 15,360 3020 - 7,936 Product Comparison So your session table does not have to be full but ssl decryption resources can be fully allocated. ... View more

Checked v7 release notes and you are right. Portal license is deprecated now ... View more

With multiple gateway you need portal license. What you could do for free is create multiple gateways and based on user/group assign different gateways to different users/groups. ... View more

I would start with Monitor > Packet Capture to see if PA receives those DHCP requests from switch and offers from server. ... View more