About Brandon_Wertz

@glastra1 I was able to find the directory for my virtualized FWs.  In there I found "objects_5_0.C" and "rulebases_5_0.fws"   But the MT UI kep saying I needed to import "Policy" too, so I looked in the same folder and only cound "connectra_policy.C"     When I loaded all 3 up I see the objects, I see "NAT" rules, but in "Security" there are no Security Rules.  Any ideas?     Thanks, Brandon ... View more

I looked for a MT forum...I didn't find it.  Thanks!  @pulukas I found out my issue.  I looked in "Disucssions" not "Topics") ... View more

The reason why I was asking about cloud usage and and internal users, was I was thinking maybe there was a NAT resource exhaustion.     If you're only set up with a single public IP and users, say, were going to O365 you might have reached a mathmatical limit to available NAT ports.  Also there's a relatively low limit on SSL interception cabiliites for the 3020. ... View more

What's the associated hadware?    Do you use any cloud based services?   How many users behind the PA device? ... View more

@burtond some screen shots might be helpful for us...Rule/Logs   Also if you're using a "group" in the rule do you have that group in the "Group Mapping?" In the user identifcation in the "Group Include List?" ... View more

Agent bloat is a huge issue, especially when mutiple agents for the same basic purpose.   While OpenDNS and ZScaler are good platforms there are other options.  Especially if you've already have a large scale Cisco routed infrastructure and use ASAs for VPN access they really have the most mature solution for what you're looking for.   Integrated with the Cisco Any Connect client there's a plug-in that you can install called Cisco Web Security.  At your fixed sites with the appropriate router using DMVPN / IWAN / PFRv2 your fixed clients can use the same cloud web policy that your mobile/VPN clients use with CWS.  (No I'm not a Cisco rep...Yes my company has over 18 Palo devices from 5060s down to PA200s) Cisco just has a better solution for cloud based filtering. ... View more

Thanks I'll take a look! ... View more

That's what we've seen.   MPLS is going away, so to speak, the reliance for using it for everything is going away.  For us, hundreds of Meg/Gigabit INet circuits are relatively cheap, but ingesting all that data comes at an expense.   For our users they're split-tunneled with specific work traffic coming back to HQ, while general INet traffic goes out their local connections.  Using this cloud design works well with "hybrid networking or an iWAN" solution as our traditional remote office locations can have the same "funnel the junk" policy direct "to the cloud" via business broadband links while traditional business traffic contnues to use the smaller MPLS links. ... View more

When you say "it brings back the user id mappings."  Does it actually provide the IP to User ID mapping for the source user in question?   In the deny log, does the denied ICMP request show the source user ID that you're expecting?   You should see something like this:   ME@FIREWALLNAME(active)> show user ip-user-mapping(mp) ip (USER IP 1.1.11) IP address: (USER IP 1.1.1.1) (vsys1) User: (USER ID) From: UIA Idle Timeout: 3371s Max. TTL: 3371s Groups that the user belongs to (used in policy) ... View more

have you validated that the firewall has a mapping of the IP to User?   Do you see a deny log showing the ICMP request with the source user the traffic is being generated from? ... View more

@jcawsey13 the bug that @VinceM referenced (Log files consuming disk space) wasn't fixed until 7.0.2 (What I was told from TAC). ... View more

I had this same question to my previous SE.  Bascially he said there's no direct way, but he pulled it via API from the firewall.   If you like I can provide you that same list.  Altough my exported version is from Feb 2015, so I'm not sure if you'd want it or not.  If you wanted it just comment and I'll post it (it is a year old though) ... View more

@sokonta  (Says the 4 or so other people before you saying they haven't seen the bug they previously saw in 7.0.3 with SSL enabled.) ... View more