About kbrazil

Regarding running DHCP server on an L3 interface vs. L2 interface, you might not need to completely change all L2 interfaces to L3.  You could instead just add one L3 interface (if you have any extra), configure DHCP server on it, and physically plug it in to your existing L2 network without affecting the current L2 config.  You may even be able to do this with an L3 VLAN logical interface connected to the L2 VLAN forwarding object depending on your configuration. Cheers, Kelly ... View more

Yes, multiple interfaces in a Zone are completely fine and will solve the multiple session issue you are seeing.  Many customers do this today, even in Vwire mode. Cheers, Kelly ... View more

Nice work - looks great.  I hadn't thought to use conditional advertisements in this way before.  Great use-case! Cheers, Kelly ... View more

Hi Mikand, Leaving the link aggregation to the end-points is recommended when configuring vwire on the firewall.  It is possible to use aggregate interfaces on the firewall on vwire, but as far as I know there is no benefit to doing this and it is not considered best practice. Cheers, Kelly ... View more

You may want to enable WildFire by configuring a forward action on a File-Blocking profile.  Wildfire runs the executable in a sandbox environment and checks its behavior to see if it is malicious.  If so, signatures are automatically generated within an hour with the subscription service.  This also feeds into the PAN-DB URL filtering database malware category, so you may also want to block those types of web sites, too. Also, a Continue action on executable (PE or "portable executable") file downloads can help so the user has to specifically click "Continue" to download the file.  This is called drive-by-download protection.  You can customize the response page to show a warning for these types of files to discourage users from clicking continue. Both options can be combined, as well. Cheers, Kelly ... View more