About emr_1

emr_1 · ‎02-03-2015

A couple of my customers hit similar issue. Does your firewall run over 388 days? There is one fixed issue which is bug#64166. (you can find it in 5.0.14 RN or 6.0.4 RN.

emr_1 · ‎01-15-2015

minecraft is already developed. For Halo, I think you can request it for developing new app-id. Please refer to following doc for how-to: How to Request a new App-ID

emr_1 · ‎11-12-2014

Hello PAN team, When do you update this page? End-of-Life Summary I want to know EoS for 6.1.

emr_1 · ‎07-31-2014

From my understanding, there is no way to figure out that traffic was blocked by antivirus signature or wildfire signature from threat log (especially "type" field. this will be 'virus' in both case). Though I think you can figure out by looking at threat ID. Please refer to following KB: Threat ID Ranges in the Palo Alto Networks Content Database For example, if you hit any virus with TID is between 2000000 - 3000000, then this might be hit to antivirus signature. But if it is between 3000000 - 3100000, then this might be wildfire signature. Isn't it?

emr_1 · ‎07-28-2014

This is good information, though how about agent side? I could find the statement you described in PAN-OS 6.0.3 Release Note. BUT I could not find anything related to Windows Server 2012 in UIA 6.0.2 Release Note. Does it mean PAN-OS side is ready, but agent side is not and have to wait new UIA? Regards,

emr_1 · ‎07-24-2014

Hi HULK and slv, FYI: I found following doc: Which App ID's Require Decryption? This includes facebook and other features related to facebook (w/o facebook-base) On the other hand, I tested with my PA-5020 which does not have decrypt rule, and confirmed that I can see 'facebook-base' without decryption. Regards,

emr_1 · ‎07-22-2014

I believe there is no way to configure disabling ICMP type 13 and 14. How about configuring security policy which applies to 'from Trust to Trust' if you want to block it on Trust I/F? I'm not sure it works or not, just guessing.

emr_1 · ‎07-17-2014

Hello You can create custom signature based on icmp type. Please refer to the following KB Security Policy to Allow/Deny a Certain ICMP Type Regards,

emr_1 · ‎07-01-2014

I believe the answer to your question is here: Technical Details Regarding PPPoE Support Failover Passive device will take over the PPPoE connection from Active device when failover happens There is no need to re-connect PPPoE at Passive device when failover happens

emr_1 · ‎06-25-2014

#1 How is dataplane load going? You can check by 'show running resource-monitor' If it looks high average or 100% in max, it might stops traffic via HA1 port. To avoid this situation, you can enable heartbeat backup. #2 You can check if some kind of process was restarted. 'show system files' shows you core-dump if generated. If you can find any output, then you can export it, open the case, then TAC will investigate it.

emr_1 · ‎06-17-2014

Sounds you were previously using 5.0 or above. If correct, PA supports SSL Decryption profile from 5.0 as new feature. In the process of downgrade PANOS, PA does not automatically convert configuration file for 4.1, so you need to delete new schema manually. To delete them, you first need to export current config, delete it, then import and load new one. I think you can find following part in your config file (xml file) <profiles> <decryption/> </profiles> Regards, Emr

emr_1 · ‎09-04-2013

Thanks for your reply. I tested two more cases. One is completely denying my dos traffic by security policy and see how it goes. The result was 100% CPU usage. Another is allowing dos policy, but configured resource limit by 10. It also reached to 100% CPU usage. If your reply is correct, let say...for example: if PaloAlto device place in front of web bank system and if I attack this web site, paloalto device would protect my attack by dos or zone protection, but CPU will reaches to 100%. As a result, the web bank system will be protected, but nobody will be able to use the bank system until CPU goes down. I think this is not good solution for dos protection. Don't you think? Regards,

emr_1 · ‎09-04-2013

Hi guys, I have question related to both Zone and DoS Protection features. I'm testing with PA-200 and PA-2050 by using following DoS tool. LOIC | Free Security & Utilities software downloads at SourceForge.net I'm configuring this tool to generate lots of UDP packets in short time and see how CPU usage of dataplane goes. I could find that CPU easily reaches 100% (I can confirm with 'show running resource-monitor second') and even Protection is working it still keeps 100% usage. And also, my other traffics which should not affected by protection could not reaches to internet websites via PaloAlto until I stop the DoS tool and CPU goes down. My thought is this is because detecting packets and dropping packets are handling on Security Processor. If I'm correct, how can I decrease usage of CPU and keep dropping high rate packets, and make successful transaction for other traffics? If I can't get good solution on PA-2000 and lower model, can I get better result if I use PA-3000 or PA-5000 series? Regards,

emr_1 · ‎08-22-2013

If you are talking about detail URL logs in UAR, there is max rows. You can find this value under device tab > setup > management tab > Logging and Report Settings. *NOTE: I should say panorama tab, this issue was on panorama. The default value for Max Rows in User Activity Report is 65535. Can you check that your report with 30 days hits to 65535 lines? Regards,

emr_1 · ‎08-22-2013

Well, it looks like your PaloAlto device places between client PC and proxy server. I'm not using proxy. This might causes different result.

Member Since	‎05-10-2010 06:49 PM
Date Last Visited	‎04-18-2024 10:42 PM
Posts	307
Total Likes Received	98

Online Status	Online
Date Last Visited	‎04-18-2024 10:42 PM

About emr_1

Re: TID 95187 is not on my signature list

TID 95187 is not on my signature list

Re: cytray.exe "bad image" errors following Agent update

Re: Panopto Still Available ?

Re: Panopto Still Available ?

Re: tshoot firewall

Re: cytray.exe "bad image" errors following Agent update

Re: Looking for Manufacturer Part Number Information

Looking for Manufacturer Part Number Information

Re: cytray.exe "bad image" errors following Agent update

TID 95187 is not on my signature list

Re: TID 95187 is not on my signature list

Re: Global Protect

Re: cytray.exe "bad image" errors following Agent update

Re: Upgrade PAN OS from 10.1 to 11.1

Re: TID 95187 is not on my signature list

Re: what does "SWITCH" in hardware architecture mean?

Re: any solution to keep tracking user IP mapping?

Re: any solution to keep tracking user IP mapping?

Re: [need help]can't see new incoming logs after upgrading M-100 into 8.1.12

Nominated Discussion: What does "SWITCH" in hardware architecture mean?

Nominated Discussion: How to Change Forward Decrypt Trust Certificate

Re: source user showing as unknown in traffic monitor

Re: Internet Games

EoS for PANOS 6.1

Re: Antivirus profile question, wildfire action?

Re: When new version of User-ID agent will release to support on Active Directory 2012 version ?

Re: App blocking

Re: ICMP Timestamps

Re: ICMP Timestamps

Re: PPPoE in A/P configuration

Re: High Availability weirdness

Re: invalid configuration. Schema verification failed. profiles -> decryption unexpected here.

Re: Looking for best way for using DoS protection

Looking for best way for using DoS protection

Re: User activity reports

Re: Skype false positive

Nebula Beta

Unlock your full community experience!

About emr_1