About Brandon_Wertz

I appreciate the responses.  I'll revert back and see how things go. ... View more

Looking at the "Threat Vault" there are sigs for CSRF exploits.     --edit--   There are also 38 AV sigs for various CSRF traffic types     ... View more

you can use the hardware comparison tool to see the differences, but in this scenario it's comparing apples to racecars 🙂   https://www.paloaltonetworks.com/content/pan/en_US/products/product-comparison.html?chosen=pa-500,pa-5250,pa-5050 ... View more

@Brandon_Wertz I know that you can put in a 'private' FR on Cisco's website so that it's never displayed elsewhere. I agree that some changes need transparacy but from what I've heard from our SE it isn't even that useful of a system on their end, as they have to search for open FR requests to add your weight towards before opening a new one. It seems like they could do things a lot better than what they do now as far as FRs go.  ... View more

I'm guessing this is for a PA-200/220 at someone's house?   Yeah, it's called a URL Filtering subscription service with a URL filtering profile that at a minimum has "alert" on all URL categories.  Though if it's for someone's kids you'd probably want "block" on some categories.   You'd be able to see what videos were played from YouTube as well.  Although it's not going to give anything other than the video name, so you'd need to go to every YouTube video in order to review what the video content actually was. ... View more

Good rundown!   We've got a lab 200 that I hope to be standing up in the next week.  So I am probably 2 weeks out before I have anything constructive to add. ... View more

It should just be an "export" from the current PA-500 and "import" on the PA-800 you're going to buy.     That being said as a migration strategy it might be worth upgrading the 500 to the code version you're going to be running on the 800 series so that way you're only migrating platforms and not changing code base as well.     You might run into unforseen policy issues or bugs which could impact the overall migration.   Just a thought... ... View more

Sounds like your CEO would be interested in implementing 802.1x port security solution.  Check with your switch vendor that they can support 802.1x.  If so, this is your best method to make sure only authorized devices connect to your physical ports. ... View more

not in your normal operations log entries may get backlogged or lost (depending on the volume of log you generate, the dataplane buffer may nog be enough) but sessions will not be interrupted ... View more

It doesn't take long to learning the console.  Usually, about several weeks.  Policies are straight forward.  The biggest thing is just learning the EPM's.  Policy flow is pretty straight forward.   ... View more

If you have GUI access and prefer to use it the same command via CLI is also in the GUI     ... View more

While Cisco did release some of EIGRP for others to use, this is pretty much just a marketing ploy to say it is an "open standard" and no network company is ever likely to implement it.   this pretty much sums up the situation as described at the time of "release".   http://www.plexxi.com/2013/07/case-study-on-standards-why-opening-up-eigrp-is-misleading/ ... View more

I had this same issue after upgrade from 7.0.12 to 7.1.7 and so far support has not been able to figure out why my decryption stopped working. I put in a rule for web-browsing for tcp/443 as suggested in this post and my decryption seems to be working again. Great work on this post guys! ... View more

Even if it's been there always you can optimise it and turn off logging for non interesting traffic.   But to find the source of spike of events: PA FW saves these reports daily. I guess you have to check past reports, find out on which day there was a spike, which rule recorded it and (in the unlikely case you still have logs for that day) you can find out which traffic caused it. If you don't have logs you can check other automated reports and look for possible causes.     ... View more

Hi Pulukas, thanks for taking a look.   Unfortunately, this is the guide I used and linked in my original post. I have everything setup as per the article but we have been having a number of files getting through.   I have since raised a ticket with Palo regarding this and the engineer I was talking to confirmed the settings were correct and couldn't see why the files were getting through 3 days after the hash had been identified.   It has therefore been escalated and I am now in the process of providing the various logs required for investigation.   I suspect that this issue is down to human error and there is some setting/policy somewhere which is causing this headache, I just hope it is sorted soon :).   I will let you know if I get a solution, as I noticed in the article you linked, other people were having similar issues. ... View more