About mbutt

You can create split tunnel by configuring access routes in the global protect gateway. This way with security policy you can only allow access to ip address that you want and block access to the rest with the security policy. Hope this helps. Thanks ... View more

since there is no ip address associated in vwire mode with an interface. It will not be possible to access management on the vwire ports.As Nadir mentioned you will have to burn a port and configure it as Layer 3 in order to access it on dataplane ports instead on management port. Hope this helps. thanks ... View more

If this is reproducible consistently i will request you to open a case with the support. So we can investigate the root cause of the issue. Also if you have steps on reproducing it, i will appreciate if you can share that with us. Thank you Numan ... View more

Currently i do not believe PA firewall logs the searches done by the users. However in the categories it will just show up as search-engines. Moreover in the url filtering if you are looking for a specific search you can search based on the filter contains google and search engines example ( url contains 'google' ) and ( category eq search-engines ) The above might not give you exactly what you are looking for, however it might narrow down your search. However if this is something that is useful in your environment you can request a feature with your local Sales Engineer. Hope this helps. Thanks ... View more

The following doc explains about unknow apps https://live.paloaltonetworks.com/docs/DOC-2007 Also following document explains how to request an new application https://live.paloaltonetworks.com/docs/DOC-1879 you can also create an app override for an application that is internal to your network and you know the port numbers https://live.paloaltonetworks.com/docs/DOC-1071 Following doc explains what application override does https://live.paloaltonetworks.com/docs/DOC-1343 Hope this helps. Thanks ... View more

From the logs it seems like the client machine is not able to reach to 198.199.129.150 and create the tunnel. (T4044) 07/31/13 20:53:51:765 Debug( 161): Trying to do ipsec connection to 198.199.129.150[4501] (T4044) 07/31/13 20:53:51:765 Info ( 173): Connected to: 198.199.129.150[4501], Sending keep alive to ipsec socket... (T4044) 07/31/13 20:54:01:765 Info ( 210): failed to receive keep alive (T4044) 07/31/13 20:54:01:765 Debug( 219): Disconnect udp socket (T4044) 07/31/13 20:54:01:765 Error( 994): Connect(198.199.129.150) failed (T4044) 07/31/13 20:54:01:765 Debug( 838): ProcMonitor in third loop. (T4044) 07/31/13 20:54:01:765 Debug( 840): now is 1375318441 (T4044) 07/31/13 20:54:01:765 Info ( 872): Retry exceeds 2 minutes (T4044) 07/31/13 20:54:01:765 Debug( 881): ProcMonitor: reached "done". (T4044) 07/31/13 20:54:01:765 Debug( 900): ProcMonitor: do_disconnect() (T4044) 07/31/13 20:54:01:765 Info ( 914): VPN disconnect. The reason is Internal error. Notify server It seems to be the device issue. Just to confirm is it only happening on 1 device or you are seeing this on multiple device. Also what type of device is it. Hope this helps you resolve the issue. Thanks ... View more

If there was no traffic passing through the tunnel the tunnel might have come down. As you said as soon as you ran test command the tunnel came back up. Next time if you see tunnel go down. I will suggest rather than running the test command send some traffic from the host machines over the tunnel and see if the traffic is dropped or if it pass through and tunnel comes up. If this is the case then it should be working as expected, Hope this helps. Thanks ... View more

What software version are you on. I know there was some config sync issue on 4.1.8 and i believe that was fixed in 4.1.9. If you are not on that software version then as Nadir said restart the management server > debug software restart management-server Also make sure to restart it on both the devices one at a time. So you dont loose management to both at the same time. Hope this helps. Thanks ... View more

What mode is the paloalto in. If it is in layer 2 mode. Please refer to this guide, it explains and shows common different scenarios. https://live.paloaltonetworks.com/docs/DOC-2011 Hope this helps. Thanks ... View more

I think it would be best if you look at the session as well. It is quite possible that intiially the traffic is allowed but once the application is determined traffic is getting blocked. However you can try rmonvon suggestions and see what happens. If that doesnt work then you will need to gather the following 1. Techsupport 2. running config 3. Pcap of the traffic 4. traffic logs and open a case with support to verify if the signatures for http-audio are up to date. hope this helps. thanks ... View more

I am not sure on the version it might be 5.0.x where the administrator accounts do sync however the admin account might not get sync'd. As far as i remember i think it was introduced in 4.1.x version. Thanks ... View more

I believe if you are on 4.1.x and If the device is in active/passive and you can login to the other device. You can create a super user on that device and sync it to the one which you have forgot the password for. Then login to the firewall with the new account and change the password for admin. Hope this helps. Thanks ... View more

Check what policy is the other traffic hitting. Also make sure that the application is showing up as http-aduio in the traffic logs and not as incomplete or insufficient. If it is showing up as as of the above that does not mean that the traffic is allowed. Please see the doc below for the the definition of them. https://live.paloaltonetworks.com/docs/DOC-1549 Hope this helps. ... View more

Hi Jim, For filing feature request you will need to get in touch with your local Sales Engineer. He will file it on your behalf. Hope this helps. Thanks Numan ... View more