About BPry

BPry · ‎07-06-2016

I would like to set the severity of the vpn tunnel-status-up event to critical so that it triggers an email without having to get emails for all informational notifications. Does anyone know if this is a possibilty as it currently sits?

BPry · ‎07-05-2016

It may also be worth running the two commands listed below and seeing their output. show high-availability all show high-availability state Look at the link state and see if it's reporting that it's actually up, I've had an issue before where the link state was down and it never sent me an alert about it. Still not sure why but once the issue was cleared up I did get an alert stating that the HA peer was up.

BPry · ‎07-05-2016

Simple question but could it be that your passive firewall is down or the link between the two is damaged in some way. If it's not being synchronized and it was prior I would guess that one of those two options was the culperate

BPry · ‎07-05-2016

I've noticed that since the 592 content update I've been recieving a large amount of Microsoft SMB Client Response Parsing Vulnerability alerts from Threat-ID 35427. I've checked the servers and the workstations and everything is up-to-date or not running an operating system that would have even included this particular CVE (2010-0476). Particularly I only see this coming from our ASA zone that manages our remote users coming into the internal file servers, although this is the only such traffic that would go through the PA. I'm just wondering if anybody has noticed this or heard if it is going to be updated with the next content update; as when the issue first popped up it actually grounded our remote operations as the workers couldn't access there files since the default action is reset-both.

BPry · ‎06-30-2016

Kim, Do you know why PA isn't letting us upvote feature requests ourselves. I understand that it's on an internal database becasue it's supposed to be tied in with there security issues but why don't they seperate that out and make it public so that we don't have to bug our SEs just because I want to 'upvote' a feature request?

BPry · ‎06-30-2016

Couldn't you just use URL Filtering to disable access to that domain? Wouldn't that be easier then worrying about what IP is accessing that traffic.

BPry · ‎06-29-2016

Does your management port have an active internet accessable connection at all. It could be that you need to put in service routes to actually get this feature to work properly if you have already verified that your policy set isn't blocking the PA from resolving the address. If you are funneling out service requests from the outside interface you may not actually be allowing the interface a DNS connection.

BPry · ‎06-24-2016

Thanks! I actually just figured it out, didn't realize that it was allowed for everyone until I realized that my laptop wasn't on the wifi today.

BPry · ‎06-24-2016

I'm setting up a PA-200 for a remote office and was wondering if anyone could tell me how I would restrict the GUI access on the Public IP to solely 1 range of public IP addresses. As it sits now I have access on any device as long as I have the password and username, I'm not sure if that is the normal default or not but it doesn't really sit well with me. Thanks for any help!

BPry · ‎06-24-2016

I'll have to check and see if we have TAM; I know that we have support and have access to a SE but I wasn't involved in the actual purchasing of it or ever informed really of anything to do with support other than the contact information for the SE.

BPry · ‎06-20-2016

Once I applied the rule with the EBL as the destination instead of the source then it stated working as it should.

BPry · ‎06-17-2016

I would think that Palo Alto will address the issue and tune the threshold or whitelist Akamai in the threat signature. What annoys me is you can't tell me they didn't see this issue in internal testing.

BPry · ‎06-17-2016

Thanks! I didn't see that one.

BPry · ‎06-17-2016

Palo Alto pushed out an update to the HTTP Request Brute Force Attack signature (40059) on 06-15. Since then I've seen a rash of threats being identified from Akamai Technologies IP addresses (about 8 different addresses). I'm wondering if anybody else is having this issue and it's a problem with the threat signature or if someone is using Akamai hosting and figured out our IP range. The only reason that I'm hesitant to block them is because I know that Microsoft using Akamai and I don't want to interrupt our server ops.

BPry · ‎06-17-2016

With the IP instead of the EBL object the rule functions as it should. I also tried creating a rule specifically saying that our inside network can't go to the EBL as the destination and that appears to function fine.

Member Since	‎05-26-2016 07:16 AM
Date Last Visited	‎02-24-2026 02:19 PM
Posts	6,520
Total Likes Received	2296

Online Status	Offline
Date Last Visited	‎02-24-2026 02:19 PM

Unlock your full community experience!

About BPry