About BPry

santonic, There is actually quite a few threat signatures that trigger based on packet header information ... View more

Non of the threat id's *require* that your traffic is decrypted, if it detects the signature then it will trigger. If it can't detect the signature because of the encryption then it will not trigger.  ... View more

Is this a web applicaion and do you use SSL decyrption? If you are not using SSL decyption and are attempting to block two app-ids it's pretty common for this to not actually work.  ... View more

Out of curiosity do you actually have a captive portal profile built out? ... View more

You would have to have a specific rule that is associated with a File Blocking profile, simply build a rule above that one without your File Blocking profile assigned and then it will work perfectly fine.    ... View more

It really sounds like you just don't have something configured properly on the AD side of things. Have you modified the properties on CIMV2 in WIM, have you actually enabled User Identification on the actual zone (this would explain why your accounts listed can't be used)? If you run show user ip-user-mapping all do you actually get anything listed or does nothing show up? You could verify well have multiple issues here that are masquerading as one  ... View more

Generally speaking you would want to include the user domain in your Server Profile, it looks like you would have zearthlink. Try giving that a shot and see if it gives you options to your user list; it may also be a good idea to verify that you actually have the right permissions setup, PAs require more permissions then most server admins would feel is necessary so often times I see them not actually have every permission that they need.  ... View more

This would be more of an issue with Word than your PA.    Go to HKEY_CURRENT_USER\Software\Microsoft\Office\*\Word\Options (* is whatever version you are using)   create a new DWORD value called "UseTimeoutForAttachedTemplateLoad"   Give it a value of "1"  (The value is milliseconds, so set it accordingly. If you have users that actually do open the VPN I would give it something like 3000 to actually give it 3 seconds to respond)    Exit Regedit and probably restart just to be sure and give it a go.   You probably can't do this on clients machines, but without a timeout set it really doesn't matter if your PA sends a reset packet to the other end, as Word wont be "listening" for one for lack of a better term.  ... View more

The only time that I would actually use LSVPN is if I'm going to be depoloying a steady stream of firewalls that need to connect back to the main office, for example if you provide a dedicated firewall for a PCI network that connects back to your HQ and constantly have to set these up and deploy them. Other than that if you are in an enviroment where you are not constantly adding clients and your number of offices is fairly static I wouldn't really worry about it. For the type of enviroment that you have deployed I would simply run IPSEC between all your sites and get down and dirty with your route table. This is easier done with Panorama and might be a good time to get it approved by management if you do not already have it. It would be easy enough to maintian it without Panorama though as well.  ... View more

What does the userid logs look like? Is there any entries for a connection time-out or any other connection error?    ... View more

I imagine that you are primarly looking to keep the 5512 for AnyConnect correct? If I already had a PA-500 the only thing that I would really want to keep the 5512 in place for is AnyConnect if I was bringing in the 500, but I also hate GlobalProtect's user interface so I'm a little biased.  If you are looking to only have the 5512 for AnyConnect let us know and I can provide a more detailed description of how I'm doing this with our equipment.   If you are looking at implementing the 500 inline with the 5512 and just wish to gain the filtering capability of the 500 I would set it up as TAP and put it infront of the 5512 and frontend all traffic before it hits the 5512, the only downside to this setup would be that you will have to maintain two firewalls.  ... View more

mivaldi is right, if this is a modem with integrated wireless then just forget that you modem even has a wireless option and shut it off. Keeping that wireless signal on would defeat any purpose of having a PA protecting your network. You can setup the DHCP to act as a relay or create your own DHCP options, perosnally I would recommend putting the DHCP on the PA itself since it allows you to easy switch your computers away from your ISPs DHCP servers. I would recommend moving your equipment away from the 192.168.1.* addresses, everybody uses 192.168.1. I assumed from your first post the interface IP was 192.168.1.252, if you are using 192.168.1.254 as your interface IP then that route is currect. I would be your network around the PA-200 to simulate an enviroment that you would actually be working with, leaving it behind everything isn't what you are going to see out in the real world.  I'm not sure from your wording if your wireless router is built into your modem or not, as you referenced them as two different pieces of equipment I'm going to guess that they are not. Put you wireless router behind your PA and plug your PA directely into the modem. You may or may not have to actually power cycle the modem to get it to provide an IP address to your PA. The "Outside" port that you are using on your PA can be set to DHCP to automatically pull all the required informaiton for you, then let it build the default route. Then you can start working on the "inside" and wireless zone/ports and their security policies to actually start moving traffic.  ... View more

What does the PAs traffic and Threat logs say?  ... View more

Your setup is rather odd and without looking over the total configuration I can't tell whats wrong, I can only take crack shots on the information you provide. I did notice that the current route for 192.168.1.0/24 is showing your next hop as 192.168.1.254, which I didn't see mentioned anywhere on your network setup. What does your interface configuration look like?  This might be a little faster to just dump the configuration, take out everything you don't want people to see, and upload the file. I feel like there may be multiple small configuration errors across the configuration that you are running into, that would take a while for the forum to pinpoint each individual issue with screenshots.    It might be worth throwing your wireless router out of the picture and setting up an "UnTrust" zone on your firewall along with a "Trust" zone, and setting your "UnTrust" interface as DHCP. Understanding that you will still need wireless put your Wireless Router behind the firewall and simply put it in AP mode. Running your firewall behind your wireless router isn't exactly the best setup anyways from a security perspective, as this would allow wireless users to completely bypass any security that you have setup on the firewall. ... View more