About Phoenix

Hi, Did you try adding the App "Apple-update" and action as block. ... View more

Hello, In the below screenshot as explained by shasnain we can select any application in specific and look for the timeouts. If needed we can modify right there by Customizing it. Hope this helps. ... View more

Hello, Yes we can modify the default admin account through the template. I went ahead on Panorama and created an admin account with a different password ( Local device has admin account with password as admin  ) and forced the template values to the firewall. CommitAll succeeds and the password was changed to new password. Old password could not log me in. The image above explains with a slight green box next to admin indicating its a template push. This confirms you can change and modify admin accounts from Panorama templates. Thanks ... View more

Hello Peter, Authenticating to the firewall works on the firewall management interface and we do not create rules for this interface. The rules created are for data ports. If a user is traversing through the PAN between 2 zones and the security rule has http and https only allowed as services then that user can only pass port 80 and 443 traffic between the zones. Thanks ... View more

Just to add the Software version on this device is 4.1.13 as indicated in the last line. ... View more

Hello, "show system info" - would be the command. hostname: lab-56-PA-500 ip-address: 10.30.14.56 netmask: 255.255.254.0 default-gateway: 10.30.14.254 ipv6-address: ipv6-default-gateway: mac-address: 00:1b:17:08:e2:00 time: Mon Sep 16 09:51:51 2013 uptime: 41 days, 4:16:14 family: 500 model: PA-500 serial: 0006C100437 sw-version: 4.1.13 ... View more

May be this doc can help. Unable to Display WebUI using IE8 or IE9 ... View more

Yes, we can capture the traffic entering a Vpn tunnel. But once captured we get to see the ESP packets and not any more details as they are encrypted as informed by Hulk. We can use the filters and captures per the below doc, https://live.paloaltonetworks.com/docs/DOC-2542 Thanks ... View more

Thanks for sharing let me test and get back to you. I understand the point that it should not be truncated before submitting for analysis.. may be it is a GUI issue of truncated, but let me find details from my side too. ... View more

Hi Chang, If you can share the exact URL we can test it in the lab and share the results to see if we have the same issue and find the expected behavior for you. You can also share the report for us to view the details on it. ... View more

Hello Tician, Apart from the tech knowledge shared by akawimandan, in regards to design questions our SE's should be glad to share your concerns and suggest you design. Thanks ... View more

Hi, Ideally the HA would not establish with the change in platform per the software. With change in minor release of software version it should be fine to work for HA. Thanks ... View more

Hello as-mg, We have a feature called Host Information profile as part of Global Protect. This feature helps to detect all the host details all that is mentioned on the left side of the image. I would suggest to refer the below link to know more details on the same, https://live.paloaltonetworks.com/docs/DOC-2020 Thanks ... View more

Hello, Different vendors have different way of doing it. For example in Cisco, to disable the supported checking for optics here is the command: Router > configure terminal Router(config) # service unsupported-transceiver Some thing like that may be needed on Juniper switch to accept the communication, may be. Thanks ... View more

Hello, This is more of a troubleshooting scenario and may have to check different parameters as we narrow down the issue. Some points I think are: > Is the app asterisk-iax allowed, based on the type of application may be some traffic is not being passed. > Some times voip related apps may have variations on behavior with change in App content version as decoders would be getting updated, so if it was working at certain content version and not in another that may be the reason. > If the voip servers are internal, did you check by disabling nat rules to see if natting has issue. Also it is good test mechanism to test with 1:1 nat but looks like this was tested already. > Did you try and see the global counters at the time of passing traffic, this would give us an idea on the drops done by pan. We will have to set up filters for specific source and destination and run the global counters command while traffic passing. "show counter global filter packet-filter yes delta yes " Run this back to back multiple times which would give some idea. But I would suggest if a case is not opened yet pls open to isolate the issue. Thanks ... View more