About hyadavalli

hyadavalli · ‎10-25-2014

Hello, When you exported and imported certificate did you by any chance exported private key also? Regards, Hari Yadavalli

hyadavalli · ‎10-23-2014

Hello, Please try below suggestion for custom application to allow manager skype

hyadavalli · ‎10-22-2014

Hello KC, Do you have a sample packet capture for above MIME type? I was doing some research on 'application/x-msdownload' but I don't find any Media type in that format. What exactly you are trying to create custom application for? Regards, Hari Yadavalli

hyadavalli · ‎10-22-2014

Hello David, Scenario-1: Application - Web-browsing and service - any In above policy firewall will allow traffic if it identified as web-browsing on any service Scenario-2: Application - web-browsing and service - application-default In above policy firewall will allow traffic if identified as web-browsing and destined for port 80(default port for web browsing) Scenario-3: Application - any and service - tcp/80 In above policy firewall will allow traffic if traffic is destined to port 80 irrespective of application So it's like an AND operation between application and service. Hope this hepls. Regards, Hari Yadavalli

hyadavalli · ‎10-06-2014

Hello, 1) if there is a dependent application then firewall will check from top-down whether dependent application is being allowed as mentioned in the document. 2) My recommendation is to allow web-browsing in policy 150 and apply url filtering profile. Since policies 20-30 are user restricted policies eventhough you allow web browsing in those, rule 150 still need an explicit dependent application allow policy to avoid commit warnings. Hope this helps. Regards, Hari

hyadavalli · ‎10-03-2014

Hello All, I have a hot case(248797) where customer has upgraded panorama from 5.1.x to 6.0.x where in log forwarding process has stopped from firewalls after upgrade. After some troubleshooting I did notice that firewalls show as connected but below command for log-collector status show as No >debug management-server log-collector-agent-status whereas on panorama device show as connected. For this I had to restart management-server process on one firewall and that started log forwarding process. debug software restart management-server Since customer has around 200 firewalls he won't login to all the firewalls and do the above step and he is looking for an automated way or script to run such that management server process can be restarted without login into firewalls. Regards, Hari Yadavalli

hyadavalli · ‎08-07-2014

Hello, You can clone the policy and with no schedule set the action to deny and associate a tag to it. Use the above tag in alarms under 'security policy group limits' and also enable web alarm notifications. Hope this helps. Regards, Hari Yadavalli

hyadavalli · ‎08-01-2014

Hello Simon, Try making the scope as session instead of transaction. Regards, Hari Yadavalli

hyadavalli · ‎07-25-2014

Hello Sebastian, Lemme clarify this, QoS policy is session based. So if you have a QoS policy for outbound traffic then all the return traffic will also follow the QoS policy and bandwidth limiting is done based on the QoS profile applied to inside interface. Please take a look at below screenshots and let me know if that makes sense to you. In below screenshots ethernet1/1(Untrust-L3) is outside interface and ethernet1/2(trust-L3) is inside interface. Regards, Hari Yadavalli

hyadavalli · ‎07-17-2014

Hello, Are you getting user-ip-mapping from user-id agent or from captive portal authentication? Regards, Hari Yadavalli

hyadavalli · ‎07-11-2014

Hello Dave, Make sure you commit the changes and disabled pre-emptive on both firewalls. Regards, Hari Yadavalli

hyadavalli · ‎07-11-2014

Hello Dave, In your situation try disabling pre-emptive on both firewalls. Regards, Hari Yadavalli

hyadavalli · ‎07-10-2014

Hello Javith, external users should use both isp to reach web servers in active/active ha mode->load share/balance.. For above sentence we donot support load balance. trust l3 ips connected to cisco switch should be different..right?---> Yes dns servers for both isp's are different..so i changed default 4.2.2.2/8.8.8.8 to isp dns servers..right?----> optional web servers should be exposed to external users-so configured s-nat static and tick bi-directional..right?----> Yes For better practice on configuring HA Active/Active please follow below document. Configuring Active/Active HA PAN-OS 4.0 The above document is similar in PANOS-4.1 and 5.0 as well. Regards, Hari

hyadavalli · ‎07-02-2014

I only see one SHA reported as malware and rest as benign. Please open a case with palo alto support and they'll address the issue with wildfire.

hyadavalli · ‎07-02-2014

Based on the SHA provided in initial comment I see wildfire reported as malicious

Member Since	‎11-08-2012 09:47 AM
Date Last Visited	‎02-03-2026 09:00 AM
Posts	416
Total Likes Received	35

Online Status	Offline
Date Last Visited	‎02-03-2026 09:00 AM

About hyadavalli

Re: Commit Error "commit operation aborted as all daemons are not available"

Re: group mapping issue

Re: group mapping issue

Re: Problems with ms lync / url filtering

Re: This webservice call is only available to Panorama

Re: This webservice call is only available to Panorama

Re: HA failover problems 6.1.1 PANOS

Re: What happens if Dynamic Block List server is inaccessible?

Re: Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

Re: Issues with geolocation IP addresses

Re: Increase paste buffer on PAN (or other import methods)

Re: Not showing dynamic updates for global protect data file even we have licens global protect licens,.

Re: Bright cloud DB classifications on url

Re: Report: how many unique IPs from particular network where active?

Re: Agentless User-ID

Re: Problem with Captive portal :

Re: Maximum number of custom app-id's

Re: Configure Certificate Based Authentication for IKE: ISSUE Cert

Re: Skype manager custom application

Re: Can I make custom application from MIME type?

Re: security policies: application vs service

Re: Application Dependency Warnings

Script to restart management server process on firewalls

Re: Policy schedule end notification

Re: Custom Vulnerability Object to detect Failed WordPress Logins

Re: QoS Best Practices - complete concept/configuration - big picture for QoS

Re: User IP-user-mapping incorrect

Re: Active/Passive HA Sync Issues

Re: Active/Passive HA Sync Issues

Re: Active/active ha config

Re: Havex Malware

Re: Havex Malware

Seattle Hardware Beta

Seattle Beta

Unlock your full community experience!

About hyadavalli