About Lucky

Hi Khang,   Shellshock is a fancy name for specially crafted packets in client-to-server communication that are trying to exploit bash and could lead to execution of arbitrary commands on the server.   If you have your own trusted hosts on the originating side (if this is from your own network as you are suggesting) I would definitely open a case with TAC and see if this is a false positive or you might have compromised hosts in your network that are trying to enumerate / exploit servers within. If it is False Positive - PAN needs to solve it; if it is not False Positive than some probes for vulnerable bash inside of your network would be considered indicators of compromise.   Best regards, Luciano ... View more

Hi Mike,   can you raise debug on the client side? Should be enabled from the GP configuration for users, you can collect troubleshooting information for network configurations and routing table. It is worth investigating is there some conflict in third-party software as well (why is customer using SSL VPN? Are they using some IPsec VPN at the same time that sets default route with same metric...?) I am thinking, error is not the happiest description what happened - it might be having problems installing default route to the client...   Raising debug on client and investigating client's routing table would be my first steps, before I take it to the GP, especially if everything works with all/most of other clients, debugged logs should tell you more anyhow. I would also try using the latest version of client, 3.0 has been out for a few days - perhaps it will solve your problems.   Best regards, Luciano ... View more

Hi,   did you check your pcaps from the clients... could you be having some horrible overhead, or lots of drops/retransmissions? You should see significant difference in performance between IPsec and SSL, anyhow. Have you tried looking at IPsec and Tunneling Resource List to check if any of the documents for configuration/troubleshooting would reveal cause? Also, have you tested it with GP agent version 3.0.0? It should be out since a few days ago.   Best regards,   Luciano ... View more

Hi, Andres,   you can find details on bugs already fixed as well as known issues for every of the PAN-OS versions, those are found next to their respective software updates, here: https://support.paloaltonetworks.com/Updates/SoftwareUpdates You can check release notes for 7.0.5 and it will show all bugs fixed from 7.0.1 onwards, as well as known issues not fixed yet, including decryption problems (if link doesn't work, just go to above "softwareUpdates" link and get them from there).   Best regards, Luciano ... View more

There were feature enhancements in 7.0 and additional ciphers were added, it is worth checking. There are no reports on instability of 7.0.5 either, it is just a fresh version 🙂 ... View more

Hi, J.K.,   I am not aware of any practical way to do it. You could create exceptions for some threats but that would not except them only from getting pcap but also from receiving the action set in such rule (it would not be blocked, you would not get alert or no connection would be reset) so ... no, sorry, that's such an upractical overkill for a simple task.   For what it's worth, you can always collect all pcaps, and than occassionally use filter rule for threat logs to see only logs with pcaps, so you could  add threat IDs or names to build upon this filter and see on what days you have pcaps you want to keep: ( pcap_id neq 0 ) Once you found out what pcaps you WANT to keep out of all you have, note the dates they occured on, than proceed and delete directories for all other pcaps. You can use asterisk to partially replace date, in example below I deleted only pcaps from days of the month starting with 1* in Sept 2015: luciano@PA-200> delete pcap directory 201509 20150918 2015/09/19 00:59:52 4.0K 20150919 2015/09/20 00:21:49 4.0K 20150920 2015/09/21 01:55:55 4.0K 20150921 2015/09/22 00:11:41 4.0K 20150922 2015/09/22 23:29:07 4.0K 20150923 2015/09/24 00:07:17 12.0K 20150924 2015/09/24 23:45:41 4.0K 20150925 2015/09/26 01:18:24 4.0K 20150926 2015/09/26 10:03:44 4.0K 20150927 2015/09/27 23:38:44 4.0K 20150928 2015/09/28 21:50:09 4.0K 20150929 2015/09/30 00:06:27 4.0K 20150930 2015/10/01 00:04:34 4.0K <value> Directory name <Enter> Finish input luciano@PA-200> delete pcap directory 2015091 20150918 2015/09/19 00:59:52 4.0K 20150919 2015/09/20 00:21:49 4.0K <value> Directory name <Enter> Finish input luciano@PA-200> delete pcap directory 2015091* successfully removed 2015091* luciano@PA-200> delete pcap directory 2015091 <value> Directory name <Enter> Finish input luciano@PA-200> delete pcap directory 201509 20150920 2015/09/21 01:55:55 4.0K 20150921 2015/09/22 00:11:41 4.0K 20150922 2015/09/22 23:29:07 4.0K   Not too much of a help with this footwork, but at this moment I can't figure out better or even any other way to keep pcaps you want but to still try to free some space on your device by deleting unneeded pcaps.   I was thinking it could be scripted out, perhaps, by reading logs from CLI and sorting this information out, but that's out of the scope of support offered from this community member 🙂 You can always request a feature through SE who is supporting your organisation, in the worst case.   Best regards, Luciano ... View more

Hi,   from the top of my had with so little inflrmation I would say always go for the last / highest version available, unless you have really good reason not to use it?   Best regards, Luciano ... View more

Hi, Soport Seguridad,   for what it's worth, change in behavior was noted in release notes for 7.0, in "Management Features", with a link for more information. I know this is "captain hindsight" help 😕 Reaper is right with his answer too, this is only a calculation based on your current situation. You can check defaults by clicking "restore defaults" in the bottom right corner of the panel for logging and reporting settings, to do that go to Device > Setup > Management > Logging and Reporting Settings, as in screenshot.     Best regards,   Luciano ... View more

Brad is right, sometimes it can take more than 24 hours but if it takes more than few days and you don't get any notifications back, you should open a case to follow up. ... View more

Hi,   I am not sure how are you going to distinguish between 'something.zip/download?nowrap' and 'sourceforge.net/projects/filezilla/files/FileZilla_Client/3.13.1/FileZilla_3.13.1_win32.zip/download?nowrap'? .... and even something.zip can have subdomains and sub-subdomains, so you can't work around http:// neither....I think that your best guess is still to go with "continue" for this special category, if that matching of .zip/ does not work out 🙂   regards ... View more

Hi,   I think you probably want to add UDP to TCP7080 and maybe rename it just to "port7080" so it is not misleading 🙂   Regards   Luciano ... View more

Hi Matt,   EDIT - Bradley already responded with the easiest way from GUI: holding "shift" and selecting first and last should select all items in between, at least that's what works for me from the latest SeaMonkey (firefox-like browser but without DRM built-in)   otherwise - smash the xml in editor of your choice as gentleman noted 🙂   Regards   L.   p.s. I vote for vim even though I use both npp and sublime in GUIs :))))) ... View more