About Brandon_Wertz

When you log into your support account at https://support.paloaltonetworks.com in the "Resources" section there's the "Security Advisories" link ... View more

I was also considering whether to do it with custom App or custom IPS signature. In the end i decided for IPS signature because I still want to see what app is being used (web-browsing, http-video...) instead of just which browsers is being used.  ... View more

Thank you, both..  I'll probably go with the cold-spare until I can figure out the sub-interface config.  These PA's are pretty neat!  Always learning...  😄 ... View more

@Brandon_Wertz...seems I was spot on ! 😉  Regarding pcap log, On top of my head, I dont remember any particular log file which would log the pcap setting but following comand can be used to see the realtime setting :     admin@PA-VM> debug dataplane packet-diag show setting   -------------------------------------------------------------------------------- Packet diagnosis setting: -------------------------------------------------------------------------------- Packet filter   Enabled:                   no   Match pre-parsed packet:   no             -------------------------------------------------------------------------------- Logging   Enabled:                   no   Log-throttle:              no   Sync-log-by-ticks:         yes               Features:   Counters: -------------------------------------------------------------------------------- Packet capture                                                                                             <<<<<<<<<<<<<<<<   Enabled:                   no   Snaplen:                   0             --------------------------------------------------------------------------------     A painful way of achieving this would be writing a script and fetching this output periodically.         ... View more

I've only used the Migration Tool a few times and not with Checkpoint, so I'm not sure where you would look.   But you really should post this question over in these other discussion forums.  The migration tool developers monitor that forum and respond to questions.  They are not over here on the general topics forum very often.   https://live.paloaltonetworks.com/t5/Migration-Too l-Discussions/bd-p/mt_discuss ... View more

Hi Brandon,   It is less likely to be NAT exhaustion issue since other traffic like HTTPS (and other) like is working fine (which would also use source NAT). This seem to be a software issue which would require deeper analysis by the Tech support team.         ... View more

Agent bloat is a huge issue, especially when mutiple agents for the same basic purpose.   While OpenDNS and ZScaler are good platforms there are other options.  Especially if you've already have a large scale Cisco routed infrastructure and use ASAs for VPN access they really have the most mature solution for what you're looking for.   Integrated with the Cisco Any Connect client there's a plug-in that you can install called Cisco Web Security.  At your fixed sites with the appropriate router using DMVPN / IWAN / PFRv2 your fixed clients can use the same cloud web policy that your mobile/VPN clients use with CWS.  (No I'm not a Cisco rep...Yes my company has over 18 Palo devices from 5060s down to PA200s) Cisco just has a better solution for cloud based filtering. ... View more

I appreciate everyone's help.  I believe where I was off was our threats send emails directly from the fw to to us. The fw will send complete syslogs but unable to parse out specific objects/strings.  I'll have our solarwinds send over the specifics.   Thanks again. ... View more

I had this same question to my previous SE.  Bascially he said there's no direct way, but he pulled it via API from the firewall.   If you like I can provide you that same list.  Altough my exported version is from Feb 2015, so I'm not sure if you'd want it or not.  If you wanted it just comment and I'll post it (it is a year old though) ... View more

Thank you guys 7.0.4 it is then.. ... View more

10GB is indeed very small, if you make your initial disk larger the surplus will be added to the log partition, but if you decide to increase the log partition later that partition will be lost   you can add a second disk, it will mount as sdb1:   admin@Panorama> show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda3 3.8G 1.6G 2.1G 44% / /dev/sda5 7.6G 1.5G 5.8G 20% /opt/pancfg /dev/sda6 3.8G 1.9G 1.7G 54% /opt/panrepo tmpfs 1005M 0 1005M 0% /dev/shm /dev/sdb1 16G 195M 15G 2% /opt/panlogs if you look at the partitions, the previos sda8 partition will have unmounted in favor of the newly added sdb   admin@Panorama> show system disk-partition Disk /dev/sda: 36.5 GB, 36507222016 bytes 255 heads, 63 sectors/track, 4438 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sda1 1 250 2008093+ 83 Linux /dev/sda2 251 749 4008217+ 83 Linux /dev/sda3 750 1248 4008217+ 83 Linux /dev/sda4 1249 4438 25623675 5 Extended /dev/sda5 1249 2245 8008371 83 Linux /dev/sda6 2246 2744 4008186 83 Linux /dev/sda7 2745 2994 2008093+ 82 Linux swap / Solaris /dev/sda8 2995 4438 11598898+ 83 Linux Disk /dev/sdb: 17.1 GB, 17179869184 bytes 255 heads, 63 sectors/track, 2088 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sdb1 1 2088 16771828+ 83 Linux so you could opt to stick with the initial 10gb of log partition, then migrate to a larger secondary disk. if at one point you need even more space you could export the logs, unmount the secondary, mount a larger secondary, import logs   regards Tom ... View more

Thanks for all of your replies!   I didn´t open a case yet, because it looks like i´m not able to open one direct at PaloAlto. We have Premium Partner Support, so I think I would have to contact our Partner. Now, between Christmas and NewYear it´s a little bit tricky here!   Anyway, I tested again today, since we´re now an AV-Version 1731-2209 (12/27/15) and it looks like it is corrected now! Maybe anyone else contacted TAC 😉   Thanks to all!   Alex. ... View more

@reaper good point.  In the past I didn't take into account the type of video content being posted.     But as stated in my original post; with the "tweak" changing my security policy from solely blocking the application facebook-video to blocking the application facebook-base along with the URL category CDN I was able to block a video that played in FB when previously I was only blocking the "video" application.   Have either of you successfully blocked the application "facebook-video" by itself?   In a 24-hr period < 6MB of FB-Video traffic:       In a 24-hr period > 100GB of facebook-base traffic ... View more

@Bin From this post I saw the domain compute-1.amazonaws.com was listed as "Shopping."  Palo has now recently (PAN-DB) categorized this domain as "CDN" not sure if that helps you at all. ... View more