About JonHill

In recent weeks we've had a problem reported where one minute a site will be accessible for instance Youtube and then it won't be and then it will and it goes on, after looking in the logs when  the connection to Youtube fails is when the log show no USER-ID when it works it shows a local USER-ID. We use an AD group for access to general internet and have this configured on the corresponding rule.   I've tried troubleshooting looking at various knowledgbase articles but haven't found any reason why sometimes USER-ID's are correct and and sites can be accessed and then othertimes they can't its also not happeing for all sites accessed at the sametime it may not work for Youtube but it will work for Google.   Can anyone give me any ideas why this might be happeneing? Thanks Jon     ... View more

I've followed a number of articles to import our Checkpoint config into Expedition ready to import into our Palos but for whatever reason the Rules won't import, objects and NATs import fine but  the rules don't.   Our Checkpoint version is 77.30. I've followed https://live.paloaltonetworks.com/t5/Migration-Tool-Articles/Checkpoint-Different-Source-Files-Forma... for the migration tool which I've also tried but that fails to import the rules as well. The Rules are all in the rules.c file.   Can anyone suggest where I might be going wrong and how I can successfully import the rules? Any help would be much appreciated.   Thanks Jon ... View more

I'm very new to PAN firewalls and are still learning as I go along, they've only been in a month or so and the only rule is currently set any any from the trust to untrust zones and vice versa.   We've got a couple of issues around some connections that traverse our 5250's (LAN to WAN and vice versa) but from the 5250's perspective its not seeing any traffic in the logs for the addresses in question, no deny drops allows nothing.   When we've done a packet capture from the servers on either end of the connection it shows the traffic leaving but its never seen on the 5250's. We've checked the routing and everything else in between but we've found nothing wrong.   Zone protection profile has been disabled.   Is there anything else that I can check to see if for one reason or another the 5250's are doing something they shouldn't to the traffic?   Any help would be much appreciated?   Thanks   Jon ... View more