About gwesson

What PAN-OS version are you using?   You can check the device server log for details about what happened. It isn't super clear unless you have seen the error for other daemons, but it's referring to the "device" daemon when it says "... to client device".   > less mp-log devsrv.log or > tail follow yes mp-log devsrv.log (then replicate the issue by trying the commit again) ... View more

You'll probably want to post this in the Migration Tool forums to get the most visibility:   https://live.paloaltonetworks.com/t5/Migration-Tool-Discussions/bd-p/mt_discuss   Cheers, Greg ... View more

You should be able to see that info under Panorama > Managed Devices. Make sure you are showing the relevant columns (Software Version, Apps and Threat, Antivirus, URL Filtering, WildFire).   Each connected device will show the versions of each item in their respective column.   Best regards, Greg Wesson ... View more

If I had to guess, you're probably running PAN-OS 7.0 or older, so the list of ciphers supported by the decryption is limited to lower security ciphers (nothing using DHE or EC). If I'm wrong about the OS version, you can discard the rest of this message because I have no idea other than that.   If the site you're going to only supports high-encryption ciphers within TLS 1.0 and greater, the only option left to the firewall's decryption mechanism is to use SSLv3. Since SSLv3 is pretty much not supported by most current browsers unless you force it the error you see will happen (it can't negotiate any ciphers that it has in TLS, and the downgrade to SSLv3 fails).   PAN-OS 7.1 introduces a huge amount of additional ciphers within SSL forward decryption. If you are unable to upgrade to 7.1 yet, the only options would be to block the site or exclude it from your decryption policy.   Best regards, Greg Wesson ... View more

Probably the most effective way to do this would be to create an Application Filter (Objects tab > Application Filters > Add) and give it a name like "Video Streaming". I do this for my at-home QoS policy (though I'm making it faster instead of blocking it =P)   Create a security rule with the Sports category in the rule itself, the Video Streaming application filter you created above, and an action of Deny.   This should be skipped when a normal sports web page is pulled up, but any application that matches the filter will be blocked when on a sports page.   Note: I have not tested this, so I don't know if it'll break other stuff. You'll want to test it with your own client before implementing it site-wide.   edit: My rules don't normally include categories in the rules themselves, so that column isn't present in my screenshot. Sorry about that!   Screenshot of what I wrote in app filter and security rule: ... View more

  Your images didn't come through for some reason, but in general the reason for this is because the CSR wasn't signed with the CA option (ca=true). If it's not a CA cert, it cannot be used for forward decryption.    You will be unable to get a CA cert from a public authority (like Symmatec or GoDaddy). No public CA will give a private party a certificate that can be used to issue new, trusted certificates.    You'll need to use an internal CA, or create a self-signed CA cert on the firewall and distribute that to your users.   Cheers, Greg ... View more

I haven't had any issues with it connecting and being controlled. Are you doing NAT on your firewall for the Nest device? That's the only thing I can think of, as it doesn't need any inbound rules and your security rules are probably good. ... View more

I've got a pair of Nests at my house behind a PA-200. Almost all the connections end up with a client reset, but everything works for my Nest reporting and login. My phone can manage them just fine, and I can see all my historical data. I think that Nest is just really aggressive with TCP handling.   Here's a screenshot of my logs. You'll notice that everything ends with rst, but the byte sizes are significant:   Hope this helps, Greg ... View more

uPNP is not something that can be allowed through the firewall. As it is inherently insecure, you would need to do 1-to-1 NAT to get the full capabilities of the Xbox/PS platforms. Without the 1-to-1 NAT, you'll still be able to get online to download updates or new games, browse the respective marketplaces, etc., but you won't be able to host a multiplayer game (unless something has changed in the last couple years that I'm not current on).   There's an article about it if you want to take a look: https://live.paloaltonetworks.com/t5/Management-Articles/Palo-Alto-Networks-Firewalls-gaming-consoles-xbox-Playstation/ta-p/54848   Cheers, Greg ... View more

There's a paradox you've mentioned that needs to be clarified.    You say that the rule matches and traffic is allowed. But then you say that the implicit deny rule is blocking the traffic. Both can't be true for the same traffic, so maybe there is more than just port 8443 that is happening?   To answer your explicit question: you cannot modify the Implicit-Deny rule at all, so that's a moot point in this regard.   Since your rule is already specific to 8443 and 2 external servers, and your application is set to "any", web-browsing is implied in the "any".    Take a look at your traffic log (Monitor > Traffic) and see what port(s) the denied traffic is using. You may need to broaden your rule to include the ports.   Using a port is generally not needed. The firewall can pick up the application on any port, so usually that just ends up making it more restrictive when you don't want it to be. Try removing the port restriction and instead specifying the application "mcafee-epo-admin" and "web-browsing" to that rule. You're forcing it to only apply to 2 destination servers, so it will only allow web-browsing to those servers anyway.   Cheers, Greg ... View more