About VinceM

Hi all,   Of course you can do that with custom app 🙂 In the advance tab when you create new app, you can define your own signature. If you select for exemple http-request-header and paatern "Chrome\/", it will work. For other browser, just make a TCP dump of your http request "GET" and identify the unic stream.   But it's true, it will be not very efficient, nothing is more easy to fake than http header 🙂   Hope help.   V. ... View more

Hi,   Raido is right. Class 4 is the default one for all traffic which doesn't match any QoS rule. Then no chance for you, it's the only class you can't use in your case 🙂 Just chnage it. V. ... View more

Hi,   Depend of you PANOS version but by default the IntrZone traffic (Untrust to Untrust) is not loggued. Mean no trace in logs. You need to activate them. After that if you want to be protected against floods, fragmented packet ... you need to configure both zone protection and / or DOS policy.   Hope help.   V. ... View more

Hi,   Thx for all info. Mean ECMP with static routing is not usable. Maybe with dynamic it make sense ....   V. ... View more

Hi   I agree with you but for sure Palo guy have not implement this feature without thinking we need to monitor access ... I hope.   Rgds   V. ... View more

Hi,   If you really need GP, it can be interesting for you to upgrade to V7. In this release, licence had been simplify.   According the VY RN: "You can now use GlobalProtect to provide a secure, remote access or virtual private network (VPN) solution via single or multiple external gateways, without any GlobalProtect licenses. The portal license, which was required to enable this functionality, has been deprecated. However, advanced features including Host Information Profile (HIP) checks and support for the GlobalProtect mobile app for iOS and Android still require a gateway subscription. To take advantage of the new license structure, you need to upgrade only the device running the GlobalProtect portal to PAN-OS 7.0 or later."   We are in 7.0.2 and everything works well 🙂   Hope help.   V. ... View more

HI,   Thx for your help. But it seem it's not enaugh for blocking psiphon 😞 I ask for new app.   V. ... View more

Hi Cos,   Got same info but memory alert. Seem to be normal.   Hope help.   V. ... View more

Hi,   URL filtering can't be used because after "installing" the psiphon client, you need to initiate connexion. These connexions are based on SSL then no URL filtering ... 😞   V.   ... View more

Hi,   Agree with baudy. Admin profile is not correct. Not enaough right for seing full IP.   V. ... View more

Hi,   Short question, did you not configure AD replication between your site ? Peaple in the US shold not use AD in TW for opening session ..   Then 1 palo, 1 agent per site should be enough. Depend of you replication time between ADs.   Hope help.   V. ... View more