About murphyj

When I tried it with the Get it still did not work. There might be something with the version I'm running. I just test it on 6.1.3, when you have your setup is it for 1 ip address or a range? If its for a range how are you handling the last octet? ... View more

You could just create a DNS black list on your DNS server that points some place else for all of those sites its an internal address it won't hit your firewall.  ... View more

I ended up making the PA a Sub-CA since I was going to be doing decryption, but you should be able to do a CSR from the active get the cert. Click on the cert and set it as the webui cert and commit. Once you do that it should sync over, but when you do this you will still get an error every time you connect to each system individual and no error when you connect to the cluster address. ... View more

I ran into the same issue and what I found out is that the if you are running an Active/Passvice config you can only have one WEbUI cert per cluster. To get it so you don't have a a cert issue, issue the cert for the HA ip address and use that for your login. You are not able to have a cert per device but one for the cluster. ... View more

Out of curiosity are you applying a URL profile to the rule on the Security rule? Wither its by profile or group settings? ... View more

Upon adding the remaining part of the chain it worked, thank you very much. ... View more

When I do the command: less webserver-log sslvpn-access.log I do not see any reference to what you said this is what I currently see. - - [Tue Jul 23 10:50:21 2013 EDT] "POST /global-protect/prelogin.esp HTTP/1.1" 200 643 - - [Tue Jul 23 10:50:21 2013 EDT] "POST /global-protect/getconfig.esp HTTP/1.1" 200 6203 - - [Tue Jul 23 10:50:25 2013 EDT] "POST /ssl-vpn/prelogin.esp HTTP/1.1" 200 642 - - [Tue Jul 23 10:50:25 2013 EDT] "POST /ssl-vpn/login.esp HTTP/1.1" 200 2037 - - [Tue Jul 23 10:50:25 2013 EDT] "POST /ssl-vpn/getconfig.esp HTTP/1.1" 200 1997 127.0.0.1 - - [Tue Jul 23 10:50:45 2013 EDT] "GET /robots.txt HTTP/1.0" 200 284 - - [Tue Jul 23 10:51:42 2013 EDT] "POST /global-protect/prelogin.esp HTTP/1.1" 200 643 - - [Tue Jul 23 10:51:42 2013 EDT] "POST /global-protect/getconfig.esp HTTP/1.1" 200 6203 - - [Tue Jul 23 10:51:45 2013 EDT] "POST /ssl-vpn/prelogin.esp HTTP/1.1" 200 642 - - [Tue Jul 23 10:51:45 2013 EDT] "POST /ssl-vpn/login.esp HTTP/1.1" 200 2333 - - [Tue Jul 23 10:51:45 2013 EDT] "POST /ssl-vpn/getconfig.esp HTTP/1.1" 200 1997 127.0.0.1 - - [Tue Jul 23 10:51:46 2013 EDT] "GET /robots.txt HTTP/1.0" 200 284 127.0.0.1 - - [Tue Jul 23 10:52:46 2013 EDT] "GET /robots.txt HTTP/1.0" 200 284 127.0.0.1 - - [Tue Jul 23 10:53:46 2013 EDT] "GET /robots.txt HTTP/1.0" 200 284 - - [Tue Jul 23 10:54:00 2013 EDT] "GET /index.sslvpn HTTP/1.1" 200 480 - - [Tue Jul 23 10:54:00 2013 EDT] "GET /global-protect/login.esp HTTP/1.1" 200 7504 - - [Tue Jul 23 10:54:00 2013 EDT] "GET /images/global_protect.gif HTTP/1.1" 200 595 - - [Tue Jul 23 10:54:00 2013 EDT] "GET /styles/falcon_content.css?v=@@version HTTP/1.1" 200 41011 - - [Tue Jul 23 10:54:00 2013 EDT] "GET /images/logo_pan_158.gif HTTP/1.1" 200 3720 - - [Tue Jul 23 10:54:00 2013 EDT] "GET /favicon.ico HTTP/1.1" 404 382 The other commands show: debug user-id dump hip-profile-database No records exists or Matches! show user ip-user-mapping ip 172.18.20.2 IP address:  172.18.20.2 (vsys1) User:        ***\**** From:        GP Idle Timeout: 2591945s Max. TTL:    2591945s Groups that the user belongs to (used in policy) ... View more

Nothing shows up in Hips Monitor section. OS Contains Microsoft.All That's it for the whole thing. ... View more

Thanks for your time and information. ... View more

The the SNMP I was able to get the information to start logging, thank you. ... View more

Ya, I looking at the same thing, what I notice is if you set your PA as a Cert authority on your network you can set it to decrypt the search traffic only. This should allow you to block that traffic in theory. I have not had a chance to test it out yet. As for Bing I have been looking into that myself and noticed a couple of things. You don’t have to worry about the https with Bing it doesn’t really search that way. As for the filter: adlt=off is when safesearch is set to off adlt=moderate is when moderate search is turned on adlt=strict is for Strict searching I have not had time to create and application for it to test yet. ... View more