About networkadmin

Palo Alto seem to have the lowest arp/mac cache limits of any firewall I've ever come across. Are there any plans to increase the limits please? ... View more

Can anyone point me to a document or some guidelines on current recommendations/best practise when using forward proxy please? I have the SSL certificate in place on my clients, my main target is SSL traffic to higher risk URL categories such as web based email and social networking sites. I'm currently running 4.0.9. Thanks. ... View more

One of our switches has a couple of untagged connections into our PAN. Each connection is configured on the PAN as a regular L3 interface with an IP address assigned and the interface is in the appropriate zone. I'm interested in reclaiming one of the NICs on the PAN so it would be nice to be able to run a trunk from the switch to the PAN. Where I'm struggling a little is in making sense of the Admin Guide on how I do this - specifically how I tell the PAN that I have VLAN20 and VLAN30 coming into it, and I want to assign the PAN 192.168.1.254 on VLAN20 and .2.254 on VLAN30 and have the VLAN interfaces assigned to the zones that the L3 interfaces were in (as at this point I wouldn't be using those two L3 interfaces). I'm sure my terminology is a bit off for which I apologise, but hopefully I've explained what I'm looking to do - are there any example white papers or tutorials please? If there's any questions just ask. Thanks. ... View more

We're currently running 3.1.10.  There is an issue we're encountering related to SSL decryption and URL filtering which we're waiting for 4.0.8 to come out and fix. I see 4.1 is now out so just when I thought we'd be running the latest PanOS, all of a sudden we aren't. How much of a leap is 4.1 from 4.0.x?  What is Palo Alto's recommended OS assuming you have no specific feature need that would dictate a certain version? Thanks ... View more

Is there a way to produce a graph of the usage of a particular application? Bytes or sessions would be acceptable, I just want to be able to show a rough usage trend over the course of a day/week. Thanks. ... View more

I need to setup a VPN tunnel with a Cisco device which we don't control or have any access to. The intention is that I can allow a group of IP addresses on our LAN to have access to resources on the other side of the tunnel. These are the settings that I've been given by the people who own/control the other side of the tunnel: Phase 1 ISAKMP Identification: IP Address ISKAMP Pre Share Key: <TBC via Phone or Secure Email do not include on this form> ISKAMP Lifetime: 86400 seconds ISKAMP Encryption: AES256 ISKAMP Authentication: Pre share key ISKAMP Hash: SHA DH Group: 2 NAT-T: Enabled IKE Negotiation Mode: Main Phase 2 IPSEC ESP Authentication: SHA IPSEC ESP Encryption: AES256 IPSEC SA Lifetime Kbytes: 4608000 IPSEC SA Lifetime Hrs: 8 Perfect Forward Secrecy: Yes Mode: Tunnel Connection Type: Bidirectional I'm pretty new to VPN tunnels.  Is there anything I need to know when trying to set this up on the PAN? My understanding is that ideally I would create a new zone called "CustomerX" and put the tunnel.x interface that I create into that zone so that I have to have a rule to allow any traffic to flow between our "trust" zone and the far side? Any info would be really appreciated and any questions or things I haven't mentioned, just ask. Thanks. ... View more

We have a Palo Alto in front of an Exchange 2010 CAS server. The Palo Alto is in a back-to-back config with a "dumb" firewall in front of it that only allows port 443 inbound. The Palo Alto has the SSL cert from the Exchange box on it, so does SSL inspection on all the inbound traffic. My questions is, can anyone who has Exchange 2010 behind a Palo Alto confirm which apps I'd need to allow if I wanted to be a little smarter than simply allowing port 443 through as a service? If I drill down using App-ID into the destination IP, over the last 7 days these are the apps/sessions that I see: outlook-web     8,055 ms-exchange      6,678 msrpc      4,197 web-browsing 3,037 ssl      2,929 dns      224 rpc-over-http      37 webdav      29 unknown-tcp      25 insufficient-data      12 http-audio      10 http-proxy      2 Obviously many of those are expected, but equally some aren't. I'm concerned that unless the list of apps is absolutely correct people will start to find obscure pieces of access to Exchange/Outlook stop working. Thanks in advance. ... View more