About SCoupland

Indeed. I'm looking to poll the VPN to confirm it's status.  ... View more

The ability to push Auth Profiles, Server Profiles and Admin Accounts down to managed devices was added in Panorama V5. You'd have to upgrade to 5.0 on the Panorama (and I believe all the firewalls) to achieve this functionality or individually configure each firewall manually or do some cut and paste work with each firewalls XML config (I don't recommend that). ... View more

I believe that's because when using a specific group/user it's checking the account against the account on device before passing it to LDAP to check whether the username/password is valid on the LDAP server. When you select all it skips the check and simply passes to the LDAP server. It's always worth tailing the authd.log on the device when troubleshooting authentication profile issues as it will highlight problems such as missing domain names to you. ... View more

The only way I can think of doing this off the top of my head would be to create a DLP profile containing a list of the words, set the action to alert and apply it to the rules that match the general web browsing rule. ... View more

The best method for obtaining either a physical or virtual unit for testing things would be contact a reseller or contact your PAN SE and discuss it with them. The VM is only available normally to those who have purchased it. ... View more

The article can be located here - How to Configure Agentless User-ID in PAN-OS 5.0.x Personally if I only wanted the customer to setup the user account on the domain and not see the firewall configuration I would write my own version of this with own screenshots so then I could put my own company's branding on the document. ... View more

Hi Kal, Long time since I've heard your voice on my phone! I take it this issue is the same thing that you called us about today? It sounds like there is a disconnect between which domain name should be applied to the user. Is this in transparent or redirect? What server profile is being used for the captive portal authentication? Can you provide an example of both user-IP mappings from when it's working and when it's not? What does the authd.log show? Regarding point 3 I'm not sure, that's something new to me. What kind of device are you browsing with? There has been some odd issues noticed by one of our customers with IOS devices. The article you are referencing is only for devices with multiple dataplanes, the PA-5000 series. If the device has support through us then please log a case with us and we can take a look at it. Regards, SeanC ... View more

First issue I see is that you already identified that all your interfaces are in layer 3 which means you wouldn't be able to create a layer 2 sub-interface. I'm guessing that there's an error in the wording there? If you have a spare interface, putting the test network on a L3 interface into a a separate security zone and controlling the traffic too and from that is certainly the way I would do it. If you don't have a spare interface on the devices to handle the additional test network then putting into a separate VLAN on a layer 3 sub-interface and then putting the sub-interface into it's own security zone is the next best step. If you do intend to do a layer 2 sub-interface you could do the same as L3 with the zone and policy but it would require you to put it into a VLAN object (you could have the L2 sub-interface into it's own VLAN object) and then assign a VLAN interface to it and then add it into the virtual router so that it could access your L3 network. If you REALLY want to separate the traffic then you could put an interface into a separate VSYS however that would probably be overcomplicating it! ... View more

This may work: - test security-policy-match from <insert source zone> to zone-v8 source-user cn=net_vip,ou=paloalto,dc=domena destination 192.168.81.81 application web-browsing destination-port 80 Just replace the source zone and possibly the username (do a ? after entering source-user to get the correct syntax for their name). You can also add a "show all" at the end to see if it maybe is matching an earlier security policy. ... View more

The PA-2000 series implements SSL decryption in hardware and QoS and decompression are implemented in software. If you watch the below video you will see the layout of components for both the 3020 and 3050 about 3minutes in. The PA-3020 does not have a network processor so all of the routing, QoS and NAT is all done in software. The PA-3050 does have the network processor and implements it all in hardware. Video Link : 1238 I would reiterate that I would monitor my PA-2000 to see whether there is a problem with the memory usage and then raise a support case if it continues to increase as this could potentially be a bug. I only suggest discussing with your SE replacing the PA-2000 with a PA-3000 if you feel that it is not meeting your requirements after establishing whether this is normal behaviour of the PA-2000. ... View more

You should only really need to restart the management and device servers if there respective memory values are high or you've been directed to by support. Those values look OK but keep an eye on them over time to see if it increases over time. Another thing you can check for is the presence of backtraces and core files by performing a "show system files" and if there is anything with a recent time stamp for any time you have issues you may want to have PAN support investigate. It could be an as yet undiscovered bug. If you feel that your 2050s aren't cutting it you may wish to approach your account managers SE about upgrading to 3020s as while they are more expensive I believe they were doing some deals for people wanting to upgrade. ... View more