About Raido_Rattameister

You need to use DNS sinkhole feature. DNS sinkhole will give fake ip to malware dns requests and then infected pc's try to access this fake ip. You should use some ip that is not publicly and internally used. Or you can set up some box on it with wireshark to see exactly what data is sent to this fake ip.   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-DNS-Sinkhole/ta-p/58891   1.1.1.1 as sinkhole is really bad idea because this is is really often used for demo purpouses or in software testing so more often than not you see traffic to 1.1.1.1 even without sinkhole so it is dificult to distinguish if it was really infected pc 🙂 Make up your own ip and monitor traffic log. ... View more

  Is firewall in virtual wire mode? If in layer 3 mode then do you have nat rule in place? Can you paste screenshot of traffic log entry (click on magn glass on left) ... View more

If you happen to use IE then press F12 > Network > Play button  This helps you to identify all url's IE pulls traffic from when you go to this url site. Are all URL's over https? Do you use decryption? What is beginning of unlisted video url (before /) - is it same as for regular ones? ... View more

What command do you use to ping? If you don't specify source then your ping requests go out from mgmt ip. Do I get it right that your OpenVPN has 80.0.0.5 ip set already. If you configure same ip on Palo then you get response from Palo's own 80.0.0.5 ip not from OpenVPN. You can check arp table to identify it by MAC address show arp all show arp ethernet1/6   Instead use command ping source 80.0.0.1 host 80.0.0.5 ... View more

I would add class 4 to your VOIP profile aswell as class 4 is default class where traffic is placed if no QoS policy applies to it. ... View more

And security profiles must be configured. Otherwise Palo does not scan for threats. ... View more

Is this full error you get? Proxy id error in system log should tell exactly what other end sends. So you can configure your Phase 2 accordingly. Can you paste full proxy id error here? ... View more

If you decrypt ssl then better to wait and see if 7.0.4 has any fixes for it in release notes. Some environments have random issues with 7.0.3 ... View more

less dp-log then either tab or ? you should see older files also (like dp-monitor.log.2 and dp-monitor.log.3)   and then change command accordingly grep dp-log dp-monitor.log.2 pattern "Number of active sessions"   if you use command less dp-log dp-monitor.log then you see full file. type command below to see timestamps when session counts were taken grep dp-log dp-monitor.log.2 pattern "panio" ... View more

What is TCP? GlobalProtect can be UDP also (and it usually is). ... View more

ssh is basically encrypted telnet. So when you decrypt it then yes you can see what is going inside it. ... View more

Very handy to block well known scanners to bring down noise coming from internet (OpenBL for example).   In big environments can be used as whitelist instead. For example script will generate list of (physical) domain controllers to a file and firewalls allow active directory specific applications towards this dynamic block list etc. ... View more

Are both client using same client version? New GP version requires cert to be trusted. Go to firewall. Export CA certificate from Palo you signed GP cert with (only public key, NOT PRIVATE). Install it to Trusted Root Certificate Store on laptop. ... View more