About dannon

Ok, I will just sit on it for now.   In response to the other poster, yes, our licenses are current and valid for wild-fire and the other 4 palo features we have.   Thanks. Dannon   ... View more

Our students range from K - 12 and can end up using a chromebook at some point.  We don't have a 1:1 initiative, but they get a lot of use.  We have like 3K of Chromebooks here in our District.   Yes, having Global Protect wouldn't work.  Our teachers have a hard enough time getting students to log in properly with their Google@edu email and password.   I've talked with my Palo SE and he said Palo doesn't have anything on the horizon (again).  Maybe it's because Palo is a firewall first, and internet content filter second.   Pitty though.  Other products are adding Google hooks via their API to allow such things.   -Dan     ... View more

Yeah,  I watched the webinar for that one and tried to set it up, but i couldn't get it working.  I tried to contact the authors, but never heard back.   Shame, really.  Palo should fix this, as many other internet filter vendors have support.   Dan   ... View more

Hello,   You can use this CLI command to get the version of UserID agent :   > show user user-id-agent config name agent_name   OS: Microsoft Standard Edition (build 9200), 64-bit Product Version: 7.0.4-5 Protocol Version: 5 ... View more

Agreed.   We have been wanting this feature for 3 years now and have brought it up to Palo and logged it as a feature request.  It must not be a priority for Palo.   The best product in this regard was Lightspeed Systems content filter.  They have a very nice reporing system and logging layout.  It would also log keyword searches by user and give daily reports and real-time data on them.  Sadly, the rest of the product wasn't great, but reports and kwd searches/reports were spot-on.   I'd love to have this in Palo.  I hate their reporting and have wanted an overhaul since the beginning.  Being a K12 school district, we have different needs than corporate sector. ... View more

Well, Palo's temp fix wasn't really a fix for us.  We had to disable it because it caused some HTTPS websites to not come up: outlook.com , youtube, etc.  As soon as I disabled the fix, they came up without error.  This is still with ssl decryption turned on.   If anyone wants to know what the fix is:   Hi Daniel, It was nice talking to you earlier. In our session we discssued that engineering is actively working on the issue to resolve it.  In the meantime, there is a workaround in place. We will like to apply it at your end and see if that resolves the issue. We will configure DoS policy with aggregate profile on port 443. 1. Create DoS Profile Objects -> Security Profiles -> DoS Protection <entry name="tac.case.00393841"> <flood> <tcp-syn> <syn-cookies> <block> <duration>10</duration> </block> <alarm-rate>1000000</alarm- rate> <activate-rate>0</activate-rate> <maximal-rate>1000000</maximal-rate> </syn-cookies> <enable>yes</enable> </tcp-syn>  2. Create DoS policy, Policies -> DoS Protection <entry name="tac.case.00393841"> <from> <zone> <member>Trust</member> </zone> </from> <to> <zone> <member>Untrust</member> </zone> </to> <protection> <aggregate> <profile>tac.case.00393841</profile> </aggregate> </protection> <source> <member>any</member> </source> <destination> <member>any</member> </destination> <source-user> <member>any</member> </source-user> <service> <member>service-https</member> </service> <log-setting>Any_profile_If_Available</log-setting> <action> <protect/> </action> </entry> </rules> </dos> Please do let us know if this resolves your issue. We will wait for your response to proceed. Thank you. ... View more

Yeah, I am disappointed by this bug.  I installed 7.0.0 initially and ran for a month or 2 before seeing 7.0.1.  I also noticed at that time that 7.0.0 had been pulled.  Installed 7.0.1 and ran into issues with the SSL.  Saw 7.0.2 but read about lots of bugs, some new with SSL and dataplane issues too.  Was told by support to NOT go to 7.0.2 and wait for 7.0.3.  Finally went to that and still have the SSL issues.   We are very disappointed here with what's been going on.  SSL decryption is a big thing, and to have it borked up is poor QA for sure.   On a slightly better note, support got back to me with a temporary work-around to our issue.  Basically, they had me create a new DOS protection profile and policy which only applies to in/out traffic on service-https.  They said someting about it fixing the issue in testing and for other affected customers.  Note this is a temp-fix until they get a proper update rolled out.     ... View more

Just as an addition, I had a "dataplane under severe load" happen again this morning.  System reasources applet on the Dashboard didn't register much, but the logs showed the CPUs were at 100% for well over 20 mins.  This is also with 7.0.3, which should have fixed it.  Spent 45 mins on thep hone with support and they gathered the log files to look at causes, but did say that our box should not behave this way given the size of our organization.   As we just upgraded from a 3020 to a 5050 to fix this issue, we are NOT happy about this.  Palo has really slipped with the 7.0.x code.  If you spend $100,000, you should NOT expect these kind of issues.   Rant over. Dannon       ... View more

We also have this problem.  We have use LIghtspeed, M86, Cymphonix, Bloxx, and now Palo for internet filtering in the last 10 years.  By far Lightspeed had the most useful reports for managers: they included things like top keyword searches, suspicious keyword searches, and lots of graphs (pie, chart, etc).   Many times I need to run a report for a specific user to send to their manager for web activity.  I can easily get 200+ pages of data.  I've been told this is useless and takes too long to view.   I have asked to have reporting overhauled on Palo, but nothing yet.  I was really exicited for PanOS 7 cause I was told this was much better.  Alas, it was only ACC and not reporting.   I've even asked to have the live Traffic and URL logs be color customizable.  I'd love to see blocked sessions in red and allowed session in green, for example.   Just my 2 cents. Dannon   ... View more

We are also having the same issue.   I've got an open TAC case with log files and information.  Hopefully this will be fix ASAP.  We rely heavily on SSL decryption. ... View more