About gafrol

Hmm, but in his policy he has configured service "application-default" which should limit communication to the standard ports of the protocol, eg. ssl = 443, web-browsing = 80 etc. However I tend to use only ports not apps for inbound traffic. ... View more

That's what we monitor ... View more

- Ability to deploy and update User-ID Agent from the Firewall UI/Panorama. This would make life much easier in large environments - Abilty to run scheduled commands (cron ?), such as a system reboot directly on the Firewall - Ability to run local backups on the FW and export via ftp/tftp/scp/smb (this is an old one...) - Improve FW UI in a way  to allow creation of Rule Sections. Now the rulebase is quickly becoming very confusing. Look at the Migration Tool, that's how It's done (Thanks Albert 🙂 - Ability to analyze MS Office files and pdf's in Wildfire - Integrated WAN acceleration Technology would be a killer 🙂 ... View more

Thanks for the info. Any other user experiences ? ... View more

We are facing a problem with a lot of "unknown" URL's (Brightcloud DB) although the URLs in question are well known sites. We already filed a case but the problem could not get fixed until now. We are on 5.0.7. After clearing the url-cache all works fine again for a unknown amount of time (days,weeks). But clearing the url-cache manually every now and then cannot be the solution. Now I am reading about a bug in the cache timeout value. dyang schrieb: By default, the cache has a timeout value of 24 hrs.  We recently identified a bug recently where this variable was not getting configured properly, but this should be addressed in a future release (meaning you'll be able to configure this to a number of your choosing). Can you give us some more info about this one ? rgds Roland ... View more

Had the same issue a week ago. Downgraded to 5.0.6 since hotfix was not available at that time. All working fine with 5.0.6. ... View more

Already done ... View more

In my experience and the environments I work in there is at least one internal DNS Server, and client dns traffic is not allowed to unknown , external Servers. Good IT Security concepts are still an important part of an Enterprise Security posture even in the age of NGFW's 🙂 Although I understand the message behind the video demonstration... ... View more

Ahh OK thanks, good to know ! ... View more

Testing the PAN OCSP responder with "openssl s_client -connect ocsp.company.com:443 -tls1  -tlsextdebug  -status"  (PA-200 5.0.4) root@backup:~# openssl s_client -connect ocsp.company.com:443 -tls1  -tlsextdebug  -status CONNECTED(00000003) OCSP response: no response sent I was expecting to see something like OCSP response: ====================================== OCSP Response Data:     OCSP Response Status: successful (0x0)     Response Type: Basic OCSP Response     Version: 1 (0x0) ... View more

Ok, wait a minute what is the difference between a MP cloud url lookup and a CLI url test in terms of timeout ? Anyway I increased the timeout from 5 to 10 seconds and cleared the url cache, didn't change anything. ... View more

I have the same problem here testing the url on the CLI for the first time testing the url on the CLI the second time All URL profiles have the dynamic check enabled, additionally I have set deviceconfig setting url dynamic-url yes . But webbrowsing to that url again after the CLI test categorised it correctly the url monitor shows Does not make sense to me, to fire up a CLI url test before it gets resolved into a category... The same strange behavior with other in the first place "unknown" or "not-resolved" url's for example www.myexpertone.com Anyone else ? ... View more

https://live.paloaltonetworks.com/message/10581#10581 ... View more