About mmmccorkle

Hi   As noted by panos, this should appear only in traffic logs. I reviewed more than few IP destination addresses from traffic logs where category was any, and each one of them I found in URL logs properly categorized.   Some of anys in my logs: ad networks, cdn networks, image retrieval for url hosted elsewhere (prolly another ad)... other than that, dns queries, viber-voice, and mass of other legit traffic that is still with category any - could be a bits of known browser sessions - I am talking about browser session, when you open some large portal website it is a single tab in your "browsing session" but it creates hundreds of calls to other websites for ads images javascripts links text bits etc. Whatever I rechecked in URL logs, I found proper category.   You can do the same - check if you have ( category eq any ) in URL filtering logs, and if do - come back to us. If not, that is expected behavior, you are good to go 🙂   Regards   Luciano ... View more

Hello, KC Lee,   That is the limit of the hardware line combined with the OS on it, it is not limited by licensing, so yes, why not - anything that adds up to 750, does not say "750 out of which max. 250 for something" or anything similar.   Regards   Luciano ... View more

I may be talking about the wrong feature, but I know we can import keys in the CLI wtih the following command string. 'configure' 'set mgt-config users admin public-key dwlakjdlwakjdlwakjdlwakjd9821jkhdwalkjhdwkajhdwakjdhwakjdhwadwadwa' ... View more

I had to go in to the exception tab and set it there and then it worked ... View more

Dear Please note that: using url categories in a security policy, instead of a security profile does NOT work if you do not have a license. You still need an active license to be able to use url categories. You do not need a license to use custom url categories, which you can then use in security policies as well as in security profiles. The use in policy or profile has nothing to do with license. ... View more

Hey Skidoohead, Let me lay out multiple scenarios for you. 1. The firewall has a local definition for the file in question.      - When the firewall is set to scan the supported file types, it will check the local database and compare the md5 hash of the file. If the md5 hash is found, it will take the appropriate action, as configured. The file, if malicious and configured correctly, will not be allowed to pass. 2. The firewall does not have a local definition for the file in question, but the cloud has seen the file before.       - The firewall checks the local definitions for the md5 hash and it finds nothing. It then reaches out to the cloud and checks for the md5 hash there. We find a match and the cloud reports back and tells us what its verdict was. The file, if malicious and configured correctly, will not be allowed to pass. This happens within milliseconds and you will see a 'wildfire-upload-skip' in the submission logs. 3. The firewall does not have a local definition for the file in question and neither does the cloud.      - Same as all the other scenarios, but this file has not yet been scanned by the cloud therefore no verdict has been determined. The file will be uploaded to the cloud and the cloud will reply back as soon as it has a verdict on the file. In this scenario, the file will be allowed to pass the first time. Wildfire will not hold the email/file captive in the firewall until a determination has been made. This is not how Wildfire works. Let me know if I can clarify anything. Thanks! ... View more

Hey Cheon, According to this document... How to Configure Minimum Password Complexity for User Accounts  , these features are for local administrator accounts only. Thanks! ... View more

Thanks, exactly what I needed!. Reading the new global Counters now works. ... View more

Hi, You are totally right, We are not migrating only this kind of rules because we dont know what ip address to use for the nat. A message is created in the logs section telling you that this Dynamic Nat is not migrated. You are not missing other rules. Regards ... View more

Glad things went well for you. Yes, Active/Active does bring complications and design considerations.  I manage four A/A clusters in the data center.  But there are situations where it is required.  The trick is not to over complicate the situation unnecessarily. Just to close the loop here is the Active/Active technote reviewing the issues to watch in the A/A deploy. Configuring Active/Active HA PAN-OS 4.0 ... View more

Mandar, As mentioned by Gregoux, the client will connect to the gateway with the quickest response time. Thanks! Please do not forget to mark and 'Helpful' or 'Correct' replies. ... View more

Glad to hear all went well.  We like the uneventful cuts. ... View more

Hi Rich, Make sure the IP Communicator's IP (Either static or via dhcp) is not overlapping with the IP pool configured on the GP gateway? If the IP's assigned to your GP virtual adapter and your softphone are on the same subnet you might have issues. Also, make sure that any ip/network the IP communicator needs to reach (tfpt, call manager, other softphones etc) are not overlapping with IP pool from GP gateway. Could you provide more information on what the client is experiencing? Ex: Failing to register; calls dropping , intermittent issues , etc. ... View more

Sven_Lieckfeldt, You may need to check PanGPS.log and authd.log to co-relate the authentication events. 1). Check PanGPS.log in global protect client installation path for auth events tried by user. 2).  In PAN cli, execute below command for authentication event generated by user. > less mp-log authd.log Then type /user-name to search any log for the user and keep pressing 'n' until you don't see any relevant log. Or you can search for user authentication event in  authd.log using notepad++ after generating tech support file. Without these logs it is difficult to say what happened. Thanks ... View more

Hi, PAN does not support any compressed files except zip/gzip because PAN scans malware by stream-based. Following KB might be helpful for you even it's talking about IPS. IPS Scanning of Compressed Files ... View more