About bryan

Hello Depps, As Marco has stated, IE & Chrome share the same cert repository, while Firefox utilizes it's own. You will need to manually import the cert into Firefox via the Certificate Manager as a Trusted Authority, then Trust the CA to identify websites when prompted: Regards, Bryan ... View more

Hello Chris, I’ve seen similar cases/threads/templates posted on SolarWind’s Thwack site. You may need to copy/modify the default NCM template & create one to accommodate the later versions of PanOS. The current template on the site was created for v3.1.x though viewing the template in xml will give you an idea of the various commands as well as sequence commands are issued, etc… should you wish to test. Thanks, Bryan ... View more

Hello All, This appears similar to a fix which has been included in PanoS v4.0.9 (released 01/23). Reference the list of addressed issues, #35919 which includes a detailed description. Regards, Bryan ... View more

Hello, Typically with this type of configuration, there would also be a switch between the trust interface of the Router & untrust interfaces of the FW's (Allowing both PA's to share the Single trust L3 interface of the Router). This could also be accomplished by creating a private (non-routable) vlan on your core switch solely for the edge devices to communicate. (assuming you do not have additional hardware to deploy). Either option (despite having FW redundancy) would still be subject to single points of failure with the upstream/downstream devices. As far as configuration assistance, we can refer you to documentation posted on Knowledgepoint: https://live.paloaltonetworks.com/docs/DOC-1756 Any type of design related questions/validation, etc... would typically require engaging your SE. Regards, Bryan ... View more

Hello, Please reference the following KP article regarding VSA's: https://live.paloaltonetworks.com/docs/DOC-1765 The section towards the bottom references Cisco ACS. As far as the device (assuming you are referring to the Palo Alto), VSA's are 'Vendor Specific Attributes'. The dictionary file that you've imported onto the ACS will add these attributes, allowing you to assign specific roles upon successful authentication/group assignment, i.e. Device Admin, Panorama Admin, etc... As far as the groups, you can select all or select individual groups. (either option will not hurt or affect configuration). Selecting all allows you to assign single/multiple PaloAlto attributes when the group profile is created/modified. (the options are not enabled or assigned to the group profile unless you select them), i.e. [25461\001] PaloAlto-Admin-Role will assign authenticated users an Admin role for access to the Palo Alto Appliance. If you add additional attribute [25461\003] PaloAlto-Panorama-Admin-Role to this group, this would allow you to utilize a single group, where users can logon to both the Appliance & Panorama as an Administrator. (though you can always create separate groups for Panorama Admins & Device Admins). These attributes cannot be renamed. Regards, Bryan ... View more

Hi Asanka, Please verify if there are any pending jobs in queue via CLI: admin@PA-2020> show jobs all (& Reference any Active jobs under 'Status') You can clear stuck jobs (Threat/AV) via the following command: admin@PA-2020> clear job id <ID #> Can you please attempt to upgrade AV manually using the WebUI or from CLI, via the following command below: admin@PA-2020> request anti-virus upgrade install version latest 'show jobs all' from CLI will confirm if AV is being downloaded/installed. (Check periodically & confirm the job/install complete successfully) Since you are out of date with AV Signatures for the automated process, you may want to contact support so we can troubleshoot further. Thanks very much, Bryan ... View more

Hello Paul, If you're referring to native functionality of implementing a CAPTCHA for response pages, this is not a built-in feature of the Palo Alto at this time. The Palo Alto does allow you to import custom Response Pages (Device Tab->Response Pages) though this would be more of a cosmetic customization. For the functionality you are inquiring about, we would suggest submitting a feature request through your SE. Thanks very much, Bryan ... View more

Hello Asanka, What hardware platform are you on & what PanOS version are you running? Thanks, Bryan ... View more

Hello, There is a KnowledgePoint Article referencing details of enabling this option: "Send Hostname In Syslog" setting: https://live.paloaltonetworks.com/docs/DOC-1877 Any changes/enhancements, etc... would typically require a feature request submittal through your SE. Regards, Bryan ... View more

Hello James, A 'show interface all' from CLI will show you the current, negotiated speed/duplex settings on the PAN. Could we also verify that all appears well on the switch uplinks as well (speed/duplex, errors, resets, etc...). Both the FW & the switch will either need to be configured as Auto/Auto or hardcoded as well, otherwise potential duplex mis-matches could occur. (Both ends of the Vwire should be negotiating at the same speed) Have you attempted a baseline speed test for comparison prior to implementing any type of security profiles? Running the following command from CLI will also give you an idea of CPU load, etc... associated with the Dataplane during various intervals: show running resource-monitor Assuming heavy load as well as potentially high dataplane resource utilization, If possible (preferably during a maintenance window & confirming that interface/switchport issues were not the culprit), can you please apply the following change to your Vwire security policies? Select 'Options' at the far right of the policy & check the option for 'Disable Server Response Inspection'. Commit & attempt your download tests. (Though you could probably give this option a test regardless & compare performance) Description below: Disable Server Response Inspection: To disable packet inspection from the server to the client, select this check box. This option may be useful under heavy server load conditions. Regards, Bryan ... View more

Hello, As far as whether or not this is possible, yes. You can create (2) unique VR's within the same vsys (assigning each physical L3 interface to their designated VR's), assign IP's to each of the L3 interfaces on the same subnet, with both interfaces (seperate VR's) assigned to the same zone. (as long as the IP's do not conflict as the PAN will not allow you to commit). As far as functionality/expected behavior, I'd suggest implementing/experimenting with this configuration in a test environment. Regards, Bryan ... View more

Hello Bhav, When this issue occurs, are you logging on via RDP to a Domain Controller? If so, can you attempt to logon via RDP to another Server/Workstation (Non-DC) & confirm whether the original User-ID mappings on both machines are retained? Thanks, Bryan ... View more

Hello Bhav, Can you confirm via Monitor->Traffic & Monitor->Threat whether discards/resets/drops, etc... are occurring during the time of the updates? You could also manually launch a windows update from the client (Browser or Start->All Programs->Windows Update), then either filter the source IP of the client via the WebUI/Monitor Tab ( addr.src in x.x.x.x ) or via a session trace from CLI: show session all filter source <ip> (Keep pressing Up Arrow & Enter & verify session status ACTIVE, DISCARD, etc…) You can also apply a similar filter to the URL filtering logs as well in the WebUI (Monitor->URL Filtering) as you may have a blocked category that happens to be hosting content (i.e., content-delivery-networks) that is being referenced/pulled from an external sites during update downloads. Regards, Bryan ... View more