About jharlow

I have several older machines (XP) that are used for special purposes that cannot be be upgraded. Even the hardware cannot be upgraded or replaced (running on old dell dimenion desktops).  These machines do not need access to the internet but they are on the same domain and need to be able to communicate with other domain machines.  I want to make it where these machines cannot access any internet resources to reduce the change of malware/virus type activities.  I was thinking that I can setup a rule/URL filter, that would block access and add these machines IP addresses to the list.  Is this the best way to achieve this goal?   Thanks  ... View more

I have  a Dell Equalogic SAN that is replication to an offsite location. The traffic is sent over via a VPN tunnel (Certificate based). This traffic is being reported as unknown tcp. I can verify that the traffic in question is in fact the SAN traffic as the source and destination matches. I also read that the PA normally flags certificate based VPN as unknown. I need to get this traffic reported as a correct application as unknown is hard to manage and add to the fact that PA recommends blocking unknown TCP traffic. I also need to create a QoS rule so that this traffic is provided a higher priority.    I believe what I am needing to create is an Application override based on some of the articles here. Assuming this is correct and will provide me with the requirements; I need to have several IP addresses in this policy. Can I create an application group with a subnet; for example, all SAN traffic is outbound on 10.0.52.x (10.0.52.1-10.0.52-9) or do I have to create the group with each IP address?   If this is not the ideal solution or will not provide the results I am seeking, can you provide me with the KB or solution that would?  Thank you. ... View more

Need a way to except a machine from the URL policy. Currently I can only find a way to except a user level however, I have one machine that is not on the domain that is used to communicate to several external services.      ... View more

I created a URL filter to block shareware sites; however I need to unblock one that I use. ninite.com. I have had no success getting this site to work. Adding the url ninite.com to the allow list, I am given an SSL error (enable TLS 1.0, 1.1, 1.2) which is enabled. I tried adding the IP address and that did not work. It appears the site is using a non-standard port (port 6080). So I added that port to as part of the IP address to allow. That partially got the site working but the installer still does not.  The site has a SSL certificate and the certificate CN matches the URL that I added to the allow list.    Anyone willing to drill down on this issue and see what is needed to get it working? 🙂  I am guessing the installer is using a different port as well... Thanks,   ... View more