About rps

When setting up an url-filtering you can choose from the following actions: Allow Block Continue Override Alert The downside with block (like when blocking the category web-advertisements) is that the content is exchanged into the response page for blocked url filtering. How should I setup the policy if I want to completely drop all packets that belongs to the category web-advertisments (so that the client wont get anything in return not even the block page) - but at the same time having the block page work for other categories (lets say the spyware-and-malware)? ... View more

According to the PA-3.0_Administrators_Guide.pdf: " Trusted CA certificate—Import an additional intermediate certificate authority (CA) certificate to trust when doing SSL decryption. If the firewall encounters a certificate that is not signed by a trusted CA, then it uses its own untrusted CA to sign the certificate and generate the expected browser warning message. " It might be because I dont have english as native language but I dont get what the above says 🙂 Am I correct that the above actually means that when you do ssl decryption and visit a https site where the ssl cert of this site is signed by an unknown CA (like a CA from a specific company like your own). You can then add the ca.crt of this CA who signed that server-cert to the PA-unit and it will successfully decrypt the traffic otherwise it will bring you an error that the cert of this server cannot be verified? If so, can I only add one such CA cert to the PA-unit (where I work we have at least two CA's one for production and one for tests and I would need to add at least two custom CA certs to the PA-unit so it will successfully perform ssl decryption without warnings or errors)? How do I list which additional CA certs have been added to the PA-unit (or which CA certs already exists (builtin)) or for that matter delete an incorrect CA cert? ... View more

According to Custom-Block-Pages-TN-revB.pdf the variables available are: <user/> <url/> <category/> <appname/> <pan_form/> <fname/> Where <pan_form/> can only be used for captive portal and url filtering continue and override page. But what about the others? Later in the same document there is a table that claims that for the antivirus block page there are no default variables and <user/> and <fname/> as "Other available variables". Does this mean that I cant use <url/> for an antivirus block page? And if so, is this a limit of the hardware (like the PA wont know the url if a flow is blocked due to antivirus) or something that can be fixed with a request? What I want to do is to have the same look of the block pages, the only thing that would change is the title of the page (like the first row who informs the user if its "Blocked: Virus" or "Blocked: Application" etc). ... View more

PA have support for datafiltering but is it possible to also, when a rule is triggered, to replace the data and pass it through? Like exchanging "User-Agent:" in all http-requests (where User-Agent exists in the header) into a common User-Agent string, or for that matter completely remove data in a stream (lets say if you want to remove "Via:" header if it exists in a client request)? ... View more

In service route configuration one can define which interface should be used by the managementplane to reach the Radius server which you will use. However Radius can be used both for admin-logins aswell as captive portal (user-logins). Is it possible to setup one Radius to be used for admin-logins (towards the PA unit) and another Radius to be used to authenticate users in captive portal before they can do web-browsing? ... View more