About grenzi

Hello everybody,     the thread subject is pretty self explanatory. I'm playing with the file-blocking feature and doing some testing. What I've found in my lab environment, using both PAN-OS 10.0.1 and PAN-OS 9.0.9 and both VM-Series an PA-820 appliance, is that file blocking is not always working with application owncloud-uploading.   I have a file-blocking profile configured to block pdf, exe and msi files in both directions (upload and download) and this is what I just found.   **Scenario 1** Web server: Apache 2.4 Application: Nextcloud 19.0.4 Server architecture: x86-64 PHP: php-fpm SSL forward proxy: enabled   Scenario 2 WebServer: NGINX 1.19 Application: Nextcloud 19.0.4 Server architecture: ARM PHP: php-fpm SSL forward proxy: enabled   In Scenario 1, if I try to upload or download any of the blocked file types, the firewall correctly denies the session as expected and logs the event into the data filtering logs.   In Scenario 2, if I try to download any of the blocked file types, the firewalls denies the session as expected, but if I try to upload the file the firewall permits the session and the upload is successful.   Any idea on how to investigate deeper into this issue? I will update this thread as soon I have time to try other web application on a NGINX web server.   Thanks ... View more

Hello everybody!   It's quite a while since I'm using the Clientless VPN feature to offer access to some web applications to remote clients. When someone logs into the portal and starts using the apps, on the monitor tab I can see the real ip address that the client is coming from, but from the application point of view all the connections are seen as coming from the firewall ip address (that acts like a web proxy). Is there a way to configure the GlobalProtect portal to forward the real ip address of the client to the application, just like a reverse proxy does with the X-Forwarded-For header?   Thank you in advance! ... View more

Hello everybody,     I know it is a faq already asked on the community forums, but in this case it is especially related to this particular configuration: PAN-OS 9.0.4 on a PA-820.   Starting from the day I installed 9.0.4 on this machine, I see the management cpu always at 100%; the top 5 processes with higher cpu usage are the httpd and four pan_task processes, and I can't figure out if it is a normal behavior or not. I remember that when running 8.1.x there was not such problem.   PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 10539 nobody 20 0 2453580 176216 7956 S 198.7 4.3 10646:37 httpd 3505 root 20 0 75960 22496 7620 R 100.0 0.5 31708:51 pan_task 3506 root 20 0 50780 7868 6840 R 100.0 0.2 31708:41 pan_task 3507 root 20 0 51624 9448 7472 R 100.0 0.2 31707:54 pan_task 3508 root 20 0 51624 9572 7544 R 100.0 0.2 31708:54 pan_task The device is very low on network and resource usage, with as low as 10 users and less than 1000 cuncurrent sessions.   Is anybody experiencing the same issues with 9.0.4? ... View more

Hello everybody,     from time to time, whenever I commit small changes to my PAN firewalls, if I click on the "Preview changes" button I see (beside my changes) a list of items and configuration partials that are moved around, ie custom report configurations deleted from the top of the config and then added again in a lower portion of the config listing. Even though the overall configuration stays the same, this "fictitious" changes make the "Preview changes" feature pretty confusing and sometimes I'm unable to understand if all the changes are only cosmetic or if they hide some unwanted changes. Do any of you have the same problem? Thanks in advance. ... View more