About kprakash

Hi, You can find which of these signatures are already defined under the Palo Alto signature database, by checking them under the applipedia. We have signatures for sql, sccp, ILS and RPC. There can be slight variations under the signatures for the apps mentioned above, and we may not recognize the apps correctly. In such cases, you can raise a feature request for the applications to be added under the apps database. As a work around, you could also create custom apps ( the following link explains the steps: https://live.paloaltonetworks.com/docs/DOC-1966 ) or you can create custom apps based on ports and use them under app override policies. BR, Karthik RP ... View more

Hi It should NAT and PAT when for not only the parent sccp session ( controls session )  but also for the predict sessions (  pin hole sessions for the actual traffic succeeding the control session  ) too. the below commands will be useful to look at the NATed IPs when the sessions are formed: >show session all filter application sccp >show session all filter type predict BR, Karthik RP ... View more

Its not supported. You can find the list of IPV6 features supported, that are supported on this link: https://live.paloaltonetworks.com/docs/DOC-2383 You could however configure the PANFW as a DHCPv6 server, but you can also leverage the SLAAC IP addressing scheme on IPV6, which doesnt necessitate the use of DHCPv6 server, and can auto configure its IP address. See below explanation for SLAAC. Got it from wikipedia Stateless address autoconfiguration (SLAAC)[edit] See also: IPv6 address IPv6 hosts can configure themselves automatically when connected to an IPv6 network using the Neighbor Discovery Protocol via Internet Control Message Protocol version 6 (ICMPv6) router discovery messages. When first connected to a network, a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to such a request with a router advertisement packet that contains Internet Layer configuration parameters. [16] If IPv6 stateless address autoconfiguration is unsuitable for an application, a network may use stateful configuration with the Dynamic Host Configuration Protocol version 6 (DHCPv6) or hosts may be configured manually using static methods. Routers present a special case of requirements for address configuration, as they often are sources of autoconfiguration information, such as router and prefix advertisements. Stateless configuration of routers can be achieved with a special router renumbering protocol. [21] ... View more

You are probably missing a Source NAT translation from visitor  lan to the untrust zone, NATing it to the IP address of the untrust interface. BR, Karthik RP ... View more