About mikand

Sounds like a good feature request which you should contact your Sales rep about. However I have another opinion regarding how the appid should be used. If your webserver only listens to lets say TCP80 I then see no reason for why one would use "any" or "service-default" regarding ports (other than a test or for protocols that uses large port-ranges). My opinion is to setup the PAN as you would with a regular SPI-fw with the addition of selecting proper appid for each flow. With the disclaimer that there are some special cases where "service-default" is handy. One of the reasons is that in many cases the PAN must let one or more packets through the firewall before the appid can successfully be detected. This will, even if its a small one, unnecessary expose your resource for the surroundings. ... View more

Also the PAN can be used for both SNAT ("forward proxy") and DNAT ("reverse proxy"), however it doesnt proxy any traffic on its own (except for the SSL and SSH part when doing termination). So you can use a PAN to protect your webservers by setting up a DNAT rule along with SSL-termination to inspect HTTPS flows - and then in the security rule define which applications should be allowed (for example if its a bunch of Sharepoint-servers you wish to protect). ... View more

You can create a custom threatpolicy (that you can group with other custom or default settings into a profile group). This custom threatpolicy (or the whole profile group) can then be applied for your traffic to/from a specific ip-address or such. Since the ruleset in PAN is top-down first-match you can set it up as: rule1: srcip=x.x.x.x, threatprofile=ALL_BUT_12345 rule2: srcip=any, threatprofile=default ... View more

I think you can do this in the CLI, but no idea on exact syntax or if this is possible to do from the GUI. A dirty workaround would be if you export running-config.xml to your local computer and search from a texteditor, but thats just wrong and dirty :smileysilly: ... View more

Dont forget the proxy-id (which seems to be the no1 mistake when ipsec stuff wont work :smileysilly:) ... View more

Any particular reason you wish to do this? Because performance-wise you wont gain anything from this, perhaps lower the probability of false positive. Cant you select a sub-category such as networking -> remote-access? This would cover the threats regarding remote-access stuff. However there can be other threats more general that one should look for aswell so I would stick to use a profile which will look for as many bad things as possible. To lower the probability of false positives you could use low and informational severity set to action=default and medium, high and critical severity set to action=block. Do this for both spyware and vulnerability and then create a profile-group who will use your custom groups. ... View more

Dont forget to get back with the fix ... View more

Which answer did the sales rep return to you regarding this? What do you mean that it will be logged in the traffic log? You didnt setup a log entry for this rule? Then if you use default for the other threats then its depends on how each threat is setup in the threat db if it should just alert (just log) or deny (block and log). Given that you get a hit for the other threats that is... ... View more

log on session end (which is the default if you enable logging) should bring you this. The problem here is to find out why the session ended and in my opinion using pcap will bring you the proofs you need of whats actually going on in the wire. ... View more

I dont know if the built in dhcpserver of PAN have support for option 252 today. Sounds like you should contact your sales rep with a feature request regarding this. Another method to inform the client of which proxy to use is to send this info through an AD-policy if you use AD for your internal network. ... View more

If your clients have 10.0.0.0/16 and the L3-switch interface towards your PAN have ip 192.168.0.1 (your PAN have 192.168.0.2 at eth1/1 and the subnetmask for this linknet is /30 (255.255.255.252) then your routing in your PAN should be setup as:               <ip>                 <static-route>                   <entry name="ROUTE_CLIENTS">                     <nexthop>                       <ip-address>192.168.0.1</ip-address>                     </nexthop>                     <interface>ethernet1/1</interface>                     <metric>10</metric>                     <destination>10.0.0.0/16</destination>                   </entry>                 </static-route>               </ip> ... View more

Whats the uptime of the unit and which version do you use? I think the commit performance have been increased in 4.1.x so on 5xxx boxes its down to something like 5-10'ish seconds instead of several minutes. ... View more

Unfortunately I havent played around with bandwidth limiting in PAN, just prioritize traffic up/down. Would a workaround for you be to put facebook traffic in the lowest priority group instead? This way the facebook users gets all bandwidth if noone else is using your uplink but as soon someone else is using it the others will have their traffic before the facebook users. The below example is how to get backup-traffic (traffic to/from backupservers placed on a dedicated interface of the PAN) to be put in lowest prio, but should be easily modified to suit your needs to do the same for traffic matching application facebook or similar. In QoS Profile create one with just the classes you need (I think this is not needed if you are happy with the default setup of 8 classes in 4 different priogroups):             <entry name="BACKUP">               <class>                 <entry name="class8">                   <priority>low</priority>                 </entry>               </class>             </entry> Then on the physical interface you define it to use the particular profile, like so (I think this is in the QoS part of the GUI):             <entry name="ethernet1/1">               <regular-traffic>                 <groups>                   <entry name="regular-traffic-group">                     <members>                       <entry name="BACKUP_1_1">                         <match>                           <local-address>                             <address>                               <member>any</member>                             </address>                             <interface>ethernet1/2</interface>                           </local-address>                         </match>                         <qos-profile>BACKUP</qos-profile>                       </entry>                     </members>                   </entry>                 </groups>                 <default-group>                   <qos-profile>default</qos-profile>                 </default-group>               </regular-traffic>               <tunnel-traffic>                 <groups>                   <entry name="tunnel-traffic-group"/>                 </groups>               </tunnel-traffic>               <enabled>yes</enabled>             </entry>             <entry name="ethernet1/2">               <regular-traffic>                 <groups>                   <entry name="regular-traffic-group">                     <members>                       <entry name="BACKUP_1_2">                         <match>                           <local-address>                             <address>                               <member>any</member>                             </address>                           </local-address>                         </match>                         <qos-profile>BACKUP</qos-profile>                       </entry>                     </members>                   </entry>                 </groups>                 <default-group>                   <qos-profile>default</qos-profile>                 </default-group>               </regular-traffic>               <tunnel-traffic>                 <groups>                   <entry name="tunnel-traffic-group"/>                 </groups>               </tunnel-traffic>               <enabled>yes</enabled>             </entry> A note here is that QoS is applied for egress traffic. In order to make the traffic get lowest prio in both directions you need to setup the above rule for both external and internal interface. The above gives that traffic arriving at eth1/1 (uplink) and is designated for eth1/2 (backup) will have the custom QoS-profile (BACKUP instead of default). Traffic arriving at eth1/2 (backup) will use the BACKUP QoS-profile for all traffic. In your case (with mixed traffic) it would probably be best to just use the default QoS-profile. And finally setup a QoS rule for which traffic should be marked to be processed by the QoS:                 <entry name="BACKUP_BACKUP">                   <from>                     <member>any</member>                   </from>                   <to>                     <member>BACKUP</member>                   </to>                   <source>                     <member>any</member>                   </source>                   <destination>                     <member>any</member>                   </destination>                   <source-user>                     <member>any</member>                   </source-user>                   <category>                     <member>any</member>                   </category>                   <application>                     <member>any</member>                   </application>                   <service>                     <member>any</member>                   </service>                   <action>                     <class>8</class>                   </action>                   <description>Traffic to backupservers</description>                   <negate-source>no</negate-source>                   <negate-destination>no</negate-destination>                 </entry>                 <entry name="BACKUP_RESTORE">                   <from>                     <member>BACKUP</member>                   </from>                   <to>                     <member>any</member>                   </to>                   <source>                     <member>any</member>                   </source>                   <destination>                     <member>any</member>                   </destination>                   <source-user>                     <member>any</member>                   </source-user>                   <category>                     <member>any</member>                   </category>                   <application>                     <member>any</member>                   </application>                   <service>                     <member>any</member>                   </service>                   <action>                     <class>8</class>                   </action>                   <description>Traffic from backupservers</description>                   <negate-source>no</negate-source>                   <negate-destination>no</negate-destination>                 </entry> ... View more

Try pressing esc or something instead. I think the maint stuff was somewhat changed in 4.x (or if its just for the 5xxx boxes) so you get a grub boot menu when you want to go into maint-mode from where you can select which partition to boot (I think there is one maint-partition on every disk). The password for maint mode is then "M4INT" or something like that before you can do the scrub of the harddrives. ... View more