About mikand

Cant you do it with 2 different VSYS? Like so: --- VSYS1 ( VWIRE1 ( eth1/1 - eth1/2 ) )  --- VSYS2 ( VWIRE2 ( eth1/3 - eth1/4 ) ) --- --- = physical cable This way a cable goes into eth1/1, then another cable connects eth1/2 with eth1/3 and finally a third cable goes from eth1/4. The drawback is of course that you will only have roughly half the number of concurrent sessions (because a single session will eat one entry in VSYS1 and a second entry in VSYS2). ... View more

Would be nice if those numbers could be posted online 🙂 Specially the case between appid override which disables everything vs "appid:any" which should be equal (at least securitywise). I think Network World got slightly lower throughput when they tried to "disable everything" and one of the theories back then was that a disable added one (or more) cpu-cycles within the PA which would end up with 1%'ish lower throughput. That is the PA will do AppID no matter what, when you disable/ignore the result from the AppID it will take one (or more) additional cpu/fpga/asic cycles to ignore the result. ... View more

Will this workaround survive a Panorama update? ... View more

Perhaps you should buy the M100 box and then dont have to think about if its aligned or not 😉 On the other hand hopefully the QA testings will be worth waiting for (given the history for previous oopsies regarding QA and PaloAlto). ... View more

Sounds more like a not so smart reuse 🙂 Next time you run into these CP guys you can ask them on how well their userid function works (or for that matter how many mbit/s you have left in throughput when you enable all IPS signatures 😉 Are there any differents in the resuse of ports for NFS regarding TCP vs UDP? Or for that matter hardmount vs softmount and such? ... View more

I can understand that cool features might be under NDA until publically announced... but I fail to see why aligned vmware-image would fall into the NDA traphole? ... View more

I think it should be an easy task for the sales to transfer the licenses for you. I mean, how hard can it be for paloalto to run an UPDATE against the sql database holding the license stuff at paloaltos end? :smileysilly: ... View more

I guess using CEF is the way to go if you want logs from your PA into your ArcSight. You could of course create some flexconnector parser (I think its called) but you would need to do this manually and I dont know how this would handle any whitespace characters (not to mention that you need to verify this for each major version of PA). But sure using a more "raw" format of the logging would save quote a few bytes compared to the CEF format. With CEF you have an estimated overhead of 604 bytes per logmessage which is then thrown away by the logcollector. That is approx 48.32Mbit/s of unecessary stuff on the network link at a rate of 10.000 msgs/sec. Would be nice if PA could create an official parser lib for the flexconnector (or whatever its called) which is then maintained and tested for various major versions. ... View more

In this particular case, why not configure the route towards the PA instead? Or if this isnt possible perhaps settings up a tagged vlan if you dont want to fix (static) routing in your core? ... View more

Which PANOS are you running? Because even if 5.x is supposed to somewhat fix the dependency hell (inspired by the Microsoft dll hell? 😉 it seems that not all dependencies are being taken care of by the 5.x release. Another issue with this "magic" auto dependency in the background is for how many packets should it allow traffic before the auto depedent appid is being blocked? For example smtp for the case of gmail should only be valid if the domain is .google.com (and whatever other domains google uses nowadays). It would be really bad if the auto depedency suddently, silently, allows any smtp to the rest of the world while you as an admin think you have only allowed gmail as appid... (sure, a workaround might be to add custom urldb that only allows this rule if the http host request matches but still). ... View more

If I recall it correctly this has been around for many years. That is you must read the manual and manually configure stuff before response pages will show up. I dunno of the reason for this (other than forcing customers to read the manual :smileysilly:), perhaps your SE could return to you with a better explanation and if you get such please update this thread aswell ... View more

Thanks for the updates on this issue! ... View more

What about creating a group policy which prohibts locally logged in user(s) to reach the network/internet? Other than that I think you would need to use the regular userid to get a log of regular DC logins. Sounds something you should contact the support with and then get back to this thread with the result ... View more

And both devices are configured equally? Because when there is no ssl termination activated the PA device can only see the CN (Common Name) part of the cert being used which in googles case is *.google.com (since when there is no ssl termination enabled the PA cannot see inside the ssl tunnel which it otherwise would to see which hostname is actually being requested by the client). Since *.google.com (from the CN part of the cert) is everything PA knows (except src/dst ip/port) it will log this and this will then show up in your activity log. But I can agree - if this is the case it would be nice if the PA device somehow (by color or something?) could notify the user that this info is taken from the cert and not the actual http header. ... View more

Didnt there exist a way to create a subinterface within the VWIRE setup to accomplish the same effect without burning a third physical interface? ... View more