About NickThen

I'm quite disappointed in Palo Alto's approch to not make 9.0 supported on the 5000 (i.e 5020, 5060, etc.)  For a customer that purchased their equipment right before th 5200s came out it seems we (and probably many others) were screwed over on this deal.  Palo's approch when I discussed this was "you'll have to upgrade."  Ya that's all fine and good if you want to fork out another $250K for a pair fully licensed.  As an enterprise customer I would hope to get 5 years out of them but that dones't look to be possible IF we need some of the featuers in 9.  Now I'll admit that we wouldn't go to it until at least 9.0.6 or .7 so maybe a year out but that still is less than what we're hoping to get out of them.  I can see maybe not doing this on a 200 or 3000 but the 5000 should have more than enough power to handle it.  Just a major downer by PAN on this one. ... View more

I thought I would reach out and see if the team at Palo Alto or the user community could shed some light on this one.  We are experiencing a phishing attack on random workstations (luckily only 5 at the moment) hyjacking Outlook to send out Document Download links to people in an address book.  We have not yet discovered the payload or how it is getting into the building, but in our research it appears to destroy itself upon completion but leaves behind many Outlook rules.  These look at typical responses such as "how do I open the document."  It will then send a response back to the end user stating to click on the link and enter your email credentials.  Users are falling for it thinking it is from the legit person.  We have written custom signatures to stop the HTML pages to harvest the credentials, but curious if others have seen this?  I have attached some screenshots of what is sent and users see.  Thanks in advance for any help!       ... View more

Does anyone have any best practives on how to configure Multi-Domain authentication with Global Protect?  I see how to map/sync groups in multiple domains in my forest, but not entirely sure the process for the Global Protect end.  Right now I am using Kerberos and the realm in one domain.  Obviously this won't work in the other.  Do I do something with authentication profiles and the order that they are processed or something different?  Has anyone had experience with this getting it setup? ... View more