About CRHC

Hello, For several years, we have been blocking URL content classifed as "web-advertisements" within PANDB.  This has been extremely successful in stopping malicious ads from comprimising systems.    More and more websites are now disallowing access to content based on any active "ad blocking" solutions.  These sites now present the user with a message stating they will not provide content with Ad blockers in place.  Since the control is at the PAN level, the user has no control.    White-listing is not an option as the ad content does not come from "nytimes.com".   And white-listing *.lotsofads.com defeats the reason for blocking web advertising.    Has anyone come across any inventive methods to continue blocking web advertisements at the PAN level and have the websites that "check" still work?   Thanks!   Mike ... View more

Hello, Most of the "Dynamic DNS" sites are categorized as Computer and Internet Info (PANDB).  On occasion a device will get infected because of a Dynamic DNS redirect to a malicious site.  The initial URL connection is through one of the DDNS sites.  Because we allow "Computer and Internet Info", the connection is allowed to the final (malicious) destination.  Besides hunting down every DDNS service and creating a custom URL block list - are there any solutions to better control these redirects? Thanks! Cheers, Mike ... View more

Hello, Is anyone else seeing a large amount of events based on the newly released signature - Oracle Java SE Remote Java Runtime Environment Remote Code Execution Vulnerability(36166) for legitimate user traffic? Have been seeing events all day since the threat content update for this week.  I have not heard of any complaints as of yet.  But the event is triggering when clients are logged into one of our clinical portal pages (utilizing Java). Mike ... View more

Hello, Our XenApp farm IP range is dynamic and the servers could spin up on any number of IPs within a couple of segments.  Does a TS Agent entry for every single possible IP need to be added on the PAN device, or can I configure it to look at a subnet range? My attempts at using subnets have not worked, but single IP entries do work.  Thanks! Mikes ... View more

Hello, I have a Global Protect Portal setup which works properly with a policy set for the App-IDs of "SSL", "Web-Browsing" and "PANOS-Global-Protect" and "any" Service.  If I set service to "Application-default" - the portal login page no longer displays.  The logs then show that SSL (443) was "Allowed" and Web-Browsing (443) is "Deny". Is there a particular reason that using the "application-default" with the APP-ID access policy for Global Protect, would not work?  Thanks! Cheers, Mike ... View more