About emr_1

You can use Threat ID instead. If you click threat Name, you can see threat detail. This window contain threat ID. You can use this as follow: (threatid eq xxxxx) Regards, ... View more

Hi, Usually, PA uses own MGT port as a source port. Are you connecting MGT port to your network and is it reachable from MGT to Win2003? My PA-200 with 5.0.4 is working fine for Dynamic Block List. Regards, Emr ... View more

I think this only works with URL filtering log. Are you trying to parse in traffic log? Regards, ... View more

You can choose profile even you run 4.1 The following doc might help you. How to Tune IPS in PAN-OS 4.1 This also might help you. Regards, Emr ... View more

Hi Phil, Sounds PANOS 5.0 would be nice for you. The detail of threat log looks as below on 5.0.4. You can select profile and also you can use Exempt IP address (this is new from 5.0) Regards, Emr ... View more

Hello, Continue action only works with browser-based traffic, and some of the traffic does not allow you to click continue button. Hence you have to make either : (1)new security rule with forward only action just for the traffics you can't use continue-and-forward (2)just change current fileblocking profile with action 'forward' Regards, ... View more

The following logs are output of debug related to the operation which read-only superuser is trying to view the report. (NOTE: this is in v5.0.3) <request cmd="op" complete="/operations/download/report/predefined/scope/entry[@name='shared']/report-name/entry[@name='top-url-categories']/file-name" cookie="0890887635970713"/> <response status="error"><msg><line>Not authorized for scope shared</line></msg></response> It looks like you have no permission. Because you can't select read-only rights in admin role editor for each report, I might able to guess two thoughts. One is that this result is expected behavior and better result should be not showing report name as 'disable' rights does, another is a bug. For workaround, I agree with jfitz-gerald, you should use admin role with 'enable' rights for reports. Regards, ... View more

Hi, You can edit File Blocking Profile under Objects tab, it's not AV or AS profiles. You can specify application to apply File Blocking in Profile. OR You can completely separate security rule that currently blocking exchange server traffic. New security rule is just for mail traffic with no File Blocking Profile on it. Regards, ... View more

If you permit to save it and client users are able to save their ID/PW, it will be save in client device. You can decide it under Network tab > Global Protect Portal > <config name> > Agent tab > Use can save password. This configuration is enabled by default. Regards, ... View more

Hi, 'forward' actually does not forwarding anything and allows traffic. Following flow chart might help your understanding. Additionally, if you see 'wildfire-upload-success' or 'wildfire-upload-skip', the device upload files and the traffic will be passed. After retrieving wildfire signature, you can block same file by configuring as 'block' in antivirus profile. Regards, ... View more

Hi, I see same result as you saw. I tried 'neq', 'ne', '!=', '<>', though nothing worked. From the output of GUI debug, I guess GUI does not have criteria for negate query. Here is an example: <request cmd="op" cookie="3832618156237601" target-vsys="vsys1">   <operations xml="yes">     <deep-search>       <address>(from/member neq 'L3-Trust1')</address>     </deep-search>   </operations> </request> <response status="error" code="17"><msg><line><![CDATA[deep-search -> address Invalid input]]></line></msg></response> Regards, ... View more