About TonyDeHart

The most likely exception in the future will be for GP which is a relatively simple rule that we could add except for the fact that these block rules are SHARE pre-rules making it difficult but I think in the rule I can just target the device directly.   The other though it that we have some developers spread about that could need exceptions but it could be a number of resources making it more difficult.  I was hoping to get ahead of the question before it was aske but it sounds like the only way is the way I was thinking it would have to be to start with.   Thank you. ... View more

I hadn't thought of the override but that is an excellent point. I've run into others issues with overrides that aren't obvious from the start or with duplicate names at different template stack levels. ... View more

I'd agree.  Leaks would be disturbing.   I find it interesting though that in session 923204 which has a massive amount of traffic labeled to that interzone rule if the firewall is getting confused when labeling what rule it applies to. I'm curious why it started under a different rule at 8:56 but then shifted at the end to interzone at 9:46 despite nothing obvious changing. Was that rule removed or changed (the Aany2Ju...) that would have caused that session to stay open or change which rule would apply? I'm not sure what the firewall does usually with open sessions when the rules change mid-session but I have had some things done that presumably would shut down a GlobalProtect session yet its still open even after a rule change which makes me think its taking a shortcut when applying the rules later in the session. ... View more

I'm definitely no expert but I have had some odd things occur with traffic when doing commits to the firewall particularly when changing the name of anything.  I don't see how that would apply here though. I'd be curious if these two bits of traffic were allowed during a commit and how much traffic was allowed to traverse the firewall.   Might be helpful to have the details on the allowed traffic from the magnifying glass. It would disturb me enough to open a ticket with support to find out why. ... View more

@TomYoung wrote: Hi @TonyDeHart ,   I googled PAN-192930 and found it "addressed" (fixed) in 10.1.6 and 10.2.2.   Thanks,   Tom Sorry I guess I could have done that...  Thank you!   So now the only problem is we are running 10.2.3-h4 and 10.1.9-h1 and that doesn't work.  Not sure what is fixed unless the discussion the engineer pointed out was related to this "fix" not actually being fixed. ... View more

What release did they fix that in (PAN-192930).  The engineer I was on the phone with before had notes he showed me from internal conversations that said it was working as intended and they didn't plan to patch/fix it.  I'd like to update him on which version this is in. ... View more

Glad it helped! ... View more

So it sounds like we do want all four since we are on 10.1.x (the latest...) and would want to account for country code version variations of sites such as netflix.com.au (if that existed...).   10.2 and up sounds like we can trim this back to two entries we just aren't there yet. ... View more

After some conversation with Palo support it turns out there are situations now with 10.2 and above that Panorama traffic is NOT identified as Panorama and is only identified as SSL traffic. According to Palo Alto support, this requires that SSL on 3978 be EXPLICITLY allowed for communications with Panorama. Supposedly, this was originally identified as a bug some time ago but for technical reasons has to be this way.  A rule with SSL/PANORAMA on port 3978 is necessary.   ... View more

Interestingly, to add to this, traffic from other firewalls to Panorama is properly tagged as Panorama traffic and NOT SSL.   Palo support is scratching their head over this too so I now don't feel so bad. If I find out what's going on I'll post it here. ... View more

It is on port 3978 but now that I've sat on this a while and looked at the logs again, it appears there may be legitimate SSL traffic on 3978 as not all the traffic is identified as Panorama.  Some it appears to be remaining as SSL over the long term.  When I had initially set this up the SSL was switching over to Panorama so I assume it was ALL identified a Panorama but there appears to be a good deal of both here.  Just seems strange to me that Panorama's own traffic wouldn't be identified as just that and not generically as SSL. ... View more

So why doesn't CASE 1 apply here? It is SSL traffic and then shifts to PANORAMA was my assumption here.  Not doubting your answer just trying to understand as that was how I was reading it - the SSL is implicitly allowed until identified and what I see in the logs is this initial SSL communications on 3978 and then the shift to PANORAMA. ... View more

I guess my question has more to do with why the Implied App isn't actually used in this case.  If I have a rule that specifies PANORAMA as an application and SSL is implicit to that I don't understand why SSL isn't allowed automatically and needs to be explicitly allowed in the rule itself. ... View more