About knarra1

If you are referring to users in group, We do not have option of filtering certain members in group. Please let me know if you are referring to something else ... View more

If the security policy is configured with the group that user is member of, it is expected to match security policy Firewall retrieve the AD groups and the associated members from ldap and keeps the group membership . If the user still exist in the group and there is a ipaddress to user mapping for that user account , you will see the from that user/ip is matching to the security rule You can try removing the user from the group in AD and Force User Group Mapping Refresh ( https://live.paloaltonetworks.com/docs/DOC-3294). See if that fix the issue . ... View more

Do you have decryption profile assigned to the decryption policy ( Options Tab in the policy )  . If so, can you verify if the "Block sessions with unsupported cipher suites" is selected and disable it and try again  ? You can define what should be blocked or not blocked for the Unsupported Modes in the decryption profile ... View more

Is the group mapping being configured in user Identification set up ? It is required to pull down the group members from the Ldap and have the mapping between the group and the members of the group . Following link has the document on how to configure group mapping https://live.paloaltonetworks.com/docs/DOC-4994 ... View more

If you have smtp relay server , Please check the the  server that is configured which could be queuing the messages or discarding them . ... View more

Yes , you will need to define custom applicationsto identify the browser and add them to the security policies ... View more

I believe you are looking to identify the traffic and define the policies action based on the browser the traffic initiated from the client . If it is the case, you can do that by creating a custom application to identify the browser and can define the actions . For the custom application you will need to create a signature to look at the user agent strings in the http headers and detect the browser type http://www.useragentstring.com/pages/All/  contains  list of User agent strings for your reference. https://live.paloaltonetworks.com/docs/DOC-5028  & https://live.paloaltonetworks.com/docs/DOC-1247 has configuration steps on how to detect the firefox & chrome browsers and block the traffic ... View more

Following link has the steps for integrating Aruba clear pass with Palo Alto Firewall. I hope this is helpful http://www.arubanetworks.com/wp-content/uploads/TechNote_ArubaAndPaloAltoNetworksIntegration.pdf ... View more

From panorama version 5.0 ,  you can choose protocol SCP for schedule config export Panorama > Schedule Config Export ... View more

The URL filtering you are seeing in the session is for the URL category in the security policy itself under the service/URL category tab ... View more

PAN devices cannot support the interfaces physical relay like other IPS & IDS  devices during the device powered down as we are a firewall device supporting L3 , L2 modes. ... View more