About ericgearhart

Why can't you test it? Couldn't you use Firefox with User Agent Switcher and a custom user agent to "pretend" to have the user agent you're trying to block? ... View more

I'm with panos on the app override on this one... it's something to at least try. Build an App override for IPSec/IKE traffic (should be UDP 500 and UDP 4500 I believe) and stick it in a rule that allows traffic to the remote ASA, and see if the issues magically go away. It will at least help you narrow down the problem, and prove whether or not the App-ID engine has something to do with the problem you're experiencing. As an aside, I'm surprised they're not using AnyConnect SSL VPN. ... View more

did you try configuring a tunnel monitor for the device? I noticed that tunnels would go down and not come back up on PA devices I was configuring IPsec tunnels on when I didn't configure a tunnel monitor. I guess for the tunnel monitor you might try configuring only one IP address for the phone itself inside the tunnel, and then for the tunnel monitor plug in the phone's only IP address as the IP to 'monitor'. The big clue that the issue was specifically related to tunnel monitoring was that I could clear the IPSec/IKE SAs on the PA CLI and then the tunnel would come back in... maybe the issue is basically the same for you? ... View more

Did you ever try to change over to a Site-to-Site IPsec tunnel style config on the PA? I would think the Avaya might need to support X-Auth in order to be a "normal" IPSec client. Try building an IKE Gateway and an IPSec tunnel on the PA, and configure Proxy-IDs as well. Have you seen this thread by the way? https://live.paloaltonetworks.com/message/21633 ... View more

We had this exact same problem... the problem is that the PAN DHCP server doesn't respond with a NACK when a client requests an IP out of the DHCP server's scope (which is in the DHCP RFC as a "should implement" if I remember from my bug report) PANOS 4.1.13 and PANOS 5.0.4 has a fix for the DHCP slowness. ... View more

I have used VPNC integrated into NetworkManager (the default on my Linux distro, OpenSUSE) and it worked great... make sure X-Auth is turned on and you should be good to go. ... View more

You know honestly it's not a "DNS Proxy" at all... I thought it would be transparent when I saw the name "DNS Proxy" too. They really ought to just name it flat out "Caching Only DNS Server," because that's essentially what it it (with some static entries permitted in order to do DNS doctoring)     ... View more

Hithead wrote: And yes, we are using the "powerful" and "stable" PA2000 series......with 5.0.3.....In the last versions the problem was also available.... I hope you're being sarcastic here The PA2000 series is neither powerful nor stable in my experience ... View more

It'd be nice if maybe a rule had a "don't warn me about dependencies" checkbox or something... I run into this every day too, because I don't have IPsec turned on for my GlobalProtect rule. I don't ever want to use IPSec... I only want to use SSL based VPN. ... View more

He directly addressed this in his original description of the question... he's not using actual clients, he's using strictly web-based Gmail: The local installations don't use SMTP - they connect to GMail over HTTP/HTPS, and the GMail back-end servers do the SMTP stuff. Why does Palo Alto now think GMail requires SMTP? I should add that I have checked the release notes for this content release and they mention *nothing* about there being a change to the gmail-base app signature. ... View more

Also the PA can't do WCCP... If that's a requirement for you in any way the PA isn't going to work. That being said, the URL filtering capabilities are "pretty good" on PA, but you can't get as granular as you can with BlueCoat. In BlueCoat you can do some pretty neat tricks, like transparently turning links on a site from http to HTTPS. If you don't need the rich amount of logic the BlueCoat provides the PA might be "good enough." Take full advantage of the PA's DNS proxy feature (so you can do some DNS rewrite if needed), User ID agent and of course App-IDs and you might have enough features that you wouldn't need BlueCoat. Also I'd probably go with 'PAN-DB' in lieu of BrightCloud for URL filtering... PAN-DB seems to me to be the way forward for PA (I don't work there though so don't take my word as the gospel truth) ... View more

slv - honestly the low level discovery features built in to Zabbix 2.0 and 2.2 should make it really easy to walk the Palo Altos and automatically discover interfaces and build graphs, without needing to template out interfaces. I can export what I have (which mostly provides graphs of the session table, management and data plane CPU usage, number of sessions broken down by TCP, UDP, etc) but for simple interface graphs use low level discovery! It really is the best way to go https://www.zabbix.com/documentation/2.0/manual/discovery/low_level_discovery#discovery_of_snmp_oids I would highly recommend you start off with Zabbix 2.2, there are a bunch of critical SNMP fixes in that version. Also Zabbix 2.2 implements AES/SHA support for SNMPv3, which Palo Alto requires for SNMPv3 (otherwise you're forced to use SNMPv2, which is completely clear text... not a good solution to start off with). Zabbix 2.2 isn't released yet, but there's supposed to be a beta out by the middle of June. ... View more

Awesome thread... a guy at work and I were just kicking around whether or not logging affects the ACC. This thread answers that question! ... View more

Thanks for the follow-up! It seemed to be something client side to me as well. And hey, at least now you're caching DNS on your PA ... View more