About ericgearhart

Doesn't that kind of imply that if what you're saying is true, a simple SYN scan of a PAN firewall's external IP address would show hundreds of ports open? That's assuming the 'Service' column in the firewall policy is set to any I suppose, not 'application-default' or specifically 'tcp-1433' (using your example of MS SQL) ... View more

Looks like amansour is right... From the 5.0 CLI Guide: > redirect — GlobalProtect portal configuration      > location — Location to fetch GlobalProtect Agent binary file (path: http://host/directory-path)      > off — Disables redirect (allows Agent download from GlobalProtect Portal only)      > on — Enables hosting GlobalProtect Agent download files                  on a server other than the GlobalProtect Portal ... View more

+1 to Sandeep's comment... I have used that technote to upgrade an HA pair and using 'suspend' worked great ... View more

We'd like to be added to that feature request... this was one of the major features I though Panorama already did honestly! We're not running Panorama but we paid for it, we just haven't made the time to deploy it yet. ... View more

SimasK if I could moderate your post and mark it "+5 Insightful" I would ... View more

I agree, there's a balance there between allowing the random Internet to be able to post and restricting it too much to where it's too much of an insular 'walled garden.' You wouldn't want the quality of the discussion board to decline because someone is making constant LOLCAT threads  :smileygrin: ... View more

I've been giving the site some thought, and I suppose as long as the Palo Alto Networks official communities section doesn't engage in censorship (e.g. deleting a post based solely on the fact that a particular user's post was critical of PA's products or services)  then a second outside community isn't that compelling. The one thing that is nice about an outside entitiy like CPUG or PANUG would be that the content would be indexed by Google and would be accessible by anyone, regardless of the status of a support contract...I think that not requiring someone to have a support contract with a company is a big reason to argue in favor of such a community (be it CPUG or PANUG) - you exclude a lot of young aspiring firewall admins by requiring a support contract before you can log in to Palo Alto Networks' communities. ... View more

I am finding that for inbound SSL decryption, it seems that sessions aren't being decrypted if the App-ID 'ssl' is matching. If the App-ID 'web-browsing' happens to match, the session is decrypted. I dunno if that helps you or not, but it's a pattern I just noticed on my inbound SSL decryption setup that I have.     ... View more

We're sticking with 4.1 on a pair of our PA devices and we're still running into bugs. Not trivial stuff either... things like PA's implementation of DHCP doesn't work correctly (ticket open for a month and a half), GlobalProtect doesn't work correctly/crashes/throws errors (client and gateway) We've got a ticket that's been open for two months for User-ID mapping not working correctly (on 4.1 code), where we basically can't use the 'user' column in our rulebase. That's a major feature that we can't take advantage of. It's not "oh another customer is complaining and whining"... it's features that are advertised as working that weren't tested or that get broken by bugfixes. I suppose your mileage may vary though. ... View more

It's time and time again for us with PA... I like the "distruptive startup" nature of the company and all the features packed into the boxes they sell (and the complete lack of dealing with the insane licensing scheme of Check Point), but these QA issues are making it hard for me to make a case with my management to move forward with handing off more load to the PA boxes we have, especially since the Check Point firewalls we have in production seem to just hum along and "just work." We're "dipping our toe" into Palo Alto slowly, and honestly these "bug whack-a-mole" issues are causing us to reconsider our firewall strategy. Don't even get me started on the GlobalProtect client... ... View more

Honestly I wish PA would slow down on the new features and beef up the stability/QA. It seems like we upgrade on support's advice to fix bugs and then after we upgrade we find other bugs... it's bug whack-a-mole. ... View more

See my image for what 5.0.1 looks like. The issue persisted in 5.0.1. The issue got worse with the upgrade. ... View more