About dagibbs

willstech wrote: Hi all. somebody who has a datasheet of disk usage for every single appliance including PA 5000 series?? Of course I know it is impossible to calculate correctly because it is depend on customer’s networks environment. What I want to know is that just rough disk usage for every single appliance. Below is an example.(below table is an incorrect data. it is just an example for understanding my question.) Model Total Disk assigned disk size for log internet speed number of days (roughly) PA-2020 80G 50G 100M 7days. Regards, Eugene. There's no hard and fast answer for this. The amount of disk space used for logs and how rapidly it fills is related to how much logging you have enabled/turned on. I've now had my PAN devices in operation for approximately 6 months, and have used only 48% of the 125G allocated on the logs partition - but while I log traffic, I *only* log URL filtering for certain categories, not every single transaction - which means the log load is a lot lower than it could be. If I cranked the URl filtering up to logging every single transaction, regardless of allow of deny status, I'd eat log space a lot faster. As always, YMMV. ... View more

lifenethealth wrote: I'm using a PA4020 and although this is the first PA device I've ever used, on 4.0.1, I've also noticed that it's almost painful to manage.  Even doing a commit, I walked to the restroom, got a cup of coffee, and when  I came back, it took a few more moments before it completed. I realize, at least I've been told, that the management sluggishness is not related to the actual traffic and processing of security rules.  That's a umm, good thing, because it it wasn't, we would have definately returned these boxes immediately.  Thankfully my immediate manager doesn't have to deal with the sluggish behavior or I wouldn't be using them now... I find not a whole lot of difference between a commit on a PA2050 and my old Checkpoint cluster. It depends how many changes you make at once - the more changes, the longer it takes - but remember, the PAN is pre-processing the commit to confirm it complies and doesn;t break anything, *and* keeping the dataplane running while it activates the changes. Having said all that, they're definitely not as fast as, say, a PIX or ASA o save a config - but then again, the PA devices work a whole lot better. 🙂 ... View more

devere wrote: after much aggrevation the problem was the layer 3 switch. it developed some fault where it couldn't correctly route to the PA on different VLANS. On a side note would it be ideal/practical to use the PA as my layer 3 device also? I wouldn't call it either - the PA is already doing a lot of work - firewall, web filter, virus checking, threat detection and filtering - adding layer 3 for your entire network, while possible, would not be the greatest idea. Having said that, you *could* do it - I just don't know if it'd be the smartest idea, not knowing which model PA you have. Cheers. ... View more

mwaters31 wrote: As somewhat of a newby to PAN, I need to ask how do I go about passing an internal public IP range outbound through the firewall and NOT natting it.  This certain range of addresses will only connect to one other public IP address (different, external network) but the other address needs to be able to see these internal IP 's for what they are and not be natted. Thanks!  Mike Are your "internal" addresses RFC1918, and your external "live" Internet addresses? If so, I don't see how you're going to get your "inside" addresses routed by your external provider - ISP edge routers should be configured, by default, to drop anything from or two an RFC 1918 address range. Enquiring mind wants to know. 🙂 If your "internal" adresses are live, routable addresses then my question is probably invalid - also similarly invalid if your "external" link is some form of point-to-point link which only uses RFC1918 addressing in the path. Cheers ... View more

nrice wrote: Please open cases with your support provider when you experience this issue.  It sounds like a bug. I've logged a ticket with our support organisation. We'll see where it goes. Thanks. ... View more

asabadin wrote: Greetings all, This is my first post as a new palo alto customer......so I'm hoping someone can shed some light here. I'm trying to install the netconnect vpn client on win 7 64bit it gets to the point of PanSetup.msi and the just disappears..... I assume 64 bit is the problem because it work on 32bit......that's the only difference I can see.... Any Ideas?? Many thanks Albert Albert. There'a s simple checklist to get the SSL VPN client working on Windows 7 64 bit. 1) Make sure you have the 64 bit version of Java installed. The 64/32 bit versions can co-exist, but you should check the environment variable "JAVA_HOME" exists, and points to the correct base Java directory ( in my case, JAVA_HOME is set to c:\program files\Java\jre6) 2) Ensure you run with the 64 bit version of IE, NOT the 32 bit version (which is the default, even on Win7 64-bt). You might have to go looking for it in your menu - most of the default shortcuts etc fire up the 32 bit version, but the 64 bit. 3) Modify the default Java security settings by going to Control Panel -> Java, selecting the "Advanced" tab, then under the "Security" option set the "Mixed Code (sandboxed vs. trusted) Security verification" to "Disabled". The rest is easy - point your browser to https://<your hostname or ip>, login via your selected credential method and the install should work fine. Once it's installed, you can just use the icon placed on the desktop from then on - no more need to fire up the 64 bit version of IE. Cheers. ... View more

devere wrote: The Palo Alto is connection on port 36 on the Layer 3 Switch, that port is on the VLAN 100. Basically all the users have their gateway to the Layer 3 switch. The Layer 3 switch then forward all requests to 192.168.200.254 which is the interface of the Palo Alto. Only users on the VLAN100 are managing to access the internet which is on the same subnet of the PA I used to manage on my old firewall through some rules (these were done by some company). Hope I made myself clear. Cheers Do you actually have a route in the Palo Alto to get point traffic back into the network via VLAN100? The PA won't need a route to VLAN100 - because it's a directly connected network, the PA will just "know' how to get to devices in this network. However, if you don;t have a VR setup on the PAN telling it how to get traffic back tot he other VLAN's - for example, route 192.168.201.0/24 via 192.168.200.1. The configuration should look something like this virtual-router {           router-1 {             interface [ ethernet1/1 ethernet1/2];             routing-table {               ip {                 static-route {                   servers {                     destination 192.168.200.0/24;                     interface ethernet1/1;                     nexthop {                       ip-address 192.168.200.1;                     }                   }                   level1 {                     destination 192.168.201.0/24;                     interface ethernet1/1;                     nexthop {                       ip-address 192.168.200.1;                     }                   } From the GUI, you should have something similar to the graphic attached - a route in the PA sending everything for the other subnets tot he "router" (layer 3) IP address for VLAN 100. Cheers. ... View more

kazjak wrote: We'd like to have an AD group called something like Pan-user-ignore group.  All the user accts that we don't want the angent to monitor would go in this group.  Then our Admins could add the user to the group as part of the account creation process.  Currently the Admin has to give me the username, I have to append the ignore_user_list.txt and restart the services on all my agents to force the changes. in a nut shell, we have a kiosk machine that is always logged in.  Any user with internet access can launch an app, enter their credentials and browse the web as themselves.  When the app closes it sends another security event changing the agents user to a "nobody" account. We have to ignore the kiosk acct otherwise during the users browsing experience the pc will send security events on behalf of the kiosk acct which switches the agent back to the kiok acct (which has limited browsing access). Create your AD group, add your users to it, and add the group to the file "ignore_group_list.txt' in the PAN agent directory. Restart your agent, and then you can simply add additional users to the AD group and never have to tweak the agent again. Mine are in the format "domain\group" and they work fine. Cheers. ... View more

cstoker wrote: Hi, I need to be able to create a baseline of firewall throughput.  I know that I can view the throughput real time with the "show system statistics" command, but does anyone know a way of monitoring this over time to use in graphs or reports.  I would like to have this data so that I know as new projects come up, the firewall can handle the additional traffic load.  Any help here would be greatly appreciated. Thanks, Chris Chris. I graph my PA's with Cacti. This gives me a 5 minute average of traffic on any port I choose using basic SNMP polling. You need to enable SNMP on the device, of course, but the PA is perfectly capable of answering the SNMP requests successfully. I have noticed that the PA will occasionally miss responding to an SNMP query for one or two polls - I can only assume this ocurs when the management module is extremely busy for oen reason or another (like an overly demanding admin [me!] requesting too many fitlers or reports from traffic monitors). You get something which looks like the attached JPG (in this case, the 'outbound" traffic is stuff going from the PA to my "inside" network - I.E. being downloaded from the internet or DMZ) Cheers ... View more

hi Jason. Couple of points from your query. The PA agent does not need to run on a Domain Controller. It can run on any server in the domain - all it needs is a domain account to run as (the agent is a service) which has appropriate rights to the Security audit logs. The exact nature of the rights required is documented, but basically the agent needs audit rights to the security log - which can only be assigned from the domain controller(s) it/themselves on an individual basis. The main selling point I used in implementing the agent (beside wacking the domain admin over the head with a big stick. :-)) was that the PA was intended to replace one of his most expensive devices (the websense filtering/proxy server), and it simply wouldn't work without the agent installed. if he wanted to save his tens of thousands of dollars a year in maintenance costs for the old web filter, then he needed to install my agent. Enlightened self-interest then encouraged compliance. When push comes to shove, if you don't have the rights to install the agents yourself (and I infer from yout post you don't), and the AD administrator is intransigent, your only call is to present your case to higher management, and let them fight it out. You could also point out the improved reporting and diagnostic ability with the agent correctly configured to management - this one is also a big selling point - the sheer visibility of user activity available when the UA is running and reporting correctly to the firewall may get you over the line. Cheers. ... View more

jnguyen wrote: below is a link to the list of supported sfp's https://live.paloaltonetworks.com/docs/DOC-1297 No there's not. The item doesn't exist. 🙂 ... View more

Also, get the ASA5505 administrator to confirm he hasn't done soemthing "funky' with the tunnel name. There's a "feature" in Cisco firewalls which require the tunnel ID ont he PIX/ASA to be the IP address of the remote end - just the IP address, *not* a name or anything else - or else phase 2 fails. This one bit me in the backside badly in a past life. Cheers. ... View more

jsherlow wrote: Hi There, This is possible: An interface cannot be in two virtual routers - however, you can have sub-interfaces in different virtual routers. So you can put a physical/logical interface from the new virtual router into the LAN and have routes to that IP for the new DMZ.  This interface would be on the same subnet, but different IP, to the other interface already in this LAN. Alternatively, you can move to PAN-OS 4.0.x and make use of one of two features: virtual router to virtual router routing PBF to virtual system and have the "New Network" in a new virtual system. Thanks James James. Thanks for that - I can manage to put another IP on the "inside" interface without too much hassle - since I don't think I'm quite ready to upgrade to PanOS 4 yet, I'll most likely run with that. Cheers. ... View more