About tshiv

santonic The action is set by the most strict rule for given signature. This was confirmed by the product management team. Thanks ... View more

santonic To add to the thread, the rules order in Vulnerability protection profile depends on the action field. For a given signature, the action taken is the most strict action match. Thanks ... View more

mrsoldner There are few enabler applications that are allowed implicitly, meaning, you don't have to add them in the policy to allow them explicitly. I believe web-browsing and SSL fall under this list. This implicit allow was something that was introduced in PAN-OS 5.0 Below document might come in handy: How to Check if an Application Needs to have Explicitly Allowed Dependency Apps I am looking for the list of implicitly allowed enabler applications. If I find anything related, i will update this post Hope this helps. Thanks ... View more

Martin.Egede Can you please verify if the self signed certificate that was generated for SSL decryption is marked as CA and that forward trust and forward untrust options on the certificate are checked? Speculating that dropbox traffic is not being decrypted. Following documents might be helpful for you: SSL Forward Proxy (Man in the Middle) How to Implement SSL Decryption Thanks ... View more

santonic Rules inside vulnerability profile do not get checked from top to bottom. These rules are defined based on criteria's such as host type and severity. For example: Threat ID 36729 has following criteria's : Host type : Server Severity : Critical thus it matches the rule highlighted below: In this case, the action will be block for threat signature 36729. hshah has given a clear idea as to how the profile gets matched. It depends on which security rule the traffic matches and the profile attached to that rule. Hope this helps. Thanks ... View more

Hello, Also make sure that you have set the user's AD account settings to allow the user to log onto "all computers" instead of the the "following computers". Hope this helps. Thanks Tilak ... View more

Hello aklugherz, I believe the dynamic allow list is not supported at the moment with PAN firewall. Do not see any existing feature requests as well. As suggested previously, your best bet would be to contact your SE who can file a request on your behalf Thanks ... View more

Santonic, The action set in the vulnerability Rules are coherent with the default action set with individual signatures. In the exceptions tab, you just add an exception for an individual vulnerability signature and change the action according to you requirements saying that exempt the action set in the Rule for this signature. To see the default action set on a vulnerability signature, open the profile and navigate to exceptions tab. Check the show all signatures option which shows all the signatures with the default action associated with them. Hope this is helpful and not confusing.........:) Thanks ... View more

Hello, If the firewall rebooted, there should be an entry in the system logs. Can you please open a ticket with TAC and provide tech support file for investigation? Thanks ... View more

Hello vchanal, Is there any specific reason that you would want to upgrade one firewall and not the other in HA cluster? Although it will not break the HA functionality, it might result in synchronization issues. It will also generate lot of unnecessary logging on the system indicating software mismatch. It is recommended to have both the firewalls that are part of the same HA cluster on the same software version. Hope this helps. Thanks ... View more

Hi Srikanth, Agree with what tpiens had to say. Also wanted to mention that there are users who try to use application default service in the security policy blocking FTP traffic so that traffic only on tcp port 21 is blocked. But this is not recommended. If you are trying to block FTP traffic, it is better to block on all service ports instead of default ports only. Thanks ... View more

The below document could be helpful : How to Implement SSL Decryption Thanks ... View more

Hello, I absolutely understand the concerns you have put forth in this discussion. Managing a pair of firewalls in active/active configuration through a panorama is very tricky...:) Coming back to the point you have made with assigning ip addresses to physical ports, there are couple of things to consider : - If the interface ip addresses are pushed from the panorama using network templates, it is good to have two different templates. One for active-primary and another for active Secondary. - Another way to implement it would be to configured the interfaces with ip-addresses locally on the firewall rather then pushing it from the panorama as a template. Hope this helps Thanks ... View more