About LCMember1959

LCMember1959 · ‎10-27-2016

After talking to TAC we found that it was indeed DNS queries from BYOD clients using Sophos Live Protection. I guess we could use some kind of application override to force this traffic to be identified as DNS, but instead we will just block sophos-live-protection.

LCMember1959 · ‎10-26-2016

Our Panorama server uses a volume on iSCSI storage (Dell Equallogic) with SAS disks. Everything else on the same storage solution works very fast, so I don't think that it's a bottleneck.

LCMember1959 · ‎10-26-2016

Thanks for the feedback. I see this problem in DNS queries from our domain controllers to the DNS servers of our ISP, and neither we nor our ISP use Sophos in any way, shape or form. So I will open a TAC case on this.

LCMember1959 · ‎10-26-2016

Some of this traffic is coming from our domain controllers (to external DNS servers), and they have no Sophos installed. To my knowledge we don't use any Sophos software whatsoever in our network.

LCMember1959 · ‎10-26-2016

Some DNS traffic is classified as sophos-live-protection in our traffic logs. Has anyone else seen this? I only have logs 5 days back in time, so I cannot say when this started but it wasn't with the latest apps update. Our firewall is PA-5050 running PAN-OS 6.1.14.

LCMember1959 · ‎10-26-2016

According to our traffic logs a lot of traffic is denied during a period of 15-20 seconds every time we update applications and threats on our PA-5050. Is this normal? This is all kinds of traffic like mssql-db, web-browsing, ms-sms etc.

LCMember1959 · ‎10-24-2016

We started using Panorama a few months ago, and I see the same thing when searching through traffic logs for older entries. We use VMware and the host running Panorama has 4 vCPUs and 4 GB memory. Panorama version is 7.1.4-h2

LCMember1959 · ‎10-10-2016

Device priority on the firewall in our main data center is set to 100 and the other is set to 111. Preemption is enabled. I am guessing when the passive partner booted up without network connectivity and no longer suspended it assumed that the active partner was down and made itself active. Then the interfaces were connected and we got a split brain scenario.

LCMember1959 · ‎10-10-2016

We are in the process of setting up HA between two PA-5050 running PANOS 6.1.14. After configuring everything and testing failover in our main data center we performed "Suspend local device" on the passive node and shut it down to move it to our secondary site. After it was moved there and powered on we started to connect the various interfaces. This caused a major outage in our network, and when I connected to the console port on the (presumed) suspended firewall I saw that it had gone active. Is this a bug in PAN-OS, or did we miss a step somewhere?

LCMember1959 · ‎10-04-2016

Have you tried the same rule, but with Any/Any as application and service? If Skype still does not work then I would suspect that it might be a client problem.

LCMember1959 · ‎09-29-2016

There is a setting under Setup -> Management -> Logging and Reporting Settings -> Log Export and Reporting called "Enable Log on High DP Load". Select this check box if you would like a system log entry generated when the packet processing load on the firewall is at 100% CPU utilization. Disabled by default. Is that what you were thinking of? I don't know of any way you can disable logging under high DP load, but at least this will alert you in case you don't have any other monitoring of your firewall..

LCMember1959 · ‎08-10-2016

End of August Palo Alto will introduce a new URL Category: "Extremism" Websites promoting terrorism, racism, fascism or other extremist views discriminating people or groups of different ethnic backgrounds, religions or other beliefs. The default policy action for this category is "Block" Would this cover your needs?

LCMember1959 · ‎06-20-2016

You can also use tools like Cacti to pull numbers from your firewall using SNMP. That way you can see trending over time.

LCMember1959 · ‎06-09-2016

Has this been changed in recent versions? We are running 6.1.10 and have the block option in our antivirus profile.

LCMember1959 · ‎02-29-2016

Support now confirms that this is a software bug and PA are working on a fix to be relased in a future version. The bug affects both PA firewalls and Panorama.

Member Since	‎12-03-2013 01:22 AM
Date Last Visited	‎11-13-2019 01:01 AM
Posts	20
Total Likes Received	5

Online Status	Offline
Date Last Visited	‎11-13-2019 01:01 AM

About LCMember1959

Re: DNS traffic identified as sophos-live-protection

Re: Panorama VM - looking up older logs takes a long time

Re: DNS traffic identified as sophos-live-protection

Re: DNS traffic identified as sophos-live-protection

DNS traffic identified as sophos-live-protection

15-20 seconds of denied traffic when applications and threats are updated

Re: Panorama VM - looking up older logs takes a long time

Re: Suspended HA partner becomes active

Suspended HA partner becomes active

Re: Skype is not working with allow rule

Re: DNS traffic identified as sophos-live-protection

Re: Suspended HA partner becomes active

Re: Turn off logging when high load on data plane

Re: Cannot download PAN-OS version due to bissexstile year. Value error: day is out of range for mon

Re: Cannot download PAN-OS version due to bissexstile year. Value error: day is out of range for mon

Whats PAN's future for TLS decrypt with many sites now moving to Diffie-Hellman based ciphers ONLY?

Re: DNS traffic identified as sophos-live-protection

Re: Panorama VM - looking up older logs takes a long time

Re: DNS traffic identified as sophos-live-protection

Re: DNS traffic identified as sophos-live-protection

DNS traffic identified as sophos-live-protection

15-20 seconds of denied traffic when applications and threats are updated

Re: Panorama VM - looking up older logs takes a long time

Re: Suspended HA partner becomes active

Suspended HA partner becomes active

Re: Skype is not working with allow rule

Re: Turn off logging when high load on data plane

Re: How to request new URL Category

Re: How to view the peak number of concurrent sessions?

Re: Anti-virus Block Option Not Available

Re: Cannot download PAN-OS version due to bissexstile year. Value error: day is out of range for mon

Unlock your full community experience!

About LCMember1959