About Mack

Hi everyone, We've got a number of virtual-routers in our PA-5050s and we're looking to do some consolidation to simplify the configuration.  Basically, we're looking to reduce the number of vrouters by moving interfaces that are currently in different vrouters into one common one.  We are not going to change the zones associated with the interfaces.  I'm wondering what happens to existing/established sessions on the firewall when we move the interfaces from one vrouter to another. My question is this: if we have an existing session through the firewall that was established based on a particular route pattern that determined the source and destination zones, then we change the route pattern but the src and dst zones remain the same, do the existing sessions continue or do they become invalid / get terminated? Long explanation: We have several server subnets and one core (physical) router in our network.  We put the server subnets behind our PA-5050s on their own dedicated interface a few years ago, but we wanted to give them each a dedicated 1Gb link to our core router.  So we created a vrouter for each server subnet and used a /30 routing subnet on a different dedicated interace between the core router and our PA-5050s to force each server subnet's traffic over a different link.  So for our 5 server subnets, we're using 10 interfaces (5 x core<-->PA, 5 x PA<-->servers).  While each server interfaces has its own zone, all of the /30 routing interfaces are in the same zone. We've now established 10Gb connectivity between the core router and the PA-5050s, so we do not need the separate interfaces.  This 10Gb link is in the same zone as the /30 routing interfaces.  To simplify our configuration, we'd like to start collapsing the separate server vrouters into one common one that uses the 10Gb link as its route to the core router.  This will not change the zones, only the routing. We need to know if we need to schedule an server outage when we change the routing.  Our hope is that since the sessions are based on the zones (which will be unchanged) and the firewall is able to do dynamic routing, the sessions would stay alive. However, the existing sessions that were previously routed across the 1Gb link will now be using the 10Gb link in a different vrouter, so maybe the firewall won't like that. ... View more

Hi all, We're in the process of migrating from Juniper ScreenOS devices onto our new Palos and I have some questions about ALGs and service timeouts. On our Junipers, there were a couple of ALGs that we had to turn off due to them mangling the application they were supposed to handle.  The most prevalent of this was the SQL ALG, which seemed to have a tendency to terminate SQL sessions prematurely on longer running queries.  Is there anyone who has migrated from ScreenOS to Palos that has experience with the ALG problem and can let me know if the Palos handle SQL better, or if I should create an Application override for it? Secondly, we had a number of services for which we extended the timeouts, most notably SSH (because keepalives didn't seem to work and our admins didn't like to log in repeatedly) and LDAP (because idle connection pool sessions would be timed out by the firewall too soon).  Does anyone have experience with how the Palos handle these services/applications (especially the connection pools)? Finally, it looks like I can make a custom app that has longer timeouts (but it is not possible for a service/port definition - why?).  On the Objects->Applications page, there is a clone button, but I can't seem to get it to work.  Any idea of how I could clone an application, for instance the SSH application and give it an extended timeout? ... View more

We have a couple of machines that are set to display the PANOS web UI Dashboard so that we can see the current Risk Factor and System Resources, etc... so we set the Authentication Settings Idle Timeout to 0 so that the sessions do not time out, as indicated by the help. However, they still do time out.  Is there something else we need to change? We're running PANOS 4.1.4, but the problem also occured in 4.1.1. ... View more

I think I may have found a bug with PANOS 4.1.1 on PA-5050s where the WebUI will not display new signatures until the user has logged out and logged back in again. I left a browser (Firefox 10) logged in for several days, using it just enough that the session did not time out.  During this long session, a content update was installed.  However, when I went looking for the new signatures, I could not find them.  They would not appear in the new Vulnerability Profile or new Spyware Profile dialogs, even if I searched by the CVE number or the Vendor ID. A new session in a new browser showed them, so I tried logging out of the old session and logging in to a new one.  The signatures were now available in the dialogs. This is obviously a little tricky to reproduce since there's only a  content update once a week.  I will try to do it again next week though. Has anyone else seen this behaviour? ... View more

Hi everyone,  I've read through the Admin Guide and have done some searching in KnowledgePoint, but can't find the answer I'm looking for... Currently, in PANOS 4.1, in a Vulnerability profile, when one adds a rule, they can conditions to match signatures.  We can provide a string to match on Threat Name, for example I could add a rule with 'ftp' in the threat name and that rule will match all signatures that contain 'ftp' in the name.  I can also specify a rule that triggers on a specific category or severity level and any signature that matches the category or severity will be included in the profile. However, what if I want to build a profile that includes all signatures for only a particular application, for example Remote Desktop? I can't use category or severity, as that will match all signatures.  I could add a rule with Threat Name = 'RDP'... but what if some signature names do not include RDP, but rather Remote Desktop Protocol? (BTW, this is the case.)  Or the old name, Terminal Services?  I could add rules for all three, but if Microsoft changes the name again and the newly released signatures use that name, our profile won't automatically include them. Is there any way to specify "include all signatures for this application" as the definition for a vulnerability profile? ... View more