About Remo

As soon as I receive more information I'll write an update here ... (This is NOT official: I can not imagine that Paloalto is not affected by this) ... View more

Hi @bwsaloum  It depends on the number of clients your PA5050 has to protect. So depending on this number it is not only the fault of Microsoft (while it still is for a major part). The PA5050 is no longer strong enough to decrypt a lot of connections with modern encryption algorithms. From what you describe your PA5050 seems to be still enough for your clients. Anyway we had the same issue, where the hardware was strong enough for years now this is no longer the case. So my conclusion is the PA5000 series is end of sale for a good reason. This hardware is still good for almost everything but not really for decrypting TLS connections ... ... View more

The PAN-OS team is curently investigating ... as soon more informations become available I assume PaloAlto will also write an official public statement.   ... View more

3 hours and this high priority case is still in the support queue ... ... View more

Hi @BigPalo    I have opened a case to ask for this information. ... View more

PS: right now I cannot find it anymore but I remember that the firewall is only able to send back an SMTP 541 error in forward decryption mode and not with knbound decryption ... ... View more

@Neil_Xu wrote: Workaround is do a "Commit All Changes" to the panorama and then push to devices. @Neil_Xu does this workaround work for you? In my situation is wasn't working. I don't evdn know if my problem is related to this one. I started with creating a zone. After that I applied it to a new L3 subinterface and tried to push the config to the firewall. The new L3 subinterface was created on the firewall but without the zone applied. After some desperate tries I created another zone in panorama, applied it to the interface and pushed the configurarion. This time the zone was also applied to the interface. The previous existing zone which still is configured in panorama was still not pushed to the firewall. Next try was that I again applied the first zone to the interface, deleted the second one and then renamed the initial zone to the name of the second zone. Again the zone was pushed to the firewall. After renaming the zone again to the inital name and another config push the zone disapeared again ... very strange behaviour ... ... View more

@benime thanks for sharing FR ID 11251 is added to the list ... View more

--> the public per-NAT IP ... View more

Hi @tforeen  Please reach out to your SE to have him create a feature request for this. Once you have the FR ID you can post it here and I will add it to the list, so others can see this and vote also for the FR. But as I am not a paloalto employee I cannot create the Feature request for you. ... View more

Hi @dannon    I have added your FR IDs to the list. And in addition I have some comments: @dannon wrote: 1.  run a "user activity report"  in the "Download URL logs" link which open up a CSV file, please in this file include either the original Username or IP address which was entered into the box on the original "User Activity Report" dialog. We are concerned that Lawyers might not hold the file up in court since it doesn't have a username / IP tied to it.  Only the "Download User Activity Report" has that. - FR11763 What abour simply downloading the logs directly from the URL logs?   @dannon wrote: 3.  Show current interface bandwidth in a dashboard widget. Be able to log over time. - FR4507 Since PAN-OS 8.1 there is a device health monitoring in panorama which includes bandwidth   @dannon wrote: 5.  Allow the GUI to change colors - themes.  Maybe a dark theme?- FR11765 This is already possible with browser extensions (maybe even directly in the browser) by enabling high contrast modes or by changing the css.   @dannon wrote: 6.  In "Response Pages", have a "Preview" link, so that we can see the page quickly without having to download and open in another browser.  Useful when making changes.- FR913 Because of the low number of this feature request this one is already pretty old so I think the chances that this (checkpoint) feature will be implemented are not that high... ... View more

Hi @karthikeyanB    In this case, you need to ask your SE to create a feature request (or maybe there is already an existing one that you can vote for). The other possibility is that you can use the API to automate this task and pull the threatlogsummary every 15 minutes or run a prepared custom report every 15 minutes. ... View more

@LasseN wrote: I can only choose DHCP address as source IP in the path monitor setup... Removing path monitoring and all is dandy again...... So did you try to chose no IP address as src in path monitoring and then the commit fails? If yes, then this is not a bug. It is somehow expected as you have to choose a source IP and on an interface with dhcp assigned IP address you only have this option - or did I get this wrong and the commit error is there also when you choose dhcp as src?   ... View more