This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About tasonibare
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About tasonibare
09-06-2023
53Posts
31Likes
13Solutions
Sep 06, 2023Last Visited
User
Activity
User
Profile
Latest posts by tasonibare
| Subject | Views | Posted |
|---|---|---|
| 4494 | 11-19-2014 01:44 PM | |
| 2339 | 11-11-2014 10:43 AM | |
| 1809 | 05-26-2014 11:54 AM | |
| 1572 | 05-26-2014 11:47 AM | |
| 3405 | 05-22-2014 10:16 PM | |
| 1803 | 05-21-2014 04:37 PM | |
| 2079 | 05-12-2014 03:13 PM | |
| 1514 | 05-07-2014 12:34 PM | |
| 2192 | 05-06-2014 09:40 AM | |
| 1340 | 05-02-2014 03:12 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 05-02-2014 10:07 AM | |
| 1 Like | 12-08-2013 10:54 PM | |
| 1 Like | 12-24-2013 03:19 AM | |
| 1 Like | 12-16-2013 12:22 PM | |
| 1 Like | 12-12-2013 04:31 PM |
User Badges
Community Statistics
| Member Since | 01-22-2013 02:29 PM |
| Date Last Visited | 09-06-2023 01:51 PM |
| Posts | 53 |
| Total Likes Received | 27 |
11-19-2014
01:44 PM
2 Kudos
Hey Satish, TO add to Samir's comment, if the encaps are incrementing but the decaps remain at 0 in the > show vpn flow tunnel-id <tunnel-id> command, then it might be an issue with the zones associated with actual tunnel traffic. To understand this better, if the interface configured for IKE Gateway is Ethernet1/1 in the UNTRUST zone but the ESP packets actually travel in and out the firewall through Ethernet1/10 in the WAN zone, then that configuration would not work. Both interfaces would need to be in the same zone for the tunnel to successfully forward traffic. See VPN Tunnel Traffic Encapsulation Incrementing but no Decaps for more details on this issue. Regards, tasonibare
... View more
11-11-2014
10:43 AM
1 Kudo
Hello dthibodeaux, If you go to the Policies -> Captive Portal tab, you can add a rule at the very top for URLs that you do not want to activate Captive portal for. The action of this rule would be "no-captive-portal" and this should take care of your requirement. Here is a document on configuring Captive Portal for your reference. https://live.paloaltonetworks.com/docs/DOC-1159 Regards, tasonibare
... View more
05-26-2014
11:54 AM
Hello KC, Have you tried posting your question in the Devcenter's discussion forum? Devcenter is dedicated to assisting with questions such as this and you might even find someone who has already implemented what you are looking to achieve, and may be able to share examples with you. The link to devcenter is DevCenter Regards, tasonibare
... View more
05-26-2014
11:47 AM
Hello Eugene, Yes, you can perform SSL decryption without getting any security warnings on your web browsers. These security warnings only occur in web browsers that do not already trust the Root CA that signed the subordinate certificate that's doing the decryption. Adding the Trustwave Root CA certificate to your workstations' certificate root stores, if it's not already there, would ensure that you do not get the security warnings when SSL decryption is implemented. Here are a few links that have details on importing root certificates into Chrome, IE, Firefox and pushing it into the root store of a whole domain, using AD Group Policy Objects: SSL Decryption Certificates Installing root certificate in Mozilla Firefox - WebMoney Wiki Installing root certificate in Google Chrome - WebMoney Wiki Regards, tasonibare
... View more
05-22-2014
10:16 PM
As mzh mentioned, this feature is not supported on the PAN at this time. A feature request (ID 1307) has been filed for this functionality and you could request that your local SE vote on it as well. Regards, tasonibare
... View more
05-21-2014
04:37 PM
Hello Zebit, From your NAT policies, it looks like your primary ISP is on ethernet 1/3 and the secondary is ethernet 1/4. Is this correct? I notice that your PBF policy dictates that all traffic sourced from the INTERN and DMZ zones should be forwarded out of eth1/3. Based on your description, if you are trying to use a Public IP address given to you by the secondary ISP, then your current configurations would not work. Problem #1 I'm assuming that your Office365 server's IP address is 172.32.0.3 and your ISP_1 public IP is 100.100.100.100 and ISP_2 public_IP is 200.200.200.200. You have configured the 200.200.200.200 to be NAT'd to 172.32.0.3 so that when anyone on the internet pings that public IP, it would be sent to the server's private address. (NAT Policy "ADFS Intern"). When that traffic ingresses on eth1/4 for 200.200.200.200, your secondary ISP connection, the return traffic will incorrectly egress out of eth1/3 based on the configured PBF (Internet Monitor). To fix this, you would need to configure a PBF policy with symmetric return and position it above the "Internet Monitor" policy. Basically, this would make the firewall send responses out on the same interface that the requests had come in. Here is a document that explains this concept in greater detail: How to Configure Symmetric Return Problem #2 I'm assuming the "Extern zone DMZ" security policy is the one that should permit traffic from the EXTERN zone to the DMZ zone. If that's the case, you would need to configure the source zone as EXTERN while the destination zone should be DMZ zone. Pages 15-16 of this document explain this configuration in greater detail as well: Understanding PAN-OS NAT In the future, I'd suggest that you open a case with Support to help resolve this type of issue, but let us know if the recommendations above help to solve the problem. Regards, tasonibare
... View more
05-12-2014
03:13 PM
1 Kudo
Hello Elvis, You can open a case with Support to submit the captures for the application to be updated. Regards, tasonibare
... View more
05-07-2014
12:34 PM
Hello Vladimir, URL filtering is triggered when there is a web-browsing or SSL traffic traversing the device, regardless of what you specify in the Application section of the security policy. I would argue that it is best practice to specify web-browsing (and/or SSL) as the permitted application(s), but this only helps to lock down that security policy further; it is not a requirement for the URL filtering to be triggered. Hope this helps. tasonibare
... View more
05-06-2014
09:40 AM
You can get the GP agent version in any of these 3 ways: 1. GUI -> Dashboard -> General Information. Look for "GlobalProtect Client" 2. GUI -> Device -> GlobalProtect Client. Look for the version that is currently Activated 3. Run CLI command: 'show system info' and it shows up as "global-protect-client-package-version" Regards, tasonibare
... View more
05-02-2014
03:12 PM
Hello infotech, We have an option that allows you to point the PA firewall to a dynamic source of URLs to be blocked, and you could schedule the firewall to refresh that list as often as every hour. Here is the document: Configuring Dynamic Block List (EBL) on a Palo Alto Networks Device Let us know if this is what you're looking for. Regards, tasonibare
... View more
05-02-2014
02:59 PM
Hello Mohammed, I believe you can achieve this by having 2 security policies for the different sets of users, one where there's a Wildfire Forward profile and the other where there isn't. This way, you can use the same SMTP application on both policies, instead of custom applications, and still achieve the intended results by just having different file-blocking profiles on either polices. Hope this helps. Regards, tasonibare
... View more
05-02-2014
12:58 PM
1 Kudo
Hello Ben, There are some applications that do not play nice when decryption is turned on, on the PA firewall. Here is a document with a list of the applications we've already identified that should be excluded from decryption: List of Applications Excluded from SSL Decryption It is possible that Cisco Jabber is one of those applications that are not yet on the list, but you could open a ticket with us to investigate this further. Regards, tasonibare
... View more
05-02-2014
10:07 AM
1 Kudo
Hello WCoats, If you run the CLI command 'show routing route', you would see the explanation of the route flags used on the PA firewalls. Here is the output for your reference: > show routing route flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2 Regards, tasonibare
... View more
05-02-2014
10:04 AM
Hello Zach, QoS is not supported on the PA firewalls at this time which is why you are not seeing it in the Physical Interface drop down of the QoS configuration. A feature request (ID 1058) has been submitted for this but there is no ETA on when it would be fulfilled at the moment. Regards, tasonibare
... View more
01-17-2014
05:03 PM
Thanks for providing clarity of your purpose, and yes, what you've described sounds like it would be a good deployment. Regards, tasonibare
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-06-2023
01:51 PM
|
Latest Tags
No tags yet
Likes From
| User | Likes Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 17 |
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks