About pulukas

The basic overview for ssl decryption is doc-2008. Controlling SSL Decryption PA does support 2048 bit certs. ... View more

In the forums here you can create this as an "Idea" instead of a discussion.  this allows other users to vote on the feature and maintains a public list. ... View more

As Hulk mentions, the session starts with the first possible rule match.  In your case that is the application ssl rule. You should reorder you security policy list so that the specific rules like this one for the vpn appear first on the list.  This prevents the application based rules from accidentally kicking in on the traffic as is apparently happening here. ... View more

If you don't have a budget for external pen testing, you can setup the scanner tools and run a basic exam yourself.  Nmap and metasploit are the basic tools of the pen tester. Nmap - Free Security Scanner For Network Exploration & Security Audits. Penetration Testing Software | Metasploit ... View more

Customer access on any Palo Alto appliance is only via the firewall command line.  Access to the root on the system is restricted to Palo Alto support only.  You cannot add anything to the root vm including vmware tools. According to VMware, best practice is to have vm-tools installed on appliances that companies offer for sale.  So we can hope that as the vm appliance business proceeds PA will start including vm tools in the load. Best Practices for Building Virtual Appliances http://www.vmware.com/files/pdf/Best_Practices_Building_Virtual_Appliances.pdf ... View more

You are correct.  The configuration you want is not possible. You can do multiple servers but the do have to be in the same logging format. ... View more

In Palo Alto Active/Active is not at all about capacity, so you won't find it mentioned in the documentation.  The use cases are just two: Asymmetrical routing - there are two active paths and source and reply traffic can appear on different links.  The A/A setup allows the sessions to still be matched and processed by the original firewall. Dynamic routing protocol load balancing - There are two paths that traffic could take through the firewalls and that path is selected by routing preferences in dynamic routing protocols outside the PA firewall.  The inactive path interfaces must remain up for the dynamic peers to maintain their routing tables.  In an active/passive design the passive firewall links are down and the peers on the secondary path cannot remain up. See the discussion in the Active/Active Tech note for more details. Configuring Active/Active HA PAN-OS 4.0 ... View more

Access to the migration tools is limited to partners only.  Us mere mortal customers cannot use these tools. Hulk, Cisco ISR is a completely different OS than the ASA.  Is there an ISR tool? ... View more

There is a basic list of hardening guidelines in DOC-2051 Configuration Hardening Guidelines ... View more

Manage more than 100 is not a problem.  The issue will be if you are collecting and using logs how much logging per second you are getting and at what point additional log collectors will be needed to avoid losing information. The second issue is then how much disk space you need to save historical logs. ... View more

darren.g wrote: mainly, how you create and deploy the certificates which the PC's use to verify/connect to the firewall before the user logs in and supplies actual credentials to Global Protect. For certificate authentication on a windows domain you can use group policy to automatically create the certificates and auto enroll the domain computers.  Configure Group Policy to Autoenroll and Deploy Certificates With windows GINA pre login you essentially connect the login process on the computer to the creation of the vpn connection at login time.  This way you do get the benefits of on network login from the vpn connected computers. ... View more

I think you can trust that if the files all match the checksum they have been verified. As a test you could create a brand new file and post this to a g-drive or dropbox then download it via your configured policies.  Since you created the file yourself from scratch it would not be in any of the wildfire previous scans. ... View more

The main "catch" would probably be capacity and HA capabilities.  The vm version cannot do any PA HA features.  So you could not have an active/passive cluster. Also since the internal v-switch is 1 gig only, you would not be able to have a 10g interface on the PA. I could see a v-sphere server with a local AD and file server along with a virtual PA being a good option in branch office scenarios. ... View more

I agree with ericgearhart, for the jump from 4 to 5 we waited until the 5.0.6 release.  There does seem to be a much better QA process for regression testing and I do hear all the PA technical support contacts saying and doing the right things.  So this time we may be ready to make the transition at 6.0.4. But the listing of three ftp bugs fixed in the 6.0.2 release linked above demonstrates that regression testing is not quite where it needs to be for major code train releases just yet. ... View more