About SCoupland

I got the same issue. Auto download & install (every 30 mins) is downloading but not installing ... View more

Hello,   I have the same issue, with an HA. Currently Active can update its content updates, but Passive can't update them. I have a question, about your workaround.    When you said "configure the ARP entries", do your refer to add the MAC address, of each MGT interface, in all Layer 3 interfaces that I have configured?   Regards, ... View more

@cdevlin wrote: I am looking for a base 5050 configuration to help speed up the process of getting the firewall up.  Does anyone have a config file they could share?       I'd be very cautious with using another person's / company's "base" config.  You could be importing a config you didn't know about having unintended (unknown) consequences.  Also if you "build" that base stuff yourself you're more apt to be capable to troubleshoot things quicker.   IMO...the base stuff you wouldn't be able to import anyway...   LDAP Syslog SNMP Group-Mapping   et al   Are all going to be unique to every company.  The "basic" config palo already has built for you in the pre-defined security profiles and security rules, but you'll need to build to suit your own use case. ... View more

Hello, Or maybe if you ahve a SIEM you can alert on the log that gets sent? One other round about way (yes its goofy) is to use something like OSPF between the two VPN endpoints and have the PAN send an email alert on any High/Ciritcal logs.   Just a thought. ... View more

The other way in 4.1 is to authenticate through Radius. In this case there is no need to configure the Local Admin Accounts. You can use this guide to configure Microsoft Network Policy Server for Logins. Cheers Marco ... View more

Contact your local reseller/dealer and ask - in most cases, they have loan units you can stick in in virtual wire mode and observe without distracting from your existing configuration. Helped me make the decision the first time I saw them, that's for sure! ... View more

In my case: I don't have URL filtering license, so I only have a couple of custom URL categories defined. On the rule I'm working on I don't have URL filterig security profile applied. I only have my custom URL category used in URL Category field of security rule. As far as I know in such case URL categorisation should still be applied? Yet I have 'any' as URL category in traffic logs which implies URL categorization wasn't even applied. Any ideas why is this not working? ... View more

No one from Palo Alto yet.  I will work on rounding someone up.  What I have been told is. . . USER-ID Update It is no longer necessary to use windows machine for one AD server It is best practice to setup filters to only enumerate groups that will be used in a policy - groups are ONLY used to create policy. The (windows) agent can still be used to check in with multiple AD servers.  As you probably know, it looks for kerberos tickets and also polls via Netbios or WMI to see if anyone has moved. Also, it is suggested to use agent if you don't want to use the control plane of the firewall for additional processing. Hope that helps a little for now. . . ... View more

test security-policy-match from <zone> to <zone> source-user domain\alias  source x.x.x.x destination y.y.y.y application <name of application> protocol <protocolnumber> show all yes Sample Example: test security-policy-match from trust to untrust source-user test\testuser source 1.1.1.1 destination 2.2.2.2 application youtube-base protocol 80 show all yes Thanks, Sanju ... View more

The PA-2000 series implements SSL decryption in hardware and QoS and decompression are implemented in software. If you watch the below video you will see the layout of components for both the 3020 and 3050 about 3minutes in. The PA-3020 does not have a network processor so all of the routing, QoS and NAT is all done in software. The PA-3050 does have the network processor and implements it all in hardware. Video Link : 1238 I would reiterate that I would monitor my PA-2000 to see whether there is a problem with the memory usage and then raise a support case if it continues to increase as this could potentially be a bug. I only suggest discussing with your SE replacing the PA-2000 with a PA-3000 if you feel that it is not meeting your requirements after establishing whether this is normal behaviour of the PA-2000. ... View more

+1 on going to 4.1.11 first... let the "dust settle" from that upgrade for at least a week before you make the leap er I mean jump to 5.0 ... View more

thnak's for your help ... View more