About kadak

Hello BSadozai Today, we do not support the EDNS RFC 2671. Usually, if DNS servers enabled with EDNS tries to talk to a non-EDNS server, the non-EDNS servers will simply ignore the OPT request and will not negotiate a larger packet size. However, I do see a feature request (FR) submitted to our development team to potentially add it to our upcoming releases. You can also request your account's SE to vote for it. FR ID : 2315 Hope that information helps! Thanks and regards, Kunal Adak ... View more

Hello Gonzalo, Its ok to see management CPU spike - but only during certain times like commits, generating tech supports, report generation and similar processes. BUT, if it stays to 70% for the most part of the day then we would need to check what process on the management plane are causing the management CPU to go high. Lets see how the management plane looks resource-wise.Could you give us an output for the following commands: > show system resources | match srvr > show system resources | match total > show system disk-space Has anything changed since the upgrade?  How did the CPU look prior to the upgrade (in other words expected MP CPU usage)? Thanks and regards, Kunal Adak ... View more

Hello hemarsys, Yes, you should be able to perform decryption in between internal zones with sub-interfaces. We would just treat them as two separate layer3 zones while creating a decryption policy for inbound inspection. Some documents that might help you: How to Implement SSL Decryption How to View SSL Decryption Information from the CLI Difference Between SSL Forward-Proxy and Inbound Inspection Decryption Mode Hope that helps! Thanks and regards, Kunal Adak ... View more

Hello Venkat, The syntax to be used to clone an existing configuration object using xpath paramter would be: http(s)://hostname/api/?type=config&action=clone&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/&from=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']&newname=rule2 Keeping syntax in consideration, in your case the REST API would be: https://hostname/api/?type=config&action=clone&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/&from=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='testProfile1']&newname=testProfile1-1 Let me know how that works out for you. Thanks and regards, Kunal Adak ... View more

Hello Mike, We cannot hide a column off of a security rule, but we can create an admin role such that a particular administrator cannot view any security rules configured on the PAN. Administration 'John Doe' can be given the admin role 'Sec-rule_restriction' so that he cannot view/modify or even add anything in the security policy section. I hope that addresses your concern to some extent! Thanks and regards, Kunal Adak ... View more

Hello Ian, Can we make sure that the safety mode setting is selected on youtube's main page. Its located at the bottom left hand side of the page. Thanks and regards, Kunal Adak ... View more

Hello Mckinzie, Now that I have understood your concern, as far as creating a URL exception for a data filtering profile is concerned, PAN firewall currently doesn't have the capability to do that. However, what you can can try is create another security rule -- without the data-filtering profile applied to it and a URL filtering profile with that specific URL mentioned in the allow list and place it on top of the existing rule which has the data-filtering profile. In that way, whenever the traffic concerned with that specific URL hits the firewall, it will only match a new rule which doesn't have the data-filtering profile. OR, the regex pattern itself needs to re-configured to avoid those SSN false-positives. Let me know what do you think about the workaround. On another note, if you think this feature would be valuable addition, you can submit a feature request through your account's SE to our development team Thanks and regards, Kunal Adak. ... View more

Hello Mario, You can run the following commands to get a general know-how about the amount of traffic flowing through the PA500 > show running resource-monitor week <1-13>              // Gives you the dataplane usage in terms of  last (1-13) week/s > show session info                                                      // Gives the current snapshot of session table utilization > show system statistics                                                 // Gives you the real time usage in terms of throughput and packet rate Now you can also gather some useful information through the WebUI, under ACC tab where you can sort by sessions/ bytes and also set the time. You can also use the feature of App Scope under Monitor tab in WebUI to generate reports for bandwidth usage. Another way to gather information from the PAN firewall would be to monitor it via SNMP and then run a report on the data using something like Splunk. Hope the above recommendation is what you are looking for. Thanks and regards, Kunal Adak ... View more

Hello Mckinzie, If you are looking to block a URL filtering category but allow a specific URL that belongs to that category, here is how you would do it: In the following screenshot, social networking category is blocked but facebook.com is allowed. The order of precedence taken: Block list Allow list                            custom categories  pre-defined categories I hope I understood your question. Thanks and regards, Kunal Adak ... View more

Hello Cheon, Are all files(ppt , jpg etc..) forwarded from data-plane to management-plane? - If  a file download session matches an AV profile enabled to the security rule, then file will be streamed to Content-ID engine for AV scanning. If not, only then the file is is streamed from the dataplane to the management plane for wildfire processing. cancel_disk_io_fail counter: Number of times the management plane failed to write temporary files to the disk before sending them to the WildFire cloud.  This can occur with a general disk fault, and can also occur when the disk buffer is near quota. I did read in an internal document that apparently the counter would only show up in wildfire statistics if it is non-zero. Thanks and regards, Kunal Adak ... View more

Hello fma, If you enable Jumbo Frames on the Device tab, it will be a global setting as you mentioned.  Any interface that has NOT CHANGED its default MTU size will inherit the jumbo frame size set in the global settings.  If you want a different interface setting then you can change it in the interface’s Advanced Tab. Best to set the interfaces that you don’t want to have the jumbo frame size first and then set the global value after these have been configured.  This way, they don’t inherit the jumbo frame size unexpectedly. In my lab, I checked the setting for Jumbo frames under Device tab, committed the changes and rebooted the firewall. All the connected interfaces inherited the global setting for MTU. admin@55-PA-5060(active)> show system state filter-pretty sw.dev.interface.config sw.dev.interface.config: { ethernet1/3: {     hwaddr: 00:1b:17:00:01:12,     mtu: 9192,   },   ethernet1/5: {     hwaddr: 00:1b:17:00:01:14,     mtu: 9192,   },   ethernet1/6: {     hwaddr: 00:1b:17:00:01:15,     mtu: 9192,   }, } Hope the above recommendation helps you! Thanks and regards, Kunal Adak ... View more