About jay.martin

This article may also prove helpful - https://live.paloaltonetworks.com/docs/DOC-6948 ... View more

Hi - I'm assuming you are not using GlobalProtect agents - if you were you could create a HIP object for the XP OS and target your rule that way.  Without GP, if your DNS performs well you could create an address group and put the FQDN's of the XP machines in, then do a deny rule to the Internet.  Or more preferably to take potentially slow/inaccurate DNS resolution out of the picture, if the XP machines have static IP addresses, or effectively static by DHCP reservation, you could do the same using the IP addresses instead of the FQDN's.  Hope this gives you some possible options. ... View more

I brought it to our SE who is making a case for this - he told me others have requested same.  One of the primary reasons they gave for having that way is for compulsory vpn connections to be able to still talk to captive portals in hotels, airports, etc.  I said, if that's the case, why not only allow the apps necessary to do captive portals and not wide open. Fingers crossed they'll make it at least a configurable option for their customers...  ... View more

Thanks for the reply - I agree - we must be able to cut the GP client off their LAN!  I'm also surprised there would be no permanent solution for this yet! ... View more

Hi rgreenspon - we have same exact issue/concern with both windows and mac clients - running latest 1.1.7 gp client - did you get a permanent solution? ... View more

bpappas - Please excuse me if I'm wrong, and David certainly correct me if I am, but I think David is asking how to guarantee bandwidth for his IPSec tunnel, not necessarily the traffic that flows over that tunnel.  Reason I say I think that's what he's after, is that is exactly what I'm after as well.  I want to be able to set QoS such that the IPSec tunnel will always have enough bandwidth to stay up, as we've seen circuits get so saturated that the entire tunnel will drop.  At least that's how I read David's question.  If I am wrong, please respond to my question as well.  Thanks - Jay ... View more

We've seen same thing you're describing on our 2050 running 4.1.1 - hoping 4.1.2 clears these things up!!!!!  10-15 minute commits are rediculous!!! ... View more

I get same - one int tagged for netflow, but 5 or 6 ints show up in ManageEngine Netflow - we're running 4.1.1, and same issue on several PAs (2020, 2050). ... View more

I see same - I got 276 pushed to all 15 of my devices before it disappeared - hope there's not some issue with it! ... View more

Thanks for the reply - though I didn't mention it (should have) I have tried that too, and it says every day there is no botnet report, although devices show activity every business day that I've checked.  I could swear I saw botnet reports in Panorama context previously - was it there before and currently is not?  It's included daily with a summary report as well as a custom report, which both show data, just not the botnet report. ... View more