About gwesson

How are you doing the failover testing? Are you pulling the link or killing the interface on the connected switch? If that's how you're testing, the failover will be immediate because the link is effectively dead. There's no hold timer because the routes are immediately removed from the route table.   If you're monitoriting a remote IP, try denying that IP with an upstream firewall or ACL, or by blocking your primary ISPs public interface address from your monitor server. This should induce the failure in a way that would mimic an outage on the ISP side without actually updating the route table immediately.   If you are already doing it the 2nd way above, then I would expect it to work using the hold timer you've configured. Anything other than that would probably be best troubleshot with a support case. You can also take a look at your routing tables with "show routing route" on the firewall's CLI.   Cheers, Greg ... View more

Suggest this to your account team! The more people that want a feature, the more likely it will be added.   For creating a new rule, the GUI already does create it below your currently-selected rule, so that part is already implemented. As a workaround, you can move rules to a specific spot using CLI: > configure # move rulebase security rules <rule-name> after <other-rule-name> # commit Cheers, Greg   ... View more

I've seen some people disable them and add a new tag (something like "pending-removal"). Doing that allows you to easily filter them, and you can leave them in place because the filtering mechanism allows you to just show rules that have the tag. You can even use tags to say, mark one as "future-delete" or some such.   If you can't use tags, the description can also be used for this purpose. Normally it's not shown on the Security rules, but it is a filterable field: (description contains 'deleteme')    Cheers, Greg ... View more

When you installed the updated cert, did you install the full chain (cert + intermediate) as per this article: https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Install-a-Chained-Certificate-Signed-by-a-Public-CA/ta-p/55523   If not, that's the most likely cause. The cert must be installed with the chain, or else all your clients must already trust the intermediate CA (or multiple intermediate CAs, if needed).    If you did just the server certificate itself and not the full chain, try doing the chain install to see if that solves it for you.   Cheers, Greg ... View more

Facebook is easy to identify by the Common Name field of the certificate (generally *.facebook.com). Many other popular SSL applications work the same way. From that, the firewall can determine that while it is SSL, it's actually Facebook.   Your VMWare View app is likely going to a server with a private IP address, or is a doman name that is unknown to the application database. That's why it's only SSL.   If you decrypt the traffic, the firewall can see beyond the key handshake, and can identify the traffic by its actual requests and responses. Until you decrypt it, the firewall only has access to the handshake itself. ... View more

Eicar is the only safe way to test AV functionality. The Eicar files are recognized by the firewall's AV, so it should be a valid test for you as long as you are scanning for the traffic (i.e., make sure you have an AV profile for the traffic type, make sure you're decrypting SSL if it's on an SSL page, etc.).   Anything else you do can potentially be dangerous to your network. If the firewall is misconfigured and you use a live malware file, you risk compromising your environment.   Cheers, Greg ... View more

You can do application-specific QoS. I'd recommend setting up a QoS policy to limit the max bandwidth available for Bittorrent. Rather than trying to limit the number of sessions, you simply make it slow.   Best regards, Greg ... View more

Your ISP modem needs to be set in bridge mode if you're going to put the firewall's external interface in L3. Both can't have the same external IP address. At least in the US, many common ISPs like Comcast and AT&T will not help you with configuration or connectivity issues if the modem is in bridge mode, so do that at your own risk (if your ISP even lets you do it).   The other option would be to set your external L3 interface to something on the modem's LAN interface, 192.168.0.1 (it's probably a /24, but that's not shown on your modem's screenshot). You'll probably want to separate your internal LAN interface with a different subnet as well, just to keep it very clear what is internal and what is external.   Hope this helps, Greg ... View more

Did you mean that your client is 192.168.1.25? If so, then the client wouldn't even be passing through the firewall most likely. If your client and server are in the same subnet, such as 192.168.1.0/24, the client will ARP directly for the server. If both the server and the client are connected to the same switch (or can access each other via L2 only), there will be no routing.   Generally you would set up your clients and servers in different zones and on different subnets, so that you can control the traffic as it routes through the firewall. ... View more