About reaper

small correction: In floating IP each device has a unique VMAC and in case of failover the VIP is moved to the active peer's VMAC using gratuitous ARPs sent out from the active member, the VMAC itself does not move ... View more

Hi Eugene This document may prove helpfull: https://live.paloaltonetworks.com/docs/DOC-1756 Page 7 describes our behavior in vwire, pages 8 and 9 our layer 3 behavior. Basically, for vwire you will need layer 3 devices as we act as a wire. In L3 we support 2 modes of operation: Floating IP and ARP load sharing. Floating IP assigns a/multiple VIP per gateway and these can be used by hosts in the network as gateway In case of failover the VMAC to this VIP is transported to the other peer via gratuitous ARP In ARP load sharing a VIP is shared among the HA peers, but each with their individual VMAC. The device that responds to the ARP request is determined by computing a hash or modulo of the source IP address of the ARP request. In case of failover the VMAC is transported to the remaining peer via gratuitous ARP. regards ... View more

Hi have these services been setup with a specific purpose in mind? the http_mapped and ftp_mapped are actually redirect services that would divert traffic to a predefined ip and port, but the services would look like eg. (80,10.1.1.1,87) where  port 80 is intercepted and forwarded to 10.1.1.1 on port 87 where the original destination IP should be that of the firewall you should be able to easily reacreate this by setting up PBF to forward specific applications or NAT to do port translation backweb is most likely a custom service, if you search your services tab it should be listed with its port information (search the UDP services) ... View more

a .torrent file is a link file to a set of "trackers" and information about a specific torrent like file name, file size, pieces it was broken up in, ... this file can then be loaded into a torrent client that uses this file to connect to the trackers and request information on that specific file (like which peers are "seeding" the file to the p2p network for download) http://en.wikipedia.org/wiki/Torrent_file "A torrent file stores metadata used for BitTorrent. It is defined in the BitTorrent specification" a .lnk file is a shorcut file as used on microsoft desktops to provide an iconised link to a URL or location/file on your harddrive or network ... View more

Hi if you want your inbound SSL to fall under a different app ID without decrypting it, the way to do this would be create a custom app and settng an app override rule to reidentify this traffic into this custom app, alternatively you could reuse an existing app but this may cause confusion as ssl will show up as a completely different app I would recommend decrypting this traffic as it is inbound and could thransport a threat into your network. ... View more

Hi the application and service field share an "and" relationship you can add an application and then set the service to limit for example http to only port 80 (preventing http over 8080 and other ports) in your example you should create 2 rules, one for the applications, and one for the service traffic categorised as not-applicable is not categorised because it is dropped due to it not hitting an allow rule ... View more

The region is available as an option when specifying source and destination for security policies, decryption policies, and DoS policies. If you would like to see region based objects in different policies you can contact your SE to have him open a feature request. ... View more

Hi Albert here's a checklist that may help shed some light on your issue: 1. Must run 64bit IE for installation (if running on 64bit system) 2. Must install 64bit Java (if running on 64bit system) 3. The Java security setting “mixed code (sandbox vs. trusted) security verification” must be set to “disable verification” to allow the SSLVPN client to be installed and running correctly. 4. User must have admin privilege for initial installation. 5. Verify that the AV client installed on the PC is not causing a conflict with Java and/or SSL vpn client installation. 6. Verify that you are on at least software version 3.1.1 for the paloalto device. 7. Verify that you are on at least version 1.1.1 for the ssl-vpn client. https://live.paloaltonetworks.com/docs/DOC-1584 ... View more

can you verify the user association via "show user ip-user-mapping ip x.x.x.x"? when a user is experiencing the aforementioned behavior this mapping will probably be -unknown- for his IP address check the same IP address on the panagent, if it is -unknown- there too, verify the cnfiguration you may want to increase the age out timeout so user data is stored longer ... View more

Hi Kazjak you should be able to add these users to that group and then add that group to the "ignore group" in panagent regards Tom ... View more

Hi Roh can you also check your security policy, it should be source tapzone destination tapzone action allow (and as indicated by johnny, make sure user identification is enabled on the tapzone) ... View more

try setting the allow skype-probe rule before the block skype rule, this may help decrease the number of probe connections ... View more

Bugs are always checked vs the versions "under construction" and if applicable fixed in both versions, where possible/applicable both branches are kept in sync (new or changed features in 4.0.1 that don't need fixing have not been fixed ofcourse and issues in 4.0 that are not present in 3.1 are not ported backwards) bugfix info is included in release notes ... View more