About EdwinD

Thank you. URL logs written:              10537835 Then a little later URL logs written:              10560883 However, there are no URL logs for the last 6 hours in the web interface view. The output from the other command leads me to believe we aren't dropping URL log requests. Current read idx: 23604 Current write idx: 23604 Total URL processed: 89140 Total URL received: 89140 Total URL request loss: 0 Total URL request discard: 0 Current async read idx: 39227 Current async write idx: 39227 Total async URL processed: 39227 Total async URL received: 39227 Total async URL request discard: 0 debug software restart device-server - this did knock off all my Citrix Xenapp/Xendesktop users.   I think this is because I have SSL decryption of this traffic enabled on the PA.  This did not resolve the issue. I'm not certain how to read the logdb-quota output.  If I am reading it correctly, I am full because the threat logs exceed my 19GB qouta, and URL filtering goes to the threat logs.   Quotas:             traffic: 31.00%, 36.932 GB               threat: 16.00%, 19.061 GB               system: 4.00%, 4.765 GB               config: 4.00%, 4.765 GB               alarm: 3.00%, 3.574 GB               trsum: 7.00%, 8.339 GB         hourlytrsum: 3.00%, 3.574 GB           dailytrsum: 1.00%, 1.191 GB         weeklytrsum: 1.00%, 1.191 GB               thsum: 2.00%, 2.383 GB         hourlythsum: 1.00%, 1.191 GB           dailythsum: 1.00%, 1.191 GB         weeklythsum: 1.00%, 1.191 GB             appstat: 6.00%, 7.148 GB               userid: 1.00%, 1.191 GB             hipmatch: 3.00%, 3.574 GB   application-pcaps: 1.00%, 1.191 GB         threat-pcaps: 1.00%, 1.191 GB   debug-filter-pcaps: 1.00%, 1.191 GB         hip-reports: 1.00%, 1.191 GB             dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 15G, Index: 16G threat: Logs: 9.3G, Index: 11G system: Logs: 207M, Index: 43M config: Logs: 1.3G, Index: 9.9M alarm: Logs: 72K, Index: 36K trsum: Logs: 4.2G, Index: 4.3G hourlytrsum: Logs: 3.1G, Index: 412M dailytrsum: Logs: 1.1G, Index: 147M weeklytrsum: Logs: 1.1G, Index: 148M thsum: Logs: 2.4G, Index: 79M hourlythsum: Logs: 56M, Index: 42M dailythsum: Logs: 34M, Index: 40M weeklythsum: Logs: 24M, Index: 9.0M appstatdb: Logs: 288M, Index: 125M userid: Logs: 1.2G, Index: 440K hipmatch: Logs: 16K, Index: 16K application-pcaps: 681M threat-pcaps: 4.0K debug-filter-pcaps: 8.0K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K show log threat - this shows that I have logs going back to 12/11/2013.  I lowered the threat DB from 16% to 7% and then did a commit.  After the commit, an Exec task ran for some time.  After the Exec task completed, I started receiving URL filtering logs again.  I believe reducing the threat DB caused the database purge to occur. I increased the threat DB back to 16% and did another commit.  This seems to be a work around for this issue. ... View more

Perhaps I'm looking at this wrong.   When the URL filtering logs quit logging, what is the appropriate action to take to get URL logging again?   I am assuming that the logs are full and thus I have no logs.   Perhaps that is not the problem at all. ... View more

Thank you. Currently my URL filter has quit logging because (I assume) it is full. >>The quota is checked each time a logdb file is rotated. If the quota threshold is violated then we start deleting logs starting from the oldest until the threshold is no longer exceeded. To see how often the logdb file is rotating, you can review the ms.log file for the following entry "Initing log file with version". Can I manually run the logdb rotation?  If so, how? ... View more

For what it is worth, I have been running Microsoft DNS servers behind the Palo Alto firewall for quite some time.  These are in my DMZ, exposed to the Internet, and allow resolution of a few of our DNS zones.  I'm currently running Microsoft server 2012 on these DNS servers. The Palo Alto firewall rule is nothing special.  It is your typical rule to allow incoming traffic, and allows UDP port 53 as a service.  I have application set to any. I have manually configured bi-directional NAT so that inbound and outbound traffic all originates from and terminates to the same public IP address. One thing that got me when I first setup this up was I forgot to go into the Windows server firewall rules and allow DNS from networks other than the one the server was on. ... View more

I suppose I could purchase two Barracuda Link Balancers, set them up HA, and then use PBF on the Palo Alto to send specific traffic to the inside vIP of the Barracudas.  Such traffic would likely need to be double NATed.  I would need to exclude B2B destinations that have IP filters in place based on our BGP network, or get static IPs on the cable modems and have those added to the IP filters. I suppose I could connect a port from ETHERNET2 to each of the Palo Alto firewalls on a new Ethernet port, then use PBF to redirect traffic to the existing Barracuda.  Such traffic wold be double NATed.   As I've never used the police based forwarding before, I'm a bit concerned about making this change on my production firewall. In this scenario, say I gave the Palo Alto Firewalls a 192.168.0.9/24 address on the private inside of the Barracuda Link Balancer.  I assign it as zone WIFI and interface 1/7.   Then I create PBF rule that says if the source is (PC VLAN RANGE, Zone TRUST) and the destination is (Akamia CDN Netblock)  I forward this to egress from interface 1/7 (right?) with a next hop of 192.168.0.1, my Barracuda inside vIP.   I would create a fail-over monitor and specify an IP address to ping.  Preferably, the IP address would be a remote IP address at Akamia, not something on my LAN.  This way I can fail over if there is an upstream failure. Do I understand correctly?  If not, what mistakes am I making?   ... View more

Attached is a small section of my rules.   These rules have profiles associated with them which include URL filtering, Data filtering, and so on.  Some groups have Google Earth, Google Maps, both, or none. If I stick a rule above all these rules which allows Google Earth and Google maps, then I'm breaking my URL filtering as the allow rule would allow this traffic regardless of what the subsequent rules state. I would need to duplicate every single one of these rules that allow Google Earth and/or Google Maps and set the top duplicate rule to allow the platform without data filtering, correct? ... View more

For what it is worth, our 2050 HA Pair reboot quite often using PanOS 4.1.10.   I'm currently reviewing the forums for issues with 4.1.12 prior to upgrading. ... View more

Thank you. dogbert@PA-2050-Trailer-Rebuild(active)> show system resources | match srvr 2360       20   0  651m 106m 3192 S    0 10.9 535:48.96 mgmtsrvr 2381       20   0  422m 106m 9912 S    0 11.0 610:47.25 devsrvr It sounds like this means PA2050 is underpowered for my needs.  Since I have an HA pair, perhaps the better thing to do would be to completely reboot the main unit so that the passive one takes over.   That way I wouldn't loose the ssl-terminations or user to IP mappings.   My shop is heavy on inbound and outbound SSL termination, and just about every outbound allow rule is based on active directory user mapping. Thank you. ... View more

Thank you everyone for sharing this information. I have recently downloaded 4.1.11.  Before applying it, I browsed this forum to see if there were any known issues.   From what I am reading, I believe I will stay on 4.1.10 and wait for 4.1.12. I have an issue where committing a policy will generate errors and fail about 50% of the time.  Subsequent commits with no changes eventually work.  I am ever hopeful that this issue will be addressed in a new release. ... View more