About _slv_

another example How to Configure U-Turn NAT ... View more

Hello DMZ is a very good idea for servers. Configuration what You need isn't so complicated and I hope that this community will help You to create them. Please read Understanding PAN-OS NAT especially U-turn NAT is for You ( for traffic from Your LAN to DMZ) - this is a stranges part for peoples from ie. Juniper world. With regards SLawek ... View more

Hello In my opinion password changing for local users  it's possible only by API How to update the local-user-database user password and additional web based system that You have to build. According to my knowelage there is no such options (1 and 2) at the moment, You can talk with Your SE. Maybe You have ActiveDirectory or any other LDAP/Radius system and by this way You can solve Your problem. Regards Slawek ... View more

In my opinion it's possible only by API How to update the local-user-database user password and additional web based system that You have to build. Regards Slawek ... View more

Microsoft made a patch for XP http://blogs.technet.com/b/microsoft_blog/archive/2014/05/01/updating-internet-explorer-and-driving-security.aspx for this 0-day! ... View more

Update is ready to dwonload! ... View more

Hello You have timout for WMI/NetBIOS 45 min and User ID timeout 15 minuts, What is Your DHCP lease time? Please try to clear mapping for one test user and authenticate it again and try to verisy after 15 and 45 minuts when it loose internet access. Please read this doc (regardijng troubleshooting) Architecting User Identification Deployments https://live.paloaltonetworks.com/docs/DOC-5662 Please also verify that it is configured correctly. Below are few good docs on User id https://live.paloaltonetworks.com/docs/DOC-3664 https://live.paloaltonetworks.com/docs/DOC-3120 https://live.paloaltonetworks.com/docs/DOC-1920 Hope this helps you resolve the issue. Regards SLawek ... View more

Take a look into date of released late 5.0.x versions. Early version started to lunch every months - now they need two months for versions. Maybe this will give us better product. I switched to 6.0.2 this weekend, One issue was with FreeRadius. After I upgraded to 6.0.2 Captive Portal stopped authorising users. I had to restart radius process. Until now 6.0.2 seems to be a "good version". I still have app-override for VoIP, maybe this week I will try to disable app-override and test my VoIP connections. Accrding to support engineer 6.x PAN should properly wor with VoIP (problems discussed Re: VoIP Traffic, strange behavior, need help to understand please.). Regards Slawek ... View more

Recently published 6.0.2 has huge list of fixes, I don't know is Your problem on this list but i could help You in this and other problem. 6.0.0 isn't a good version IMHO. Regards SLawek ... View more

Problem reported to support, I will let You know if we made any progress. Could someone verify using other NGF than PA and endpoint protetection than Symantec that this site try to hurt your computer and post small report of tests? Regards Slawek ... View more

Do You think that is a time to upgrade from 5.0.11 to 6.0.2? Is all reported to community bugs fixed in 6.0.2? Regards Slawek ... View more

Hi Hitsec Thank for clarification, but the clue is that PA refued to change classification to malware sites. ... View more

Hi Gafrol In my opinion I have all this 9 CVE covered. Security policy has: And "strict" thread  prevention profile is a default one: I try today to open "bourgelat.net" and again only SEP blocked this traffic. admin@PA-200> show session all filter source 192.168.1.35 destination 91.121.93.111 -------------------------------------------------------------------------------- ID      Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port]) Vsys                                      Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 19100   web-browsing   ACTIVE  FLOW  NS   192.168.1.35[52183]/Lan_A/6  (x.x.x.x[52427]) vsys1                                     91.121.93.111[80]/untrust  (91.121.93.111[80]) 39182   web-browsing   ACTIVE  FLOW  NS   192.168.1.35[52188]/Lan_A/6  (x.x.x.x[35161]) vsys1                                     91.121.93.111[80]/untrust  (91.121.93.111[80]) 34969   web-browsing   ACTIVE  FLOW  NS   192.168.1.35[52196]/Lan_A/6  (x.x.x.x[16722]) vsys1                                     91.121.93.111[80]/untrust  (91.121.93.111[80]) 56342   web-browsing   ACTIVE  FLOW  NS   192.168.1.35[52193]/Lan_A/6  (x.x.x.x[18863]) vsys1                                     91.121.93.111[80]/untrust  (91.121.93.111[80]) admin@PA-200> show session id 19100 Session           19100         c2s flow:                 source:      192.168.1.35 [Lan_A]                 dst:         91.121.93.111                 proto:       6                 sport:       52183           dport:      80                 state:       ACTIVE          type:       FLOW                 src user:    contoso\slawek                 dst user:    unknown                 qos node:    ethernet1/1, qos member N/A Qid 0         s2c flow:                 source:      91.121.93.111 [untrust]                 dst:         x.x.x.x                 proto:       6                 sport:       80              dport:      52427                 state:       ACTIVE          type:       FLOW                 src user:    unknown                 dst user:    contoso\slawek                 qos node:    ethernet1/4.1, qos member N/A Qid 0         start time                    : Wed Apr 23 14:11:42 2014         timeout                       : 60 sec         time to live                  : 10 sec         total byte count(c2s)         : 621         total byte count(s2c)         : 66         layer7 packet count(c2s)      : 5         layer7 packet count(s2c)      : 1         vsys                          : vsys1         application                   : web-browsing         rule                          : Lan_A NAT - monitoring         session to be logged at end   : True         session in session ager       : True         session synced from HA peer   : False         address/port translation      : source + destination         nat-rule                      : NAT_Lan_A(vsys1)         layer7 processing             : enabled         URL filtering enabled         : True         URL category                  : malware-sites         session via syn-cookies       : False         session terminated on host    : False         session traverses tunnel      : False         captive portal session        : False         ingress interface             : ethernet1/4.1         egress interface              : ethernet1/1         session QoS rule              : N/A (class 4) In monitor tab using filter "( threatid eq 34271) or ( threatid eq 34271) or ( threatid eq 33287) or ( threatid eq 33006) or ( threatid eq 32959) or ( threatid eq 32804) or ( threatid eq 32784) or ( threatid eq 32764) or ( threatid eq 32763)" I see nothing in thread logs. What is wrong with my configuration? Regards Slawek ... View more