About ITSama

I opened a support-ticket. It seems to be a bug in PAN OS 7.0.1.   Waiting for answer from support. ... View more

Hello Hulk, after fruther investigation, I opened a ticket. The answer from the support is that that jar-file includes 2 windows dll-files, which are categorized as PE-Files :smileylaugh:. Thx ... View more

Hi hshah, the URL is www.dhl-geschaeftskundenportal.de. I checked it now with a Firefox portable and it works with it, however now i found out that it also works on some other Clients with IE? Regards ... View more

Hello Hulk, thx for the "Exclude-List", that's good to know, but can you explain me how I can exclude a special application from the decryption-policy? I know how to exclude IP or URL categories, but not applications? Regards ... View more

Hi sjamaluddin, I didn't use the ID-agent, I use the internal agent on the paloalto, so I don't know where to look for the ignore-list, if it's possible, but now I understand the problem. Really good explanation . ... View more

Hi hshah, I know that, the problem is that i doesn't become a "user to IP mapping". For example, if i logon on a domaincontroller with the domain administrator, i will get the captive portal. If i logon with a user which is a member of the domain administators group, i become a "user to IP mapping". And what i find really strange is that on some servers/clients it isn't a problem with the domain-admin account. I use for "server monitoring" (domaincontroller, eventtracking) the domain-admin-account, should I use a special account for that? Regards ... View more

hi again, okay i will test the OCSP with the new PAN-OS Version soon, but now I have another problem with the selfsigned certificate for the untrusted Certificates, because I get many certificate errors because the most intermediate CA's are not in the default trusted certificate list on the PA. So what is the best way to solve the problem. It seems to be a little bit difficult to import all possible certificates for the Sub-CA's?? ... View more

Okay :smileygrin:.  I have tested it and it looks good with the untrusted certificates. And for the "security feature" in FF, i will look for a workaround . But I have one more question: Do you mean it's useful to work with OCSP-Responder or CRL-Lists? Any Ideas or best practice, because there are different meanings about that? ... View more

"Do not use a trusted certificate with the option "forward trusted certificate". Sorry I didn't really understand. You mean "Do not use a trusted certificate with the option "forward untrusted certificate"? ... View more

Hi Hithead, i had only one certificate for all purposes signed as a Subordinate-CA from my Organisation-CA???  IE has no problems with that, only FF. ... View more