About ssharma

With that URL it should have worked. Could you try following : Instead of putting the URL, configure Custom URL Category and add addons.mozilla.org *.addons.mozilla.org In separate lines. Remove the entries in the allow list under URL Filtering Profile. Then change the action to Alert for the custom category in the same URL Filtering profile. Commit the changes. Navigate to the site and see if the category still shows up as Shareware or new Custom Category. Please do attach the snapshot as well after making and committing those changes. Thank you. ... View more

Application might be the issue here. With snapshot I wanted to look at the actual URL that was under URL Filtering logs. In an SSL session, firewall does not have visibility on the HTTP GET message as that is also encrypted. I believe you do not have ssl decryption on the device? You will need ssl decryption to allow or block ssl site with specific URLs. Hope this helps. Thank you. ... View more

Hi Martin, Can you please attach the snapshot for the URL filtering logs where it says block-url. Thank you. ... View more

Yes, on the firewall. Under Device - > Global Protect Client, download and Activate version 2.1.1. Hope this helps. Thank you. ... View more

Hi Diego, Change the custom category to following format : twitter.com *.twitter.com Remove other urls for twitter, commit the changes and see if that works. Hope this helps. Thank you. ... View more

Hi Mike, I don't think this can be achieved in this scenario. Assuming you pushed a config, which caused BGP to fail and there is no other path we can reach the device. Then there is no way that we could remotely change the config. There is no option as of yet on the firewall, that says commit for 10 minutes and then revert back to old state. This would give you window to see if the configuration was working as expected. There are feature requests for the same, I will suggest you to contact your local Sales / System person, they can vote for the feature request on your behalf. Until then we will need local access to the device in case of failure. Hope this helps. Thank you. ... View more

Hi, For the first time installation, GP requires Admin privileges. Next upgrade could be from regular users. That might be issue here. Thank you. ... View more

It will depend on requirement and granularity you are trying to achieve. There are many applications that runs of Port 443. You have couple of options : 1. Allow ports 443 (HTTPS) under Services in Security Policy (This will allow all application running on port 443) 2. Allow SSL as application, this by default runs on 443 so it will be allowed. Hope this helps. Thank you. ... View more

You will have to run following command to view changes : admin@PA> show config diff ... View more

Hi, Command you are looking for is "> show config diff" ; this will show you all the configs that are modified but are not committed yet. admin@PA> show config diff <no changes made, so blank output> Then added a address group called test_3 along with other changes. admin@PA> show config diff @@ -3447,6 +3447,9 @@              v6-WINSRVR {                ip-netmask fc00:2:6::242;              } +            test_3 { +              ip-netmask 3.3.3.3; +            }            }            application-filter {              file-sharing { Hope this helps. Thank you. ... View more

If you already have console access, you run following commands to configure management IP address from CLI : configure set deviceconfig system ip-address <IP_Address> set deviceconfig system netmask <MASK> set deviceconfig system default-gateway <Default_Gateway> set deviceconfig system dns-setting servers primary <DNS_IP> commit Once you commit, you can change your PC's IP to the same range as on the management IP you configured above, and default gateway as firewall's IP. This should give you access the way you need. Thank you. ... View more

Dz3015 Yes, in that case it is expected to use Active/Active deployment. But requirement might be different in Sean's case. ... View more

Hi Sean, If you do not have requirement of running dynamic routing simultaneously on both peer and if you do not have asymmetric routing in your environment, Active/Active setup is not suggested. It does not increase the throughput through the device, you can do manual load sharing among the device. But again, traffic should be such that in case of device failure, peer device needs to handle all of the traffic through the network. It does add complexity in the configuration and also to troubleshoot the issue if there are any. Again to repeat ; If you do not have requirement of running dynamic routing simultaneously on both peer and if you do not have asymmetric routing in your environment, Active/Active setup is not suggested. Hope this helps. Thank you. ... View more

Hi tac.in , If you are seeing above mentioned messages and are running software version earlier than 6.0.7, I would suggest you to upgrade. Thank you. ... View more