About UhMayYeah

UhMayYeah · ‎08-25-2013

At the moment, there is no direct method to block files using their names . Following workarounds can be used: 1> Create a Custom URL category using the source URL of the file and block this custom-url category. Eg : If you know the URLs where this file "hacker tutorial.pdf" could be downloaded from : Create a custom URL category and block this category using URL filtering profile. 2> Create custom application signature for the URL path including the filename. P.S: "But please keep in mind that once you block the file by filename your users will normally try to change the filename to bypass the control which makes it useless." Ref https://live.paloaltonetworks.com/message/10273#10273

UhMayYeah · ‎08-25-2013

Following article explains a way to achieve this Can Files be Blocked by Name?

UhMayYeah · ‎08-25-2013

Can you try to add a static route for 1.2.3.91/32 reachable through DMZ interface. Make sure the packets are being received on the firewall using traffic logs. P.S: Without addition of this static-route ,NAT rule Outside to Outside should be able to translate these packets. Try refreshing arp table of the upstream router. >test arp gratuitous ip 1.2.3.91 interface <outside interface>

UhMayYeah · ‎08-24-2013

The statement is TRUE only for malware URLs /IP addresses identified by the PA Threat Research Team. PAN-DB does not contain all the IPs associated with a URL.

UhMayYeah · ‎08-20-2013

There is currently no limit for admins to login concurrently.However, you may experience a performance impact with the more admins logged in.For example : If the host of admins start generating reports,simultaneously , there could be some issues. But there should not be any issues configuring multiple admins as this is not limited by the Software.

UhMayYeah · ‎08-20-2013

Please confirm this information with your SE on the availability of Wildfire for Android.

UhMayYeah · ‎08-20-2013

I was able to get this working using the interface address: admin@50-PA-5020(active-primary)> show interface logical | match 192.168 ethernet1/4 19 1 trust-L3 vr:default 0 192.168.50.1/23 admin@50-PA-5020(active-primary)> show high-availability virtual-address | match 192.168 192.168.50.1 Active:yes Type:floating admin@51-PA-5020(active-secondary)> show high-availability virtual-address | match 192.168 192.168.50.1 Active:no Type:floating IP-CONFIG Connection-specific DNS Suffix . : IP Address. . . . . . . . . . . . : 192.168.50.206 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.50.1 Results: Reply from 192.168.50.1: bytes=32 time<1ms TTL=64 Reply from 192.168.50.1: bytes=32 time<1ms TTL=64 Pinging 4.2.2.2 with 32 bytes of data: Reply from 4.2.2.2: bytes=32 time=25ms TTL=57

UhMayYeah · ‎08-20-2013

This information was not posted earlier ,I will post this as a knowledge base article. Regards, AK

UhMayYeah · ‎08-20-2013

Palo Alto Networks firewalls have been designed to perform an Auto-Probe/Auto-Discovery when a DHCP server is configured in auto mode. The auto-probing detects existing DHCP servers in the same subnet. When another DHCP server is detected in the subnet, the firewall will shut down DHCP services and the other DHCP would gain/retain control. Note: Auto-Probing cannot be turned-off and should not be mistaken for the "probe-ip" feature. When the DHCP server in auto mode on the Palo Alto Networks firewall stops working due to the discovery of another DHCP server, the following message will appear in the System Log : DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface <DHCP Server Interface>

UhMayYeah · ‎08-19-2013

Please refer :https://live.paloaltonetworks.com/docs/DOC-3322 DES is not supported .

UhMayYeah · ‎08-19-2013

I suggest deleting the GP PanPortalCfg.DAT file located (by default) at the following path. C:\Users\<Windows User>. This will force the GP Windows Agent to download the Altered config from the Portal rather than using GP config from the Local cache,when a User attempts to connect back to the Portal after disconnection.

UhMayYeah · ‎08-19-2013

Currently it is not possible to use Threat name as a filter in Threat logs ,you can alternatively just choose the Threat Id from the Available columns in the Threat logs as shown in the Snapshot. Threats details can also be searched from the Threat Vault. https://threatvault.paloaltonetworks.com/

UhMayYeah · ‎08-19-2013

I tried answering this question in following Post : https://live.paloaltonetworks.com/message/26428#26428

UhMayYeah · ‎08-19-2013

1. How much user-id be supported by agent-less user-id? I guess that 64K user-id and 640 user-group would be supported on all of PAN model. right? Right 2. When using user-id collector, How much user-id and user-group be supported by agent-less user-id for receiving all of user-id and user-group from other FWs? 64K user-id and 640 user-group be supported? Right 3. How many domain and DC be supported on user-id collector environment? Only 20 DC and 8 Different Domains be supported? Approximate Numbers: Agentless: Small/Medium-sized Deployments and LAB Environments Monitoring up to 20 Domain controllers and/or Exchange servers. User-ID Agent : Large Deployments Monitoring up 100 Domain controllers and/or Exchange servers 4. When Using User-ID Collector would support so many user-id, user-group Is it makes a problem of performance for MGMT of FWs? Using the User-ID feature to its max capacity would increase the MP CPU but should not affect the Managment Access to the FW. 5. I know that command "show user ip-user-mapping all" would show mapping user for DataPlane and "show user ip-user-mapping-mp all" would show mapping user for Management Plane? What's different for both of the command? When should I check for user-mapping for MP or DP? DP reads User ID info from MP ,so while debugging User-ID related issues start with MP related command (show user ip-user-mapping-mp all).

UhMayYeah · ‎08-14-2013

Few Options: 1>Enable QOS default profile on the interface to get realtime B/W usage. 2>Using ACC which gives a good estimation of Bytes Consumed over certain duration eg Last 15 mins. 3> Using SNMP and Cacti Templates: https://live.paloaltonetworks.com/thread/4367?tstart=0

Member Since	‎02-22-2012 01:14 PM
Date Last Visited	‎05-10-2024 02:32 PM
Posts	440
Total Likes Received	254

Online Status	Offline
Date Last Visited	‎05-10-2024 02:32 PM

About UhMayYeah

Re: report global vpn

Re: Chromebooks

Re: How can i create a "next VR" type route in panOS version 3.1.12?

Re: Changing communication port

Re: Scheduled captive portal and byod..

Re: Size limit upload for application and user

Re: Scheduled captive portal and byod..

Re: Is it possible to define expiration time for loacal auth data base?

Re: Is it possible to import logs from wireshark or ethreal and view in the PaloAlto?

Re: Is it possible to import logs from any netflow server and view in the PaloAlto?

Re: BGP Graceful restart in an Active/Passive cluster?

Re: Monitor NAT Traffic?

Re: Panorama CPU Core usage

Re: When doing inbound SSL decrypt via a Palo Alto firewall, how are the private keys that you load into the FW protected?

Re: Does Palo support LDAPv3?

Women in Technology: The Inspiration of Aditi Pasupulati

Palo Alto Networks recommends deferring upgrades until March 1

Re: SSL VPN

Re: Strange logs

Re: Packet capture in traffic log

Re: Can i block file by file name?

Re: Can i block file by file name?

Re: One-to-One NAT - DMZ to inside - how do I make it work?

Re: Dynamic Block Lists and IP's

Re: Maximum number of FW admin sessions

Re: How to use Wildfire for Android APK

Re: Can a A/A Floating IP be set to the interface IP ?

Re: Log entry: DHCP server auto-probe finished

Re: Log entry: DHCP server auto-probe finished

Re: SNMP v3 with DES

Re: GlobalProtect Portal konfig update on Windows

Re: Threat search by name

Re: Threat search by name

Re: Questioning about agentless user-id.

Re: Is it possible to see what is the amount of BW is utilized by non-business traffic?

Unlock your full community experience!

About UhMayYeah