About Phoenix

Hello Art If we look at the below image we see that the Traffic Log type has a field for "Rule" this would indicate the security rule name that is generating the log. Hope this is exactly what is being looked for. ... View more

Hi MMCiobanu To add to Hulks point after creating custom url category for the specified site or sites having similar issue and configure the URL profile with this custom url profile. Also make sure no Data filtering is enabled for this security rule so that it does not process the Bat files. ... View more

Hello nickcx1 Here is the answer for the categories mapping between the Brightcloud and Pan-DB BrightCloud to PAN-DB Category Mapping For all the 3 categores you are concerned there is an equivalent category in brightcloud. Thanks ! ... View more

Hello Art, In the Applipedia there are 2 apps 1> Logmein 2> logmeinrescue. I think based on the application definition given we can just have these apps defined in the rule and take the required action to control the related traffic. There is no need of application filter as it may have lot many other apps relative to the sub-category of "remote-access". If the intention is to specifically control logmein based traffic then the above 2 apps should address. If it is more generic then an App filter looks good. If we know all the remote access tools which needs to be blocked then App group is better. Hope these 3 methods should address. Thanks ... View more

Hello Mattieb, Have seen similar issue and I want to share some screenshots in creating a custom app just to make it easy if some one faces the issue. Steps: 1> Create custom app. 2> Apply in a security rule before the rule which blocks MS-Update APP rule. 3> Clear any existing matching sessions so the new sessions to hit the new app. Wireshark info: ... View more

Below is the image explaining where to go and how to export config file. They get exported as xml as they are in the format of xml. ... View more

"show system state" is a wonderful command to pull these details. I tried to pipe the command as  "show system state | match sn" ,  show system state | match disk",  "show system state | match drive" and so on I did not get much wanted to share for reference. ... View more

Hello MemphisBrothers, We can commit the whole config and just not the differential config. This is how we do. configure commit force Once this is done can you test if you still see this. If still seen can we do config Audit for the latest 2 config versions ( ALL for the lines ) and search for keyword ms-lync-online. OR Also we can export the running configuration to a xml file and do search for the keyword ms-lync-online. These should resolve or direct the resolution. ... View more

Hello EdwinD To find if the URL logs are not being written run the command debug log-receiver statistics This would give how many URL logs are written and we should see if this is increasing or stays at same value when command is run multiple times. Also the below command would give more stats about how the URL logs are being generated and details debug device-server dump dynamic-url statistics Example: Total URL processed: 423 Total URL received: 423 Total URL request loss: 0 Total URL request discard(full): 0 Total URL request discard(invalid): 0 Total URL request discard(alloc): 0 Total URL request allocation failure: 0 Url logs are being processed by the device server daemon, you can try to restart it to refresh its resources. This is management plane daemon and it should not affect the data plane traffic in general. debug software restart device-server Another command to see what is happening on the device through counters and specific to the url would be seen as below, show counter global filter delta yes | match url Still the points holds good where if there is no space for the device to store then it has to be cleared. We can verify this from command show system logdb-quota Hope this helps. ... View more

Hello EdwinD The mechanism of purging logs to clear space is an automatic process. It kicks in only after reaching a certain free space is left. Manual control we have is to clear the whole space at once this is even seen in Device tab to clear logs. But to clear partially it is done by the PAN auto job internally or has to be done in the root. Thanks ... View more

Hello DouglasM.Shrier-LFCC, Although I see some encrypted file types File type extension with enc is seen when file is encrypted using UUencoding technology. If this is exactly what you are looking then we can request a feature for this for file type to be added. Thanks ... View more

With the above command we can see the HDD model number Example: (D2CSTK251A20-012) 12 indicates 120GB if its 24 its 240GB. ... View more

Hello schatterjee, Yes the email alerts about the system logs are Real time. Generally networks use the High, critical severity logs as email to see if the device is stable or to know the live status of the device. Thanks ... View more

Hello noore.ghunaym, Looking at applipedia gives us that the below gaming apps are available, If the security rule does not have xbox-live it has to be added for the Pan to process traffic. Now considering the NAT question in regards to PS4 or Xbox one and so on they need open ports, static IP and so on per the above docs. Ideally once the application is defined in the security rule PAN would start to open the ports needed while inspecting the APP. Some applications may have a necessity to open dynamic ports and there may be a need to open predict sessions and analyse the ports and open the ports. If there is a change in the xbox behavior or the way they work or they open certain new ports or so we may need to share the scenario with the PAN support so that the app is enhanced. Per the Xbox Network Ports | Xbox 360 Network Ports | Xbox Live Network Ports - Xbox.com looks like Kinect has a different port number which is not part of the xbox-live. Thanks ... View more