About mmmccorkle

Nils, Have you found any logs regarding that traffic? Is it being identified to a specific application by chance or does it just show up at SSL? Are we performing SSL decryption? I would imagine that if we could tie it down to an application (layer 7 inspection) we could throw it into the QoS (Quality of Service) policy therefore limiting the bandwidth and the priority. Please give us some more information when you get the chance. Thanks! ... View more

This has now been reported as fixed (on 1/28) so please update your Dynamic Updates. Thanks! ... View more

Exactly what dreputi said is correct! The 'backup' button would be the option to export the configuration under 'Device > Setup > Operations'. Thanks! Please do not forget to mark any 'helpful' or 'correct' replies. ... View more

EBlizard, The only customization for these notifications I am aware of relates to the HIP checks. I looked around to try and find any other mention of disabling the 'normal' notification bubbles related to the connection, but found none. It may be possible, but I currently have not found a way. Thanks! EDIT: I looked through the client side registry but still did not see anything we could modify to disable this. Please do not forget to mark any 'helpful' or 'correct' answers. ... View more

VSU_ITSEC, This is currently not an option on the PA firewalls. It will display the same block page for all blocked URLs, if configured. Thanks! ... View more

Olek, The PA-200 is the 'smallest' box, as far as what it can handle, but it can handle enough for a lab setup... This entirely depends on how big your lab setup will be, but if you have any specific concerns, please look at the hardware comparison for specifics listed below. Thanks! PA-500 vs PA-200 Details https://www.paloaltonetworks.com/products/product-comparison.html?chosen=pa-500,pa-200 Please do not forget to mark any 'helpful' or 'correct' answers. ... View more

MikeMeredith, Do you need the firewall to pull all groups from the AD, or could we get granular  and only have it pull a set of specific ones? That should keep the useridd process cpu/mem usage down. That has to be the issue then... useridd is running above its means, so we need to optimize it I suppose. Let me know how it goes! Don't forget to mark any answers here as 'correct' or 'helpful'. Thanks! ... View more

MikeMeredith, You're welcome. Your log output matches the same errors referenced from the ms.log file in the case I mentioned, so it looks like this may be the same issue after all. I'm trying to relate their solution to our situation. While raising a support call, please reference the output from ms.log, along with generating a TechSupport file for them to look at. Specifically we are looking to see if the RAM/CPU usage of the process 'useridd' is abnormally high. Could you do a 'show system info' and past the output? What is the uptime? I know this sounds like a cliche` response, but have you rebooted the device since this started happening? Perhaps something is just hanging up in the management-plane, but that would be too easy. You mentioned this is not in production yet, but have you been authenticating many users across the firewall? Are you pulling all the groups from the AD or just some of them? How many groups are we talking about the firewall pulling/mapping ? In the previous scenario, the useridd process was being 'oversubscribed'. This can be potentially mitigated by limiting what groups the firewall will try to map and configuring the access list for the zone. We are headed the right direction here. Let me know, Thanks EDIT: I'm unaware of a commit type where we can do that, but it would be highly convenient, right? :smileysilly: ... View more

MikeMeredith, There are no 'dumb' questions. We all start somewhere, so no worries! You're on the right path with checking the jobs. Good work. Could you run the following command in the CLI, via SSH session, and log the session output to a file? 'tail follow yes mp-log ms.log' This will show you the output from the ms.log management log file. This may show us some more details about what is going on when these AddrObjRefresh jobs kick off. I'm referencing a very similar case here, with a pair of 5000 series having the exact same issue. (225414) They also had setup User-ID recently and experienced the same behavior, so this could be the same issue, or very close. How many profiles were setup for User-ID (ldap, etc) ? In their scenario, the firewall was having trouble communicating to the LDAP server, due to other network issues, therefore user-id was taking up more cpu/ram than expected and constantly refreshing as it attempted to pull the group information. I will bet you $100 that if you were to disable the recent changes with User-ID and the server profiles, the issue would stop occurring. If you get the chance, please try this out and verify while it is not in production. This will help narrow down the issue. Let me know and we can go from there, Thanks! ... View more

Are you using HIP profiles for your GP clients? Perhaps we could create a custom report to show you the HIP matches for the past 24 hours and group by source user. Example: We could also look through the system logs, under Monitor, for... (subtype eq global protect) Combine this with filtering the description for successful logins only, and you will get... (subtype eq globalprotect)  and ( description contains 'Login from' ) Example: ... View more

I do not believe there is a static address for wildfire like there is for the update server. ... View more

As HULK mentioned, check the ms.log file. There is also an issue with Panorama pushing updates to Firewalls that was resolved in 6.1.0.  Before upgrading, please check the ms.log file, to get more specifics and let us know. Thanks ... View more