About mikand

You mean having the PAN acting as a DHCP-server for your clients? ... View more

You will need a 2.5: Connect zone to (physical or logical) interface. And personally I would apply a protection profile even for the wireless users 🙂 ... View more

Cant one setup a SNMP trap to be sent when either side of a vwire goes down? ... View more

Sounds like a good reason to open a supportcase for this 🙂 I have been behind a 3.x device and there both http and https block/continuepages works so it seems like a bug introduced in 4.x or something that (or in combination with updated appid-db). ... View more

There are some docs in the devcenter if im not mistaken, otherwise this should be already described in the administrator manual which you find if you click on Technical Documentation at https://support.paloaltonetworks.com ... View more

Sounds like you should contact support regarding feature request. Since the PAN is acting SSL-proxy (when you do SSL-termination) it should be possible for it to insert the block/continuepage in the current SSL stream instead of forcing the client to redirect into some ip-address. At least this would look better at the clientside and you as admin wont need to expose the PAN itself for the client. ... View more

The problem here is that you need additional switches between your routers and your PANs for that to work out of the blue - specially for the case when the passive unit in HSRP is completely offline. When HSRP is enabled and both HSRP units works the passive unit will act as a L2-device and just forward the traffic to the current active unit who is the L3-device (if you also setup the vlans on the link between R1 and R2). So far so good... Your PAN2(active) will reach R1(active) through R2(passive) if you have connected them as PAN1 <-> R1, PAN2 <-> R2. However if R2 gets a hardware malfunction so its completely offline (and your PAN1 for some reason also failed) you will have a setup where PAN2(active) cannot reach R1(active). If im not mistaken you can setup the interfaces of your PAN so PAN1 have one cable to R1 and one to R2 but its the same network (PAN1 have just one ip who the R(1and2) will route to for networks behind the PAN). Unless there is some other method for this I think you can do this by setting the PAN interface into L2 mode and then in PAN setup a shared gateway which you bind to the two L2 interfaces. The shared gateway will be the ip which the routers will route to (and the same for the PAN itself, the shared gateway will then route to the ip of R and HSRP will take care of which of R1 and R2 will announce the ip). ... View more

You can also do the same if you tap the traffic (using span-port) before and after the PAN and then check the generated PCAP in wireshark or tcpdump. ... View more

Should be possible if you send in this as a request to the appid-team. Otherwise I think you can do this yourself with a custom url-category. My opinion regarding pr0nsites and blocking is that this is the bad method to handle the problem. Inform and educate the users what you as an organisation except from them (like that the rest of the world will see that someone from your place is browsing these sites, at least the siteowners) - for example through policies. And then use continue page (and inform on that page the current policy or such) instead of blockpage so if the urlcategory brings you a false positive the client can still bypass the "block". This way you will also avoid the trashtalk regarding "censorship" (since the continuepage informs the client that this is a page which is violating current policy etc so its not censorship but rather help the client to make a good decision (there can be reasons for why someone visits a specific site)). Also whats placed in the category "adult-and-pornography" is up to the one who maintains the urlcategory database (currently brightcloud) which means that stuff like the frontpage of www.playboy.com belongs to this category. However you will see more nudity at www.youtube.com than what playboy shows on their frontpage (I guess you get the nuditypart once you login). Edit: http://www.paloaltonetworks.com/researchcenter/tools/ and click on "Submit an App" so get in contact with the appid-team. ... View more

Yes but the point here is that this updateserver suddently cannot do just symantec-update, it will also be able to do ftp to all the world (unless you create custom url category to restrict it to a specific domain/host but this wont work for ftp traffic I guess so you are back to square 1). And this gives that the whole idea of using a NGFW aka applicationfirewall suddently gets broken since this "limit to a specific application" isnt really true... For me its more logical to only allow "symantec-update" and nothing more. The need for "ftp" as appid should be (in my opinion) handled by the "symantec-update" itself. Lets say that the ftp session is always right after the updateserver communicate with someurl:someport and some payload (dunno whats the signature for the "symantec-update"). This brings that the "symantec-update" could allow the ftp but only after that initial http stream to the liveupdate servers. As it is today the updateserver will be able to do more than just symantec updates... because the rules setup with appid are OR-based and not AND-based. I mean if I setup a security rule that allows symantec-update and ftp, this rule will allow my host to do ftp on its own to any ftp-server (and not limit the ftp sessions to only those related to update against a symantec liveupdate server)? ... View more

The proper way is to obviously fix this in the webserver itself. If you run apache on it you can use ServerName in cooperation with ServerAlias to do this. Lets say your server is supposed to handle http://www.company.com (and http://company.com) but now it must, for the very same files and all that, also listen to http://www.anothercompany.com (and http://anothercompany.com). You can either setup this up as two different virtualhosts, OR by using the ServerName/ServerAlias like so: ServerName www.company.com ServerAlias company.com www.anothercompany.com anothercompany.com And if the above isnt possible then setup a reverse proxy in front of your webserver(s) which will do the same. Doing this in the firewall is just... wrong... IMHO ... View more

You could send it in as a new/change app request. In theory it should work but it depends on how the protocol is constructed. ... View more

Yes there are some cli commands to restart various mgmt-plane services, I dont remember them all but they are available in the manual. A quick and dirty way to do the same without cli is to click on "restart mgmtplane" in the device tab (I think its hidden there). You will miss some logs while the mgmtplane is "rebooting" but the dataplane (which is separate from the mgmtplane) will continue to process packets. ... View more

Unfortunately this forum is more of a "customers helping customers" with some PaloAlto dudes (and dudettes 😉 showing up every now and then. For a real or urgent problem you are adviced to contact your sales rep / sales engineer to setup a proper support case. Dunno why it is this way, would save some time if forum threads could be automagically taken care of by the support dudes/dudettes aswell... ... View more

You can look at the color of the interface in the GUI ? 😉 I guess you mean methods to find out in the logs that a interface is flaping or such? ... View more