About dyang

dyang · ‎03-31-2013

Hi bulent, The file that you downloaded from our Support site is a signed file, so you must use the proper CLI commands: To import the file - scp import signed-url-database To install the file - request url-filtering install signed-database Let me know if you're still having issues with those two commands. --Doris

dyang · ‎03-28-2013

I think I heard my name PAN-DB does include IP address categorization, though the majority of entries are made up of URLs. While a lot of malware does go directly to IP addresses, we've also noticed that many streaming media applications behave similarly (eg BBC iPlayer). If you would like to safely enable these applications, use App-ID to do so. --Doris

dyang · ‎03-28-2013

Hi Bill, It may be helpful to share what URL categories you block on. Sites like CNN pull in a lot of various content from different sources, so if you have CDNs (content delivery network) as a blocked category, it could result in the behavior you described. --Doris

dyang · ‎03-27-2013

There is no difference between the two commands - they do exactly the same thing. We most likely will not remove the duplicate command since it may cause migration issues. Thanks, Doris

dyang · ‎03-27-2013

Hello, You cannot block files with more than 2 levels of compression today. If you would like this functionality, please contact your SE to submit a feature request. Thanks, Doris

dyang · ‎03-27-2013

The HTTP header is "X-Forwarded-For" , as noted in the Admin and CLI guides. If you provide me a link to the KB article in question, I can have it updated. My guess is that someone shortened it to "x-fwd-for" because it's easier to type. --Doris

dyang · ‎03-26-2013

egearhart, The main issue was the result of a bug in our code - we've added fixes to PAN-OS (5.0.4) as well as content, to resolve this issue. Version 363 of content contained most of the fixes, but devices would still exhibit some of the behavior mentioned here until a device server restart. Having the PAN-OS fix in 5.0.4 will prevent this from happening at all. Since 5.0.4 has yet to be released, it is recommended that any customer who runs into this issue should follow the above steps. --Doris

dyang · ‎03-25-2013

If you're getting category "not-resolved", that usually indicates an issue communicating with the server itself. As mikand mentioned, please contact Palo Alto Networks Support directly to better troubleshoot and resolve your issue.

dyang · ‎03-22-2013

Hi everyone, The issue stems from a fix we made with content release 363, which was released to address a larger issue regarding how URL categories are saved in PAN-OS. At the moment, it appears that the bug is limited to the 5.0 codebase. For those of you who encounter the issue, please follow the steps recommended to re-initiate your device server: 1. Make sure the latest content is installed ( > release 363) 2. clear url-cache all 3. delete dynamic-url host all 4. debug software restart device-server 5. configure 6. set deviceconfig setting url dynamic-url yes 7. commit The above steps will help ensure that the list of URL categories are properly initialized in the device server and will prevent further crashes during URL lookups. I'd like to thank everyone for their help and patience in resolving this issue. Thanks, Doris

dyang · ‎03-21-2013

Hi everyone, Thanks for your comments - as mentioned, Palo Alto Networks does not have a downloadable list of bad/malicious IP addresses for people to import. Instead, as our threat team identifies malware, they automatically take any URL or IP associated with that threat and will include it as part of the PAN-DB URL filtering database. There are certainly a number of 3rd party vendors such as spamhaus.org that provide downloadable lists that you are welcome to use with the dynamic block list feature. --Doris

dyang · ‎03-21-2013

Hi ahpadmin, There's currently a discussion on another thread regarding the issue that you've encountered: Re: All sites registering as "unknown" Please follow the instructions listed there to resolve this issue. Thanks, Doris

dyang · ‎03-21-2013

Hi bmellem, As mentioned before, please restart your device server in order to resolve this issue. Thanks, Doris

dyang · ‎03-20-2013

Hi everyone, Just a minor update - we're still investigating the root cause of the issue and why it seems to have only affected PAN-OS 5.0.x and not PAN-OS 4.1.x customers (if you're using PAN-OS 4.1 and see this issue, please let us know). In the meantime, it appears that the key to restoring functionality is to restart the device server - you should not need to clear your entire cache. More updates as they come. Thanks, Doris

dyang · ‎03-20-2013

When a device attempts to pull an update (or do a dynamic URL lookup) from BrightCloud, the device connects directly to BrightCloud's servers for this information, not the Palo Alto Networks update server.

dyang · ‎03-20-2013

Yes, we are actively troubleshooting this and I'll update this thread once we have some more details to share. Thanks again for everyone's patience. --Doris

Member Since	‎01-03-2011 02:54 PM
Date Last Visited	‎08-18-2015 09:06 AM
Posts	233
Total Likes Received	56

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

About dyang

Re: Safe Search Enforcement

Re: PA URL FILTERING UPDATES force to update the HA peer

Re: Newly registered domains - how does PANDB classify them?

Re: Browse Time in custom reports

Re: Newly registered domains - how does PANDB classify them?

Re: URL Filtering Log shows FORWARD

Re: URL Filtering Log shows FORWARD

Re: URL Filtering Log shows FORWARD

Re: wildfire findings into the pan-db

Re: Safe Search Enforcement blocking all Google / Bing / YouTube searches

Re: Block traffic to ip addresses

Re: All sites registering as "unknown"

Re: All sites registering as "unknown"

Re: commented file type list available?

Re: URL Category Any

Re: URL Filtering - PANDB vs. Brightcloud

Re: Tftp brightcloud databese issue

Re: Block traffic to ip addresses

Re: Websites with just text

Re: x-forwarded-for header parsing.

Re: block files with multiple level of compression

Re: x-forwarded-for header parsing.

Re: All sites registering as "unknown"

Re: All sites registering as "unknown"

Re: All sites registering as "unknown"

Re: Dynamic Block List Site

Re: 5.0.3 - ready for production?

Re: All sites registering as "unknown"

Re: All sites registering as "unknown"

Re: 5.0.3 - ready for production?

Re: All sites registering as "unknown"

Unlock your full community experience!

About dyang