About Brandon_Wertz

@lewishttps://downloads.paloaltonetworks.com/software/PAN-OS-7.0.4-RN.pdf?__gda__=1452055432_eb7de8c610922457f6e2196acd167d12     Under Changes to Default Behavior   "The default actions for handling threats now are alert or reset-both (sides of the connection). In releases prior to PAN-OS 7.0.0, the defaults were alert or block. On upgrade, the block action will be converted to reset-both; and the drop-packets option is now renamed as drop."   I looked at out "Application Deny Rule" which has no security profiles just the "deny" action selected and we've got "Reset-Both" as the action.  So I guess it's just not a "threat" but for any "Deny."  With the "drop" action now available.  I'm guessing that selecting "Deny" is going to be the same as selecting "reset-both." ... View more

@reaper I thought I included that part in my post, maybe I didn't (where I quoted it?)  A 10GB partition might as well be conisdered nothing. ... View more

You can only have one virtual disk...You can't continually add a second, third, or fourth...etc if you find yourself running out of diskspace.     I originally made that mistake and had a 500GB partition.  I added an extra 1.5TB and while the OS saw the space it couldn't allocate to it.  I had to delete the original 500GB partition and just allocate the 2TB.   There's a "Note" in the "Virtual disk" section that describes this limitation, but I missed it (of course initially).       "By default, the Panorama virtual appliance is set up with a single disk partition for all data, and ~10GB of this space is allocated for log storage.   ...   The Panorama virtual appliance by default installs with a virtual disk of size 34GB of which 10.89GB is used for logging. To enable more than the ~10GB of storage, use the following procedure to create a new virtual disk that can support between 40GB to 2TB of storage capacity. ...   The Panorama virtual appliance can only use one virtual disk." ... View more

In "Log Settings" --> "Config" you can set that to send to your syslog server.  Make a configuration change which should send that to your syslog server.   ... View more

We haven't...(20k+ users) ... View more

I agree there can be some cross-over, but it seems Palo is trying to make a greater distinction that other Web Content Filtering services.   While I believe that BC's filtering services stomp the poo poo out of Palo's I think the distinction does make sense.   Here's a quick grab at what I'm seeing for "Music"       Here's "Entertainment-and-Arts"       It seems that the latter is more regarding the delivering of content.  From what I can tell a lot of what I'm seeing as "Music" is really "Apple" stuff. ... View more

@reaper good point.  In the past I didn't take into account the type of video content being posted.     But as stated in my original post; with the "tweak" changing my security policy from solely blocking the application facebook-video to blocking the application facebook-base along with the URL category CDN I was able to block a video that played in FB when previously I was only blocking the "video" application.   Have either of you successfully blocked the application "facebook-video" by itself?   In a 24-hr period < 6MB of FB-Video traffic:       In a 24-hr period > 100GB of facebook-base traffic ... View more

@Raido_Rattameister  1. Yes we're decrypting. 2. Not necessarily true   FB-Video App shown w/o decryption   FB-Base App shown w/o decryption   FB-Base App shown w/decryption ... View more

@gabriel.simatupang The "Value" threshold of 60-86400 is in seconds I believe.  Your request to have the group refreshed more quickly than 60 minutes just means set this value below 3600 seconds, down to as low as 60 seconds.  Although, I'm not sure how much of an impact setting the refresh to 60 seconds would have on your firewall. ... View more

@Bin From this post I saw the domain compute-1.amazonaws.com was listed as "Shopping."  Palo has now recently (PAN-DB) categorized this domain as "CDN" not sure if that helps you at all. ... View more

@gwesson Is that the "Global Find" that is integrated into 7.X?   I'm running 6.X and don't see that filter option.       That being said...Can't you just search the zone name in the search field from the security policy view? ... View more

Palo does provide a response page for SOME cert issues:     Specifically for things like an expired certificate I've seen this page come up.  However for things like certificate negotiation issues I've only ever seen a "Page Can't Be Displayed" browser page.  The only way I've found to diagnose the issue is to perform a packet capture.  Doing this you can see a "Fatal Certificate Error" in the SSL/TLS negotiation.   When things like the later occur it's very frustating because for one users tend to think there's a problem with a distant end...and/or when the ticket comes to a less experienced technician they don't even think about certificate issues and performing such in-depth analysis. ... View more

@dfeddersen From what I recall it was December 21st for 7.0.4 release. ... View more

The only thing I know for certain is that "patches" X.X.X are released every 6 weeks.  I'm not certain about the release cycle of new versions (X.) or major revisions/feature releases (X.X) from within a version.   I think the later two are "it depends." ... View more