About mbutt

My client computer will connect just fine when on a public Wifi, or through a simple AT&T router. However if I am behind my SOnicwall TZ400, then I am unable to get a working connection.  GO connects.  Then drops it and then connects again, about every 3 seconds and does this continuously.   What ports and protocols or other settings do we need to add to the Sonicwall?     ... View more

Hello Guys,   What is the best way to troubleshoot SSL interception?   Here I have an exception with: Issuer: RapidSSL RSA CA 2018 Status: untrusted   Ok great but I don't understand why the certificate is untrusted. I am trying to find some information in logs but I don't fing anything relevant. The relevant CA is trusted.   Is there some commands to troubleshoot that? Maybe the only way in the packet capture.   Thanks.   Best regards ... View more

Finding a command via context sensitive help is okay but a cli reference guide should explain or interpret what commands do. Also if you don't know any part of the name of a command you can't search for it. ... View more

I just had this error happen on an M-500 in logger mode, so I do not think it is related to your VM. I am still curious about this error though and if it is a warning of a larger problem. So far I have only seen the error once, but I am watching for more before opening a ticket. ... View more

Did this get resolved finally ? If yes what settings were modified I am facing similar issues and kinda urgent if someone can respond back pls. Users----Bluecoat Child------Palo Alto (FW)-----Parent Bluecoat Having intemittent disconnects. ... View more

Hi @VinceM,   Which PAN-OS were you using when building this custom report? I cannot find "Repeat Count". I can only find "Sessions".   I'm running PAN 7.1.16 ... View more

What settings do you give the inside gateway? I'm confused on how the GP agent "knows" it's on the inside network. Is it based on whether or not the internal gw name resolves to an IP? Or the IP is reachable? Or something else? ... View more

This feature is in PAN 8.x version ... View more

Hi,   If I understood correctly, PA-500 supports A/A solution per documentation but not Jumbo Frames. would you help me understand how this will work? In PA documents (https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/configure-active-active-ha) it mentions under Step 19 that " Enable jumbo frames on firewalls other than PA-7000 Series firewalls. Switch ports that connect the HA3 link must support jumbo frames to handle the overhead associated with the MAC-in-MAC encapsulation on the HA3 link. " In the Admin guide of the version 7.1, page 228, step 19 says this:  ####Enable jumbo frames on firewalls other than PA‐7000 Series firewalls. Switch ports that connect the HA3 link must support jumbo frames to handle the overhead associated with the MAC‐in‐MAC encapsulation on the HA3 link. The jumbo frame packet size on the firewall must match the setting on the switch######    With that being said,   1.Is A/A solution will work as expected on a pair of PA-500?   2. Are the packets going to have an overhead? If yes how much?    3.If there is any switch in between the two FWs, should be any consideration on the switch MTU settings?    4.If MTU is larger than 1500 which is the default for PA-500 then what will happen? Is the FW going to fragment the packets?   5.If the fragmentation going to happen, is there going to be any performance concern, or any kind of heart beat settings that needs to be considered on the FWs?   I appreciate your help in advance,   -Shahab     ... View more

  Hello, I have a problem, I try to open a URL in my organization URL www.encuestas-colsubsidio.com and it blocks me because it is in the category of financial, I would like to know which category to select for URLs to find and recategorize in PA DB. ... View more

Ok actually I just tried to limit Dropbox access to particular URL's but Dropbox URLs are longer than 255 characters which PanOS is not able to handle. ... View more

The same thing is still true today; PAN doesn't support the full cipher suite, additonally as long as the PA can get the applicaiton ID and do a threat scan it lets other traffic through on the fast path becuase of processing restrictions. It's also important to note that if you are using a smaller device it's very possible that you are hitting the session limit on your PA, anything over that limit will not be decrypted because the PA can not spare the system resources required to process the request and keep the traffic flowing through the firewall. Without a little more back story and actually looking at the logs on the device it's pretty impossible to say if you are encountering normal behavior or if something with your decryption policy doesn't sit right with your setup.  ... View more

Some good info here.  We are getting ready to configure some security policies and I was hoping to see how others were handling it.    One of my thoughts was / is .... Well we are getting ready to implement Panorama, so I was thinking that we could setup a global rule that is application based and then a local rule that is URL based, then monitor traffic and see which way is the most effective. ... View more

If you need to setup links to two separate firewalls then you will need to configure active active HA. Here is a guide that explains the deployment scenarios Configuring Active/Active HA PAN-OS 4.0 Please ensure that you are not trying to get double capacity by using Active Active because if you have a failure of a device a single device will not be able to hold the load of two firewalls. Hope this helps. Thanks Numan ... View more

Here is a doc that explains on how to exempt an ip address from threat profile How To Add Exempt IP Addresses From the Threat Monitor Logs You can use the above doc so it will not scan that. Here is another useful doc regarding threat prevention. Threat Prevention Deployment Tech Note Let us know if this helps. Thanks Numan ... View more