About mbutt

Even though it will require human intervention and going through the Release notes, one possible work around i can think of is to set a THRESHOLD on application and Threat update schedule. If you want the content to update automatically but giving you enough time to go through the release notes. So if for some reason you did not get a chance to go through the Release notes the content will still get updated. since we know that the content update happen weekly you can delay it with threshold. Antivirus: Daily Applications and Threats: Weekly (Wednesday) URL Filtering: Daily Below is the doc which epxlains the same information as above for update Schedule. https://live.paloaltonetworks.com/docs/DOC-2902 Hope this helps in some degree to provide you enough time to research on the new updates. Thank you Numan ... View more

Here is also a brief description why that particular rule is catching incomplete or insufficient traffic. 1. Firewall allows few packets initially through to identify the traffic as an application and that traffic can be leaked matching any rule or most open rule. 2. Once the traffic is leaked we try to identify it as application. 3. Also incomplete or insufficient data is not an application. 4. Since the traffic passed through firewall was either one directional or not sufficient packets were passed through it, firewall could not make determination to match it to a specific rule. 5. Since that determination was not made it showed the traffic matching to rule on which it initially leaked the packet through to make the determination of the application. 6. Moreover unknown-udp or unknown-tcp is shown for the traffic for which we do not have the signature to identify it as an application. But if that determination is never made then applcation shows up as incomplete or insufficient data. Below is the doc which is intended to provide an overview of how to identify unknown applications on your network and what to do once they have been identified. https://live.paloaltonetworks.com/docs/DOC-2007 Here is a doc which explains different definitions of application when they are not determined https://live.paloaltonetworks.com/docs/DOC-1549 Hope this clarifies the situation furthermore and explains the behavior. Thanks Numan ... View more

If you configured internal gateway on the GP client. It will automatically detect you on the internal LAN. and on the GP client it will show up as internal instead of connected. This way it will not create a tunnel for the client. Some useful docs for Global Protect configuration https://live.paloaltonetworks.com/docs/DOC-2904 https://live.paloaltonetworks.com/docs/DOC-2020 https://live.paloaltonetworks.com/docs/DOC-3930 Hope this helps. Thanks ... View more