About Phoenix

Hello Apackard, As soon as the threat is identified in wildfire with the subscription license in place on device and automatic scheduled updates are set ( lets say an hour ) then the firewall would get the new wildfire version in the next hour. Now any further attempt of such threat traffic on the device it is logged in Wildfire logs and Threat logs. A simple search for threats in the range ( 3 to 4 million ) would give the results of the new threats being controlled. The same threat will be pushed in next day updates through Antivirus content for other users who do not have wildfire license. Now from here on no more of the wildfire threat logs would be seen as from now it would be filed as antivirus threat. Hope this helps ! Thanks ... View more

Hello Cheon, For your requirement to make a simple and new app to find if this is your web-server traffic yes we can do. Create a new APP with the required destination  tcp/udp port. Assign this new app in the Application override rule where we provide the source and destination IPs. By doing so for any further traffic matching the IP's and ports in the App the traffic would match the application override rule and the sessions would show the new app. ( considering the old sessions are timed out, if not we can clear the old ones ) The prior update by kprakash was to intend that the IPs cannot be added in a signature pattern as such. Hope this helps ! ... View more

Hello, Good we narrowed the issue. So this points me to the point that in the rule 1 ( Open internet ) we have the User group defined. If for some reason the device is not knowing the users in this group or so it would not take the rule into effect. Now this would direct us towards user identification troubleshooting. > To see users in the group list: show user group name "Group name" > To find the groups show user group list > To see if the user is part of the group, // Use this command to find the user mapping and the group. show user ip-user-mapping ip <> If these are not showing the results right, may be need a troubleshooting call to narrow down the issue. Thanks ... View more

Hello homicidedart To block the different file types we select the the file types and give the direction based on if it is upload, download or both direction and give action as block. Some points to look for, > Direction should be checked can give both to block both directions. > Security rule should have action as Allow. Block is the action only on the file-blocking profile. > If there are more than one rule in the file blocking profile we will have to have this rule in the top or more specific rule in the top and more generic in the bottom. > Also look at the session id details for this traffic to see details about file blocking / sec rule matching and so on to isolate the cause. If all these would not help then flow basic has to be done to analyse at packet level. Hope this helps ! Thanks ... View more

Hello admin@peri Per PanOS 4.1 and 5.0, 2050 supports 100 User ID agents. Though it can support so many agents I would suggest the efficiency of the hardware with user id agents depends on the frequency of the data being retrieved from the agents to the firewall and how much data is being obtained. To some extent we can change the frequency values on the user id agents to retrieve user-ip mapping. Hope this answers your question ! ... View more

Hello COS, If we have to avoid the threat 36180. Find which security rule is used for Trust to Untrust. In that security rule find the Vulnerability profile. Go to that Vulnerability profile in the Objects Tab > Vulnerability profile Exceptions tab. Select "show all signatures" search for the threat id 36180. Now chose the action "allow" so that the threat will not be seen in the logs any more. If you want to drop packets or reset or any other action you can select too. But the option Allow only will not log it and all other options would log them. Hope this helps ! ... View more

Hello, Run the below command multiple times and pass the Bgp traffic. "show session all filter application bgp" If we identify the session in Active -> then the session is setup. If in Discard -> it is rejected by certain rule or so. If we do not see any output in the session command then the traffic is not hitting the PAN at all. As informed in the prior update we will have to take packet captures and global counters to see or gain more knowledge if we see the sessions building. Thanks ... View more

Hello dieterb, Yes it may be possible sometimes to see the apps as citrix-jedi and gotomeeting and so on. Sometimes when the software product change a certain behavior for gotoassist in this case, if it is not updated on PAN app signature we may see such issues. And also all of these belong to same parent company there may be overlaps as seen below. In such cases, where config looks like gotoassist is allowed but citrix-jedi app is not allowed then while passing traffic if we see some part of gotoassist identified as citrix-jedi and it is getting rejected then we may experience traffic drops..to avoid such issues we may have to open a case to correct the app signature database. ... View more

Hello Dieterb, Citrix software gotoassist works on the ports 80/443. If the services are made "App default" it uses the ports needed to have the gotoassist traffic allowed. Now in the apps column since we have added gotoassist it looks for signature pattern of gotoassit with combination of ports needed. If this combination matches only then traffic is allowed. If just ports match and signature pattern is not allowed the traffic should not be permitted. Thanks ... View more

Hello Troyflex, You are right, that is exact ! ... View more

Hello troyflex, The question is to find best way to restrict or control access to the users who are connecting through GP to internal resources. 1> So some users(User-set A ) should have access to only few servers and other set of users( User-set B) should have access to all. GP tunnel should be ending in a VPN zone. If GP is configured directly into Trust zone we cannot use the flexibility of security rules. In the security rules add the rule1 -> to have just the User-set A to access to the few servers. Users can be made as a local group, or just add those user IPs in the security rule. Make a rule2 -> For User-set B where they have access to all. By doing so we are providing specific access to each group. Remember always have specific rule in the top and more generic rule at the bottom while designing security rules. 2> If we have Ldap groups configured on the PAN then we can create security rules with just for selected users to access servers by giving the User-id in the rules. Hope this is clear ! ... View more

Hello Chrisp, Below is the command, "debug log-collector log-collection-stats show incoming-logs" This command would show dynamic incoming log rate and the current logs for Traffic, threat, system and so on. Another command for incoming-blocks is there, "debug log-collector log-collection-stats show incoming-blocks" Blocks of log data will be moved from one collector to the other based on a hash-map. These stats will show how many blocks of logs the collector has received from the other collectors in the Collector group. When you have only one collector in the collector group you will not see any of the above stats increasing. Hope this helps. ... View more

Hello, Yes from the graphs I see the bandwidth is kind of doubled for a single time frame when compared. I would suggest select the time frame for what is seen in Network Monitor note the numbers for Bytes for a particular application like web-browsing and so on. Now in the ACC tab select the custom time option, and select Bytes as drop down and look for the Applications and select Web-browsing. Here we would get Bytes and sessions for same time frame. If we compare they should be same if not some thing might be wrong in reporting. Thanks ... View more