About acamacho

If the information provided is still not clear then you might want to call into support because there are so many different ways to generate reports. This way you can explain what you are trying to do and we can see setup a web meeting to assist.  ... View more

The Hello Interval is the time interval between heartbeat packets that are sent to verify that the opposing firewall is operational. The minimum value for hello interval is 1000 milliseconds (1 second) on the PA-4000 series, and 8000 milliseconds on the PA-2000 series. Setting the value to the minimum is recommended to achieve optimal failover times. When there is a loss of 3 hello messages the adjacent firewall is declared to be down and the passive device will become active See https://live.paloaltonetworks.com/docs/DOC-1094 which was recommended in an earlier post. ... View more

repeating what sjamaluddin stated there is no known limit for the number of groups a user can belong to. Here is a paltform capacity for User ID Agent Maximum number of pan-agents per vsys: 100 Maximum number of pan-agents per platform: 100 Maximum number of groups that can be defined in policies per vsys: 640 If you need additonal informaiton please contact support or local SE for additional information. ... View more

Hi When it comes to having dual ethernet PAN-Agent/User ID should keep a record of both IP addresses for the same user. If you see both user name on the same IP then that is a problem. Also if you have multiple user agents running please check to see if you are seeing both or just 1 IP address on the agents. Anyway I think you might be running into some issue that I have not seen, so if you can please do call into support so we can assist and look over your configuration to determine why you are seeing this. Thank you ... View more

Hello I have looked over our bug database and knowledge piont found no similar reported issue. If you can upgrade to PANos 4.1.3 and see if this fixes this or please open up a case with support so we can assist in investigating this. Thank  you Al ... View more

Brian If you can please ssh to both active and passive and from the CLI command please type the following command. 1. show system resources Please look for mgmtsrvr and devsrvr process and see what the VIRT memory colum reads. Our development team is currently investigating a issue with a memory leak issue. If the VIRT memory is over 900MB that would be an indication that you might be running into a memory leak issue. Today they only want to release the memory pool back is to restart these services. I would recommend that you call into support so we can further trouble shoot what you are seeing. Thank you Al ... View more

Hi There could be a fill reason why this happen, so I would recommend that you please open a case with support so we can assist with this. Unsually the procedure we provide the customer is to only download 4.10 and DO NOT install the PANos. Then you can download 4.1.4 and install it. Thanks Al ... View more

Yes the passwords are hashed on the config file. I have not heard of any case where someone has every decrypted the password or keys. Below is a password policy document that might assist with  your question. Al Re: Password Policy Hello, This option is available by enabling FIPS mode (FIPS 140-2) on the FW, though the following options will also apply: Federal Information Processing Standards Support: • To log into the firewall, the browser must be TLS 1.0 compatible. • All passwords on the firewall must be at least six characters. • Accounts are locked after the number of failed attempts that is configured on theDevice > Setup > Management page. If the firewall is not in FIPS mode, it can be configured so that it never locks out; however in FIPS mode, and lockout time is required. • The firewall automatically determines the appropriate level of self-testing and enforces the appropriate level of strength in encryption algorithms and cipher suites. • Non-FIPS approved algorithms are not decrypted and are thus ignored during decryption. • When configuring IPSec, a subset of the normally available cipher suites is available. • Self-generated and imported certificates must contain public keys that are 2048 bits (or more). • The serial port is disabled. • Telnet, TFTP, and HTTP management connections are unavailable. • Surf control is not supported. • High availability (HA) encryption is required. • PAP authentication is disabled.. Below is a Knowledgepoint Article regarding FIPS Mode: https://live.paloaltonetworks.com/docs/DOC-1536 FIPS mode (enabling/details) can be referenced as well via your Admin Guide. ... View more

Having a Digium PBX system behind a PAN should be supported. Are you having issues or about to install a PAN inline that has a Digium PBX? If  you are seeing issues you might have to create an application override for SIP and increase session timers. If you need assistance please call into support or contact local reseller for assistance. Thank you ... View more

This looks like some setting is missing or not completed when user was configuring ladp Look at these areas in the Device tab and verify that it's configured correctly and then try to commit again. 1. Server Profiles - LDAP 2. Authentication Profiles 3. Local User Database ... View more

Hello Apologies I did not realize that you already had cases open. I will follow up with the folks who are assigned these cases and we will get back to you. Thank you Al ... View more

Hello Please open a case or contact your local distributor to trouble shoot this issue. Thanks you ... View more

Hello I would recommend that you contact your local SE or distributor and have them go over were you should add the PAN devices. Thanks Al ... View more

1.  Does the device do any sort of reverse proxying for web servers?  OWA, Sharepoint? - I will have to get back to you on this one. 2. Can the Logs be configured to refresh any faster than 10 seconds.  My current firewall is at least one second.  Makes it nice to see when a bit of traffic hits the FW. - We only support 10sec, 30sec, 1min, and manual. 3. Can the device to HTTP to HTTPS redirection?  Enable users to type http and automatically be redirected to the actual https web page. - I will have to get back to you on this one. 4. Can the traffic logs be "colored" so that allowed rules appear as green, while blocked rules appear as red?  Or any color the admin wants... -This is not supported, but sounds like a good feature request. I would contact your SE so they can add this as a feature request to product marketing. 5. When creating RULES, searching for Applications can be trying.  I was interested in adding the HTTP protocol to a rule in the PAN but when I typed HTTP(or even “http”) into the Application search field all I got were items like http-audio, http-proxy, http-tunnel, http-video and httport.  I finally found the lowly HTTP protocol buried in a description for the Application called “web-browsing”.  Is there a better way to search for standard protocols for use in a rule? - This one again should also be a feature request. The device we are evaulating is curentlu using OS version 3.08, I believe.  Would the newest OS address any of the above issues? - The latest release would have the same results. ... View more

Hello At this point we might need to setup a web meeting so we can do more trouble shooting. Please let me if you are free on Monday and what time works. Thanks Al ... View more