About networkadmin

rnitz wrote: I'd like to address some of the issues without addressing all of the individual issues. There are two reasons to upgrade to a new major release: 1) New features that have been added. 2) Fixes that will not be back-ported to the previous release. Depending on the code changes, not all fixes can be back-ported. Thanks for replying, but, respectfully, it doesn't really address the situation that I'm in, and that I suspect some other Palo Alto customers are in. I don't specifically need any new features in 4.x right now. I don't have any issues with 3.x that won't be fixed that might force me to upgrade to 4.x to get them fixed. So do Palo Alto recommend I run 3.1.x or 4.x? We have some other firewalls from another vendor and if I visit their support website they have a very clear "Recommended Version" section for each device, presumably based on support & stability - it would be fantastic if Palo Alto did the same. Which version would a Palo Alto device rolling off the production line today ship with? ... View more

I'd be interested in any feedback on the major benefits in going from 3.x to 4.x as well. Frankly I think Palo Alto have scored a bit of an own goal in bringing out a major OS release but doing a pretty poor job of actually telling their customers a) the benefits of upgrading and b) on what basis they should upgrade. Let me clarify that a little.  Right now, I have a box running 3.1.8.  As far as I'm aware there is no document anywhere that says "If you have a PA-500 the current recommended release of PAN-OS is xxx" so it's left for me to "somehow" figure out which version of PAN-OS I should be running.  So far as 4.x, the feedback and vibe I get from here is very non-committal and to me it almost comes across as if 4.x is still some sort of beta and isn't actually recommended for production unless you really need something it offers that 3.x doesn't have. ... View more

ksemenov wrote: After an afternoon of playing with 4.0.1 I found enough "bugs" that we decided to go back to 3.1.7 for now. Can you expand a little please? We're on 3.1.7 now and I was debating whether to go to 3.1.8 or just jump to 4.0.1 - can't say that 4.0.1 brings anything to the table that for us is like "We must have that", but equally I don't see too much in the way of solid guidance from Palo Alto of when to use a given version of PAN OS the same as Juniper do. ... View more

More an observation than anything I've gone into in any depth, but our PAN doesn't seem to stop much at all in the way of viruses/malware, its usually down to the desktop A/V. I'd be very interested in any recommendations from Palo Alto on what should be tweaked in addition to simply enabling the default av/malware policies on the outbound traffic rules that you want to protect. ... View more

One reason would be I don't know how to That reason aside, the URL list is quite long as you need to add each virtual directory - presumably even with an app you still need to do this so would I gain that much? ... View more

In the same way you can have an outbound allow/block whitelist/blacklist on a URL profile, you can do the same on inbound rules. So we have an Outlook Web Access server with an inbound rule, I use URL filtering to ensure people can only get to https://server.fqdn/exchange and not, say, https://server.fqdn/system32/someexploit.etc We're obviously doing reverse SSL decryption on the inbound traffic. Everything worked perfectly until we upgraded from 3.1.6 to 3.1.7 at which point all of a sudden URLs were being blocked that weren't previously. Adding server.fqdn to the whitelist (no sub-directories) has worked around it but we're now coming up to 2 weeks since I opened the case - it's fair to say I'm not comfortable without the URL filtering protection on the inbound traffic. ... View more

James could you go into a little more detail possibly please? I always think of QOS as being about guaranteeing/reserving bandwidth for particular applications, but the idea of having some sort of real-time graph showing different applications/protocols bandwidth usage sounds pretty useful. Thanks. ... View more

I'm pretty sure that if you add it to the "allow" list on your URL filtering profile it won't be logged. I'm not in the office to actually test it, but we do this to restrict inbound access to our Outlook Web Access box to only OWA URL's and they don't show up in the URL filtering logs. ... View more