About rmfalconer

Just to make sure, you have a URL list on an internal server and you want to have an EDL read from that? If so, you need to run an internal web server and then put your URL list, in .txt format, on that server.  Then create a new EDL and point the source to your internal server. ... View more

You should probably open a TAC case to check on the compatability of the transcievers. I'm using a 3rd party transciever on 8.0.6 in production but I tested the brand in a lab before upgrading production. You can't get to 8.0.6 without a reboot. Current best-practice to upgrade from 7.1.14 to 8.0.6 would be to install the latest 7.1 and reboot, take a snapshot for rollback, install 8.0 and reboot and then 8.0.8 and reboot.  ... View more

Do you have a security rule that denies access to the sinkhole IP address, with logging enabled? If so, you should be seing it in the traffic log. We have the sinkhole definition in our AS profile that's connected to outgoing security policies. There is a separate security policy that denies traffic to the sinkhole destination. I can search on the destination address of the sinkhole and it shows data in the traffic log. ... View more

I'm pretty sure the list of default root CAs only update when you upgrade PAN OS. I don't think they are rolled into any updates. I'm running 8.0.6 and I have Baltimore_CyberTrust_Root included. ... View more

You should be able to get everything you need from CLI commands using ' | match'.  You'll probably just have to figure out the exact syntax for each item you want, like 'show | match snmp' or 'show | match download'. ... View more

As long as you know the syntax of the command you are searching for, you can find it pretty easily. I prefer to use the set-based output on the CLI: fw> set cli config-output-format set   Then just do a match on the string you're trying to find: fw# show | match complexity set mgt-config password-complexity enabled yes set mgt-config password-complexity minimum-length 8 set mgt-config password-complexity minimum-lowercase-letters 1 set mgt-config password-complexity minimum-numeric-letters 1 set mgt-config password-complexity minimum-special-characters 1 set mgt-config password-complexity minimum-uppercase-letters 1 set mgt-config password-complexity block-repeated-characters 3 set mgt-config password-complexity block-username-inclusion yes   ... View more

OM3 is fine to use as long as you are under the supported distance. Generally, multi-mode SFPs use LED for the light source but I don't know for a fact that the PAN-SFP-SX does.  ... View more

I've found that sometimes you just have to keep trying with different applications on different lines. Try changing the width of your text editor so that there aren't any "-" marks at the line breaks. In your example, change the width so that google-docs-base is on a single line and the next app is on the next line. This does work, I've done it a lot. Sometimes you just have to tweak the formatting. ... View more

Users with standard permissions don't have access to the machine store. It's not a condition specific to GP. When you gave permission to the user for the machine cert, how did you do it? ... View more

Good to know. Thanks for posting the follow-up. ... View more

You can create filters but that would be used to allow only certain prefixes. Some would be blocked so you wouldn't have routes to these networks. If you need to support over 2000 prefixes, you'll need a larger device.   You should check with your reseller or PA to size correctly. Also, for the malformed AS message, are you using a 2 byte or 4 byte AS number? Did you select the correct option in the BGP config on the PA? ... View more

L2L is Lan to Lan, an ipsec tunnel between sites. That would definitely support multiple subnets on the Linux side. You would also have to use additional software on the Linux box to support the tunnel. Or use another device at the Linux site that can peer with the PA. If the Linux setup is a one-off, then this might be something you could try. But if it's something you need to roll-out to a lot of sites, it probably won't scale well. ... View more

If the peer is advertising all 2000+ prefixes to you, then it will be a problem.  Do you need all 2000 prefixes? You can configure inbound rules to permit specific prefixes or maybe the peer could send a summary.   ... View more