About reaper

Hi John You can add an additional IP to the server and have the secondary NAT set up to this address. Make sure to have only the first address handled by PBF so the secondary will follow the default route out the secondary ISP. regards Tom ... View more

you could try setting up host routes on the routers, or use source/destination nat on the PAN eg. routes on PAN: 192.168.0.1/32(pc1) next hop 10.0.0.1(rtr) 192.168.0.15/32(pc2) next hop 10.0.1.1(r1) if you set the similar host routes on your routers, you won't need nat. on rtr 192.168.0.15/32(pc2) next hop 10.0.0.2(pan) on r1 192.168.0.1/32(pc1) next hop 10.0.1.2(pan) If this is not possible you can set up nat like: source 192.168.0.1(pc1) destination 10.0.0.2 sourcenat 10.0.1.2 destinationnat 192.168.0.15(pc2) source 192.168.0.15(pc2) destination 10.0.1.2 sourcenat 10.0.0.2 destinationnat 192.168.0.1(pc1) regards Tom ... View more

you can set the ACC to a specific time window and then click on the app you want information about, this will allow you to drill down and view more relevant information about this application (sources, destinations, users, ...) regards ... View more

Hi Chris you could also opt to not forward all log, but selectively forward only logs that are important and leave generic logs on the units you can accomplish this by setting logforwarding for critical and high risk threats, and select only the most important security rules to forward logs to panorama this could dramatically decrease the total volume of log forwarded to panorama Tom ... View more

the DNS proxy will behave like service routes: it will use the interface IP of it's eggress interface as source IP and the VR as routing table ... View more

Hi I noticed your PBF rules lack a next hop You'll need this next hop IP to route your traffic out to the next router so it will be able to go out to the internet. regards Tom ... View more

Hi Albert It's best to upgrade to 4.0.3 as soon as possible as 4.0.1 did have some issues with userID matching security policies, these issues were addressed in 4.0.3 regards Tom ... View more

Hi Bhav There are a couple of possibilities besides backing up logdb. You could implement a panorama management server which supports up to 2TB of disk space for logging, this would also allow you to run reports on this data as the log is still accessible and centrally manage your units you could also set up a nightly logexport (under the device tab > Scheduled Log Export), this will export the desired log as csv format to an ftp server alternatively you could also setup a syslog server as external log server ... View more

Hi The age-out timeout kicks in when a user was detected as logged in by a security event or netbios probe and does not trigger any other events to "refresh" his session for an amount of time equal to the number set in age-out timeout after which the user-IP pair is timed out (deleted from db if full-expire is enabled). The options affect all users in the panagent db, users picked up by captive portal are stored on the PaloAlto locally and are not purged by panagent options (unless the IP gets picked up by panagent for that or a different user, then it is overwritten) ... View more

Hi you can configure captive portal to present the users with a login page (redirect) requiring them to authenticate. these credentials can then be used to allow them access to certain network resources or internet websites: https://live.paloaltonetworks.com/docs/DOC-1630 ... View more

Hi John If netbios/WMI polling is undesirable you could go ahead and change some of the timeout parameters to better suit your environment, then go into the panagent config (config.xml) file and change the "enable-full-expire" setting to 1. This will ensure stale logins are removed from the database once the "timeout" is hit. ... View more

Hi If you are able to, disabling UAC will prevent this issue from occurring. If this is not an option, you will want to take a look at this UAC enabled install guide: https://live.paloaltonetworks.com/docs/DOC-1544 make sure to set the panagent service's logon credentials to a domain admin (rather than local system) regards Tom ... View more