About BPry

BPry · ‎08-17-2016

From my understanding on feature requests they have to be brought up with our SE and managed from an internal PA system; I've always questioned why the system was always setup like this, but it is. This is something that would likely work with API access however, or really even a script that simply logs into each device and simply issues a restart. You could then schedule that specific script to run at a given time, wouldn't be a perfect solution but it would give you a solution until/if this was put into place.

BPry · ‎08-17-2016

Are you running this plugged into your wireless router? Where is your default routing statement currently sending your traffic, are you trying to send it directly to your modem or your wireless router? Generally speaking you would replace your wireless router with your PA-200. It may be a little more helpful if you send a screenshot of how you actually setup the routing on this device, I suspect at this point that routing is likely your issue.

BPry · ‎08-16-2016

Thanks much! Didn't realize that I could actually use a custom URL Category to this affect.

BPry · ‎08-16-2016

I might be doing something wrong but I don't see an option of putting the custom URL category as the destination address. Essentially I just want to use a wildcard in the destination address to include anything.zoom.us as an allowed destination address under security policy.

BPry · ‎08-16-2016

Since they still have to sign into globalprotect with their credentials I wouldn't be to worried about having the same cert on all of their equipment, as anybody who gets the cert would still need the username and password. Most organziations use certs pretty heavily and many will have the same cert on all of their machines. We use a cert for one of our wireless SSIDS that uses a common cert, then have another SSID that uses the machine cert to authenticate.

BPry · ‎08-16-2016

Does anyone know if it's possible to use a domain in a security policy? I know that I can use FQDN but what happens if I need to allow a wider range, such as *.zoom.us? Can this be done or am I out of luck?

BPry · ‎08-15-2016

You can setup the PA as a DNS proxy and then cache DNS entries as long as you have everything setup correctly. This doesn't really offer you any advantages of making custom DNS entries however since it's still only going to pull DNS from the actual DNS server. I would look at just setting up a DNS server locally if you need to make custom entries, you should be able to through it on pretty much any server that you are running without any issues at all.

BPry · ‎08-12-2016

In that case I would be intereseted in seeing the response of those two commands that I sent previously. If the firewall that all of these are routed back to is holding onto the old VPN credentials it wouldn't allow the remote firewall to "connect" again because it already is. This would also throw off the routing table which would explain why you can't get to the outside interface for management, with the traffic not being split-tunneled then it would also explain why all the traffic is halting. It might help to throw a few of these as a split-tunnel and see if the issue persists, and if it does do they just lose access to internal (VPN Source) resources or does the internet connection drop as a whole.

BPry · ‎08-12-2016

You can also block id 39154 which is Microsoft Office File with Macros. Please note that this isn't a perfect signature by far, but it does manage to take care of a good percentage of files before they hit our Barracudas

BPry · ‎08-12-2016

It would be interesting to see what your actual cable modem configuration looks like, for example is the device in pass-through mode, DHCP or Static Address, ect. I also didn't see it mentioned anywhere if you are running a split-tunnel or if everything is going through the tunnel. One of the things that I would look at is if the show vpn ike-sa gateway <value> or the show vpn ipsec-sa tunnel <value> still shows the connections as active? I'll also pull a Cisco and ask why they are still running 6.1.3, it might be worth upgrading one of them that does this more often to the latest 6.1.*, or 7.0.*, or even 7.1.* if you like to live dangerously.

BPry · ‎08-08-2016

Thanks! I started to look into this a little more and found a petter article than what I was seeing previously. Our system engineer just asked why it was hitting the DCs so often since he had to allocate more resources to them; I didn't have the answer since I thought the probing setting was when it was going out to the server and requesting the user-id information, not every 2 seconds.

BPry · ‎08-05-2016

Balullag, Are you using the actual Microsoft Lync on-premise server or the online hosted solutiion?

BPry · ‎08-04-2016

If you look under the 'Applications' tab under 'Objects' (I think this is where you were pulling the screenshots, unless you looked them up under applipedia) then you'll notice that in the case of snmp you have four sub-applications underneath. By allowing snmp by default you also allow all of those child applications. The same can be said about ipsec, where you will also allow ike, ipsec-ah,ipsec-esp, and ipsec-esp-udp. That being said if you solely allow ipsec-esp that will not allow anything else to actually pass because that process by itself does not call on any dependancies

BPry · ‎08-04-2016

From what I've seen modifiying the configuration by exporting, altering, then importing and commiting is the quickesst/only way to actually achieve this. The process is fairly easy and shouldn't be all that complicated. That being said make sure that you move over anything in the config thats being referenced so it'll actually work.

BPry · ‎08-04-2016

So I've been under the impression that our PA-3020s contact the ADDC servers to authenticate users every 20 minutes when it's setup to do a probe; then caches this information locally so that it isn't constantly hammering the servers with WMI requests. I've been told that this isn't the case and that they are hitting the server every few seconds. Is there somewhere were I can tell the 3020s to simply look at the cached information unless it identifies a user not in the cache, or the 20 minute window is hit and it needs to go and check for new users/groups? I've included a screenshot of both the User Idnetification field, everything under the actual LDAP server settings are set as follows; Bind Timeout=30 / Search Timeout= 10 / Retry Interval= 60. Is this something that can actually be modified to use the cache or will it by default do a WMI query every time?

Member Since	‎05-26-2016 07:16 AM
Date Last Visited	‎02-24-2026 02:19 PM
Posts	6,520
Total Likes Received	2296

Online Status	Offline
Date Last Visited	‎02-24-2026 02:19 PM

Unlock your full community experience!

About BPry