About mbutt

Hi, I believe that is a documentation typo. The issue was with terminal server agent and not user id. Even though the bug mentions it correctly but they have mistakenly put it in user id release notes. Thank you Numan ... View more

Hi Hart, Can you verify if your licenses are fine and not expired. Also can you click on check now on the dynamic update screen and tail the output of mslogs using following command and verify that it is able to reach and get the response back. tail follow yes mp-log ms.log Hopefully this helps. Thank you Numan ... View more

Hi, Couple of months back there was a change made to the update server and an annoucement was sent out which states the following Reminder: Palo Alto Networks Update Server Change Notification on 10/5/12 Created by panagent Sep 27, 2012 Palo Alto Networks is rolling out a CDN-based update infrastructure. As a result, content updates throughout the world will be delivered from the closest server to the device. If you have firewall rules that restrict the hosts that your devices can reach, you will need to adjust your firewall policy as follows. The current static IP address, 67.192.236.252 will be retired on October 5, 2012 and updates.paloaltonetworks.comwill begin to leverage our CDN infrastructure. A new static host is now available at staticupdates.paloaltonetworks.com with an IP address of 199.167.52.15. You will need to adjust your firewall rule to reflect the new IP address or hostname and you will need to change the update server address that is configured on the device to staticupdates.paloaltonetworks.com. Refer to Palo Alto Networks Devices Require FQDN For Update Server.  This change can be made anytime prior to October 5 to achieve no interruption of update services. It is recommended that users who do not have requirements to restrict the hosts your devices can reach, leave the update server configuration as updates.paloaltonetworks.com. If no change is made to the configuration, devices will begin to take advantage of the new CDN infrastructure on October 5, 2012. Have you made the change according to the above mentioned announcement. If it is not the above issue then please check your traffic logs if it is blocking anything while you are trying to do the update. Hope this helps. Thank you Numan ... View more

Hi Hart, Currently i have checked on the 5.0.1 system as well and this is not available in that OS as well. I would suggest that if you find this useful in your environment you should ask your sales Engineer to file a feature request on your behalf. This way they can track it as well. Thank you Numan ... View more

Hi, I believe currently you can not clone or move the rules to a different device group from the GUI or CLI. Work around would be to manually download the configuration and copy paste the desired rules and then load the config again. Thank you Numan ... View more

Hi, Go to the security rules in panorama, open the security rule that you want pushed to a new device group. Select the appropriate available target devices as per your requirements. Hopefully this helps. Thank you Numan ... View more

Hi, If you would just like to inspect the traffic you can put palo alto firewall in virtual wire mode. Here is a doc which provides details on the virtual wire. https://live.paloaltonetworks.com/docs/DOC-1165 The doc mentioned above is for 3.0.x software but the working of the virtual wire should be same. Hopefully this helps. Thanks Numan ... View more

Hi Hart, As Greg said there is no command clear the logs partially but as a work around If you resize the partition, and commit and then size it back after the commit, you should essentially remove the last the oldest logs.  For example if you have 1 GB of traffic logs, resize the partition to 500MB, and commit, you will remove the oldest 500MB of logs. But again doing this you might delete the logs that you wanted to keep. Hopefully  this helps. Thank you Numan ... View more

Hi Bulent, By default same zone traffic is allowed and different zone traffic is denied. If you want to block the same zone traffic you and create a security rule and define it and that will block the traffic between the same zone. Example Hope this helps. Thank you Numan ... View more

Hi J R, Check if you have dynamic URL filtering enabled under the URL filtering profile If not try enabling that. Here are details on that Dynamic URL filtering Select to enable dynamic URL categorization. URL categorization takes advantage of a URL filtering database on the firewall that lists the most popular URLs and other URLs for malicious categories. The URL filtering database may be able to resolve requests that the local database is unable to categorize. The default is enabled when using the BrightCloud database. When using the PAN-DB, this option is enabled by default and is not configurable. Here is another doc that might further clarify things https://live.paloaltonetworks.com/docs/DOC-3685 In addition to enabling the Dynamic URL filtering and committing. Do the following from the CLI > configure # set deviceconfig setting url dynamic-url yes > clear url-cache all > delete dynamic-url host all Hopefully this helps. Thank you Numan ... View more

Hi Rod, You can go to the Network---> interface tab----> and then the interface and go to the advanced setting. you will see configurable MTU and an option for adjust TCP MSS. Below is the explanation for both of them • MTU—Enter the maximum transmission unit (MTU) in bytes for packets sent on this Layer 3 interface (512 to 1500, default 1500). If machines on either side of the firewall perform Path MTU Discovery (PMTUD), the MTU value will be returned in an ICMP fragmentation needed message indicating that the MTU is too large. • Adjust TCP MSS—If you select this check box, the maximum segment size (MSS) is adjusted to 40 bytes less than the interface MTU. This setting addresses the situation in which a tunnel through the network requires a smaller MSS. If a packet cannot fit within the MSS without fragmenting, this setting allows an adjustment to be made. Hopefully this helps. Thank you Numan ... View more

Hi Muhammad, I am not sure if you are looking for the following but here is how you can configure dual ISPs This document describes the steps to configure a dual ISP configuration for a Branch office. In this scenario an office is connected to two ISPs and redundancy for outbound connectivity is desired. This configuration uses a combination of static routing, policy based forwarding (PBF), and destination interface based source NAT translation. https://live.paloaltonetworks.com/docs/DOC-1357 Hopefully this helps. Thank you Numan ... View more

Hi, Currently we support Radius, Ldap and Kerberos.  If you feel this is a valuable addition you should contact your local SE and request this feature be added to our product. Thank you Numan ... View more

Hi Gerben, When you are logging is it a at admin account. I have seen that you can setup the captures but wont be able to view them if you are not an admin. Try logging in with admin account and see if these are visible to you. Thank you Numan ... View more

Hi SLV, If you and file blocking profile with forward option. It will allow the files to be downloaded and the file will be sent to Wildfire for checking. This is default action it takes when the file blocking is set to forward. Hopefully this helps. Thank you Numan ... View more