About Brandon_Wertz

I agree there can be some cross-over, but it seems Palo is trying to make a greater distinction that other Web Content Filtering services.   While I believe that BC's filtering services stomp the poo poo out of Palo's I think the distinction does make sense.   Here's a quick grab at what I'm seeing for "Music"       Here's "Entertainment-and-Arts"       It seems that the latter is more regarding the delivering of content.  From what I can tell a lot of what I'm seeing as "Music" is really "Apple" stuff. ... View more

@reaper good point.  In the past I didn't take into account the type of video content being posted.     But as stated in my original post; with the "tweak" changing my security policy from solely blocking the application facebook-video to blocking the application facebook-base along with the URL category CDN I was able to block a video that played in FB when previously I was only blocking the "video" application.   Have either of you successfully blocked the application "facebook-video" by itself?   In a 24-hr period < 6MB of FB-Video traffic:       In a 24-hr period > 100GB of facebook-base traffic ... View more

@Raido_Rattameister  1. Yes we're decrypting. 2. Not necessarily true   FB-Video App shown w/o decryption   FB-Base App shown w/o decryption   FB-Base App shown w/decryption ... View more

@gabriel.simatupang The "Value" threshold of 60-86400 is in seconds I believe.  Your request to have the group refreshed more quickly than 60 minutes just means set this value below 3600 seconds, down to as low as 60 seconds.  Although, I'm not sure how much of an impact setting the refresh to 60 seconds would have on your firewall. ... View more

@Bin From this post I saw the domain compute-1.amazonaws.com was listed as "Shopping."  Palo has now recently (PAN-DB) categorized this domain as "CDN" not sure if that helps you at all. ... View more

@gwesson Is that the "Global Find" that is integrated into 7.X?   I'm running 6.X and don't see that filter option.       That being said...Can't you just search the zone name in the search field from the security policy view? ... View more

Palo does provide a response page for SOME cert issues:     Specifically for things like an expired certificate I've seen this page come up.  However for things like certificate negotiation issues I've only ever seen a "Page Can't Be Displayed" browser page.  The only way I've found to diagnose the issue is to perform a packet capture.  Doing this you can see a "Fatal Certificate Error" in the SSL/TLS negotiation.   When things like the later occur it's very frustating because for one users tend to think there's a problem with a distant end...and/or when the ticket comes to a less experienced technician they don't even think about certificate issues and performing such in-depth analysis. ... View more

@dfeddersen From what I recall it was December 21st for 7.0.4 release. ... View more

The only thing I know for certain is that "patches" X.X.X are released every 6 weeks.  I'm not certain about the release cycle of new versions (X.) or major revisions/feature releases (X.X) from within a version.   I think the later two are "it depends." ... View more

Agree with @mlinsemier on going to 7.1.1.  Once 7.0.4 has been released I plan on upgrading our enviornment.  Then once 7.1.X comes out the TLS support is going to be dramatically improved. ... View more

That's unfortunate about your SE...Mine's been good, especially with practical/applicable internal/NDA kinda stuff.   I've got Panorama on 7.0.2 only with 14 or so FWs from 5060s/3k/200s on version 6.X code.  The biggest thing I see is ACC is night and day different (In a positive way.)   There are some default behavorial changes but for the most part it's the same "function" with ACC being the 1 major change.  If you used ACC a lot in the past it will take some used to the new format. ... View more

There are some "cool" features in 7.X that I wanted, but nothing business driving.     I've been keeping in close contact with my SE, I suggest you do the same to make sure you get the right info, but from what i can tell 7.0.4 is going to be the "first suggested" version of 7.X as "stable."  I'd wait for that, but I'd confirm with your own account SE.   A side note.  7.1 is going to beta soon and the inital info I've seen there have been huge positive operational support additions to SSL/TLS interactions. ... View more

While I can't provide any specific answers to your questions.  Given you're relatively new to the product I might be able to point you to a different T/S method.  What's the issue(s) you're trying to tackle? ... View more

Curious what your desire to upgrade to 7.0.3 is?  With 7.0.4 coming out soon, you might want to think about waiting until it's released. ... View more