About jesseivens

Interesting solution.  We ended up going with GTB Technologies which is a agent based solution.   ... View more

Hi, thanks for the detail.  Does this produce DoS logs in the threat logs also?  So basically you are moving these bad actor logs from deny traffic to threat logs.  If I recall DoS logs have source & destination addresses of 0.0.0.0.  So you would not be able to see who is attacking you other than the DAG, right? ... View more

My comment above is only deleting the dns-sec from the profile, not removing the whole AntiSpyWare profile.  I am still using all the other functions of the AntiSpyWare profile.  Also my solution was confirmed to by TAC for a work around. ... View more

Does anything DNS relates still show under the profile?  If so, I would keep removing them.   show profiles spyware "PROFILE-NAME" ... View more

Ahh, that is because mine is a "shared" profile in Panorama.  In the firewall it should be like this. delete profiles spyware "PROFILE-NAME" botnet-domains lists default-paloalto-dns delete profiles spyware "PROFILE-NAME" botnet-domains dns-security-categories pan-dns-sec-cc delete profiles spyware "PROFILE-NAME" botnet-domains dns-security-categories pan-dns-sec-ddns delete profiles spyware "PROFILE-NAME" botnet-domains dns-security-categories pan-dns-sec-grayware delete profiles spyware "PROFILE-NAME" botnet-domains dns-security-categories pan-dns-sec-malware delete profiles spyware "PROFILE-NAME" botnet-domains dns-security-categories pan-dns-sec-parked delete profiles spyware "PROFILE-NAME" botnet-domains dns-security-categories pan-dns-sec-phishing delete profiles spyware "PROFILE-NAME" botnet-domains dns-security-categories pan-dns-sec-proxy delete profiles spyware "PROFILE-NAME" botnet-domains dns-security-categories pan-dns-sec-recent ... View more

RPBagiyev, See my post from 7/13 above.  Those cli commands is what worked for me and TAC confirmed it is a good work around until they get a fix in.   ... View more

Per my TAC case, Engineering had found that the issue is traced to a known issue PAN-164941 currently. The commits will retain the warnings but the commits will still go through and the issue will be resolved in Fixed Versions: 9.1.11, 10.0.8.     My work around posted removed the warnings and no further issues on any of my models.  ... View more

We have gotten evaluations from GTB, DigitalGuardian and tomorrow McAfee's client version.  We all really like GTB's product.  They are the only ones that have a machine that will do what I am asking, but based on the demo, we are looking more at the client app vs network appliance.  We will still use the network appliance for email DLP. We will probably be doing a proof of concept evaluation in the next few weeks.  I will share what we go with. ... View more

So far not much.  I am upgrading my PA3260s tonight from 9.1.9 to 10.0.6.  This is the same think I did on the VM500s.  I have also upgrade a VM100 and PA220, neither of which I had this problem.  Only issue was on the VM500s.  I ask TAC why this was and this is all I got back.   It is a buggy behavior, I've been checking similar cases with the same issue, different platforms. Also on versions 10.0.5 and 10.0.6. We don't have a root cause of the issue yet, but I'm glad the workaround worked for you.   I did do the workaround in Panorama on a shared profile, so it was only a 1 time change, since it is shared and I was able to push to all my different device groups at once.  I also took the opportunity change all policies to Security Profile Groups.  So if I need to change again, it is only a group change which affects all the policies that it is applied to.  Hoping that doesn't bite me down the road 🙂 ... View more

I ran into this issue when I upgraded some VM-500s to 10.0.6.  I was able to clone the default spyware profile, which I named "default-no-dns-sec"  Then I went into CLI and issued the following commands to delete DNS specific items. delete shared profiles spyware default-no-dns-sec botnet-domains lists default-paloalto-dns delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-cc delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-ddns delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-grayware delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-malware delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-parked delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-phishing delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-proxy delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-recent   On this firewall I have not "production" traffic yet, so I was able to disable all policies.  I enabled 1 with this new profile and pushed from Panorama.  No issues with the commit and no more warning.  All policies and/or Security Profile Groups will need to be updated to completely solve this. I do have a TAC case open, so I am waiting for confirmation from TAC on this. ... View more

I ran into this issue when I upgraded some VM-500s to 10.0.6.  I was able to clone the default spyware profile, which I named "default-no-dns-sec"  Then I went into CLI and issued the following commands to delete DNS specific items. delete shared profiles spyware default-no-dns-sec botnet-domains lists default-paloalto-dns delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-cc delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-ddns delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-grayware delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-malware delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-parked delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-phishing delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-proxy delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-recent   On this firewall I have not "production" traffic yet, so I was able to disable all policies.  I enabled 1 with this new profile and pushed from Panorama.  No issues with the commit and no more warning.  All policies and/or Security Profile Groups will need to be updated to completely solve this. I do have a TAC case open, so I am waiting for confirmation from TAC on this. ... View more

Use TAC, that is what they are there for.  Take advantage of the service you paid for 🙂    ... View more

I had an issue with accessing ic3.gov.  PA TAC was very helpful in troubleshooting this issue.  We found a work around but it did end up being "contact the website owner" which in my case was the FBI.  Like that is going to happen.  I temporarily rerouted that traffic through our DR site which worked fine.  After public IP and ISP migration, the issue went away.     We did find a work around.  Based on packet captures, the determined the packets were coming in out and never doing syn/ack.  This is from my tac case.   Summary: Facing an issue with accessing a particular website. out-of-window packets dropped incremented. Took captures with just server IP specified and confirmed server is sending challenge ack in response to syn, rather than syn/ack. To allow challenge ACK: Device > Setup > Session > Edit TCP Settings > Check "Allow Challenge ACK" (this is "Allow arbitrary ACK in response to SYN") https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boBJCAY ... View more

Sounds like something to get PA TAC involved with.  On the small ISP, is the the same ISP that you are using for the firewall?  Firewall Internet connection same as the problem ISP?   Interesting issue, certainly want to know what the fix turns out to be.  Best of luck.   ... View more

I read somewhere else about ForecPoint's poor service, so I will certainly share this info with my friends.  DigitalGuardian we haven't tested, so I can only say it looked good from a demo perspective.  It is client agent based which we are considering moving too.   We currently use McAfee WebGate with their prevent DLP.  McAfee's DLP only supports ICAP so it forces you to pretty much use it with their WebGate.  We want to get rid of WebGate and go with PA URL Filtering.  To do this, we need a DLP solution, so we were looking for an appliance to do this at the edge but seems they all only support ICAP.  Not sure why they can't be route based but I don't design them so.   ... View more