About BPry

I can test this in the evening and get back to you then if you don't get a response before then. I recall trying it before and having it take forever to connect but working after that.  ... View more

If you are just trying to do this for testing purposes I would simply open up a new remote management profile and assign it to a port on your trust "home" zone, you should then be able to access the management interface and SSH into the device directly from the IP address assigned to that port.  P.S this is written assuming that you have layer 3 ports instead of layer 2; if you are using layer 2 in a home enviroment I might suggust just reorganzing to Layer 3 anyways since you get access to a few more things on the PA interface.  ... View more

The 3020's were having some issue with this exact issue on 7.1.2 that had people downgrading earlier, however 7.1.3 was supposed to stop that from being an issue. I would contact your SE or open up a support case with it if you can but this was the same issue that was affecting earlier builds of 7.1.*. Please keep us up to-date on this though, as our company has been talking about upgrading to 7.1.3 with the newest security vulnerabilities that came out this/last week or continuing on to 7.0.8.  ... View more

I'm a little lost on what you are looking to do I guess. It sounds like you would like to delete all of the actual configuration changes on your device, much akin to what a factory reset would do; however you don't want to do an actual factory reset because of something correct?  Unless my view of scripting for the Palo Alto is way out of line, which it very well could actually be, I don't think there is a way to do this effectively without typing out everything once anyways. Your screenshot displays everything you could actually delete with the delete command, so unless you forgot to include another screenshot then it doesn't give anybody much insight to what you actually want to do besides the fact that you want to delete all of the configuration off of the device, but don't want to actually reset the device. If you give us the reason why you don't want to reset the device we may be able to help a little more.  ... View more

I've been playing around with this internally for a while and found that while blocking .able or .google works better then doing a *.able it's far from a perfect solution. I've had more luck with creating a custom threat signature however, the time that is needed to create a custom threat signature and properly test it before actaully deploying it is a much longer process in general.   ... View more

The same thing is still true today; PAN doesn't support the full cipher suite, additonally as long as the PA can get the applicaiton ID and do a threat scan it lets other traffic through on the fast path becuase of processing restrictions. It's also important to note that if you are using a smaller device it's very possible that you are hitting the session limit on your PA, anything over that limit will not be decrypted because the PA can not spare the system resources required to process the request and keep the traffic flowing through the firewall. Without a little more back story and actually looking at the logs on the device it's pretty impossible to say if you are encountering normal behavior or if something with your decryption policy doesn't sit right with your setup.  ... View more

Your BMP image is matching the threat signature. You can simply change the default action if this isn't something that you are worried about or you can disable the threat id in general if you don't have any Lotos in your infrastructure that would be affected by this vulnerability.  ... View more

I haven't tried this but I wonder if you couldn't do this with CloudBerry and assigning a network drive on a PC that simply points to your S3 bucket. I had this running a while back with a Google Cloud Storage buget with some of my clients backups perfectly fine so I don't see why this wouldn't work there? ... View more

We had this issue a while back and found that the setup wasn't actively pulling in new users anymore but since the groups were cached then those were still showing up. Create a new group and wait until your refresh rate would have hit on it and see if it pulls in the new group. If the newely created group shows up then you can rule out a direct access error and start looking at the access that your device actually has with LDAP bindings.  ... View more

If you have user identification enabled you can just setup the user as having access to the one server that you actually want them to access by identifying the user in a new rule and putting it above the one in place to allow the GP users access to all of the servers. Alternatively if you don't have user-id then you could statically give the one user a specific IP address and set a rule that allows that user access to the one server and all other IPs in the GP pool have access to the other servers.  ... View more

The same thing would work for you as well; I'm assuming that you can at least give the remote sites directions on how there end needs to look. If not then you are surely out of luck as far as the configuration goes, there is no way to setup a tunnel without configuring the other end  ... View more

I actually got hands on with it today because there was confussion about why something wouldn't commit. Turns out the guy who was working on it earlier had switched our trust interface to layer 2 while our untrust/IPSec Tunnel interface was for obvious reasons layer 3. Once I fixed that I also noticed that they had setup DHCP on the switch that was below it with the wrong gateway and a few other configuration mistakes. Switching the relay interface to the DHCP server on Port 4 along with some policy changes to allow the traffic worked great and wasn't a big issue getting everything sorted out; don't know why I wasn't getting all the info from the start. Thanks for your input everyone.  ... View more

THIS will help you know what you need for a packet capture but essentially it will be source IP, destination IP, the application if it's reporting as the same one all the time, and then you can filter on further from there. Pass that PCAP along to your SE and they can start the process of either identifiying why it's being hit or getting the signature updated. In the mean time I would disable that signature and let the traffic pass as long as you are confident that the servers that you are connecting to are clean.  ... View more

I can't speak on the other parts of this issue, but the session remaining ative is normal at least for my IPsec tunnel to the remote site. Oddly that IP address changes throughout the day on a regular basis which means that from one tunnel that is setup soley for the remote office I can see four different 'active' sessions to the different IP addresses throughout the day. Eventually they time-out and drop off if the script to kill the tunnel and bring it back up at the end of the day doesn't get to them first.  ... View more

I can't get to either of those IP address; but if you know the IP addresses for everything then you could make exceptions to them or disable that ID on your PA all together. I would recommend getting a packet capture done though because it sounds like something with your DNS server specifically that this signature doesn't like, and it could be that nobody else is really seeing the same issue.  ... View more