About ExclusiveNetworksGermany

ExclusiveNetworksGermany · ‎01-21-2014

When it's done 😉

ExclusiveNetworksGermany · ‎01-15-2014

And check if you have custom Applications. Custom Apps will increase the commit time about factor 5 Marco

ExclusiveNetworksGermany · ‎01-15-2014

You can find Informations on PanOS6 on this public Site: PAN-OS 6.0: What's New Cheers Marco

ExclusiveNetworksGermany · ‎01-15-2014

There is a public Document for PanOS 6.0 available: PAN-OS 6.0: What's New Cheers Marco

ExclusiveNetworksGermany · ‎01-13-2014

You can't set Link Speed or Duplex on your ESX vSwitch. This is why you can't/need to configure Speed or duplex in your PAN-VM Regards Marco

ExclusiveNetworksGermany · ‎01-07-2014

That is a Documentation Bug. A Device Admin has no rights to config import or export operations because he would be able to grant himself Superuser rights otherwise. (export, modify config, import, commit) Regards Marco

ExclusiveNetworksGermany · ‎12-02-2013

Nothing official, but some of your wishes will become true 😉 Cheers Marco

ExclusiveNetworksGermany · ‎11-13-2013

Download 5.0.0 & 5.0.8 to your Firewall and upgrade directly to 5.0.8 As always: Backup your config before you upgrade to an external Device. Kind regards Marco

ExclusiveNetworksGermany · ‎10-30-2013

tcptraceroute is sometimes used when icmp and udp is blocked. Port 80 is open is most environments http://www.catonmat.net/blog/tcp-traceroute/ The Programm tcptraceroute uses TCP/80 as well Manual Page - tcptraceroute(1) Regards Marco

ExclusiveNetworksGermany · ‎10-29-2013

With SSH Proxy you can only see if someone is tunneling Ports through SSH and block it. You cannot see the tunneled Applications like SSL Proxy. This way you cannot check for Virus in SFTP From Administrator Guide: "SSH decryption is used to identify and control SSH tunneling in addition to SSH shell access. With the SSH option, you can selectively decrypt outbound and inbound SSH traffic to assure that secure protocols are not being used to tunnel disallowed applications and content. " Kind regards Marco

ExclusiveNetworksGermany · ‎09-18-2013

Create a Policy between the two zones for "known User" or if you like specific named User. This Policy will only match for authenticated Users. Create Local User Accounts, (you can also use AD User) Create a Captive Portal Policy How to Configure Captive Portal Cheers Marco

ExclusiveNetworksGermany · ‎09-16-2013

Not all Apps can be used for PBF. because the routing decision is made at sessions start, you can only use Apps that can be discovered at session start. For your example: google-docs-base has a dependency of web-browsing & SSL At session start the PAN will discover web-browsing or SSL and make a routing decision Once this decision is made the PAN will keep it for this Session. This is why you can't select all Apps for PBF Regards Marco

ExclusiveNetworksGermany · ‎08-15-2013

Both will work. You can override the default timeout for ALL Applications (1st window) and/or for a specific Application (2nd window) Regards Marco

ExclusiveNetworksGermany · ‎06-28-2013

I would guess that you have configured an automatic update Scheduler for 1:30 am (or may be a little bit earlier) Depending on your configuration the Master is updated first and then the Update is pushed to the slave So depending on how long it would take to commit the AV Update there may be a small time frame where you have a mismatch in AV Versions. Cheers Marco

ExclusiveNetworksGermany · ‎05-24-2013

In PanOS 5.0.x the Logs are stored per CPU and can be found in pan_task_1.log, pan_task_2.log ..... after finishing your debug session you can execute: debug dataplane packet-diag aggregate-logs Now you can see all logs again in pan_packet_diag.log Regards Marco

ExclusiveNetworksGermany · ‎05-22-2013

You need the same licenses on both device or the features won't work. There are special HA License Bundles. Please ask your local reseller/distributor. Regards Marco

ExclusiveNetworksGermany · ‎04-30-2013

There is no "official" Scheduler for automatic export yet. But you can ask your SE to sign the Feature Request for you. Anyway there are some ways to trigger config Backups from external Server 1. Use the XML API 2. Or use remote ssh login (with public/private key for passwordless login) in a shell script on an external Server and execute backup commands: scp export configuration to USER@SCPHOST:PATH or tftp export configuration to TFTPHOST Cheers Marco

ExclusiveNetworksGermany · ‎04-29-2013

The other way in 4.1 is to authenticate through Radius. In this case there is no need to configure the Local Admin Accounts. You can use this guide to configure Microsoft Network Policy Server for Logins. Cheers Marco

ExclusiveNetworksGermany · ‎04-16-2013

Rather than configuring a Custom App (which make the Management slower, especially for a PA 20xx) you should configure a QoS Policy and limit the Bandwidth for youtube-base. Lets say you configure a Limit at 200 Kb. Your students will choose 360p at their own (.... or wait the whole day until the HD Video is buffered) 😉 Cheers Marco

ExclusiveNetworksGermany · ‎03-06-2013

Which Interface from your SRX is connected to the Paloalto? and where? eth1/2? eth1/6? Your Paloalto config looks like a config from PAN EDU Training. This should work. I guess you have a Problem with you physical connection or you SRX config. Regards Marco

ExclusiveNetworksGermany · ‎03-04-2013

No, like all columns in Security Poliy you can only name it i a way that i logical for you. Like: Service-Name: SRC-1026-TCP-25 Destination Port TCP-25 Source Port: 1026 Cheers Marco

ExclusiveNetworksGermany · ‎02-20-2013

Last answer is correct. Update from 4.0 to 5.0 is not allowed. This is the reason why 5.0 is not displayed. You have to go through 4.1. Download 4.1.0 & 4.1.11 You can directly upgrade to 4.1.11. After installing 4.1.11 you can refresh the Software List and 5.0.x will be visible. Cheers Marco

ExclusiveNetworksGermany · ‎12-27-2012

I don't know why the Traffic hits your first Rule. Normally i should not match this Rule if the URL Category does not apply. But you can modify your Rule that the Destination Address FQDN matches to your Server. Something like this: For the URL Category there is more debugging necessary. You can activate the visibility of the URL Category column : Regards Marco

ExclusiveNetworksGermany · ‎12-27-2012

5.0.1-h1 is only available for PA-200 for all other Devices the Fix 46285 was included in "normal" 5.0.1 Release But i can proof that it is still not working. I suggest to open support Case and refer to this Threat. If you want you can also refer to Support Case Number 00110012 As far as i know Engineering is currently working on this and hopefully it will be fixed in 5.0.2 Cheers Marco

ExclusiveNetworksGermany · ‎12-13-2012

You can directly upgrade to 4.1.9 (4.1.0 have to be downloaded but there is no need to install 4.1.0) Since this is a Major Release update plan more time for the Upgrade. Depending on the size of your Log Database we have seen upgrade time >30 min till the Firewall is productive again. A direct upgrade from 4.0.x to 5.0.x is not possible, you have to go through 4.1.x please read the Release Notes before upgrading. Regards Marco

ExclusiveNetworksGermany · ‎12-12-2012

>Do we have any way to logout users from Web UI? None that i know of. For the commits: Again: i would strongly recommend NOT to stop running commits. This could lead to unstable situations. Just a theoretical question: How do you stop commits? Do you close the window in WebUI? This will not stop a commit. Please check Tasks (lower right of WebUI) or "show jobs all" at CLI Marco

ExclusiveNetworksGermany · ‎12-11-2012

with >delete admin-sessions you can log out all currently logged in Admins/Users from CLI or WebUI I would NOT recommend to stop a running commits but if you do you should take a look at your jobs > show jobs all / show jobs id <ID> and/or try a >commit force Cheers Marco

ExclusiveNetworksGermany · ‎12-10-2012

You can only use Apps that can be discovered at Session Setup. Example: web-browsing instead of facebook-base Extracted from Admin guide: [snip] The initial session on a given destination IP address and port that is associated with an application will not match an application-specific rule and will be forwarded according to subsequent PBF rules (that do not specify an application) or the virtual router’s forwarding table. All subsequent sessions on that destination IP address and port for the same application will match an application-specific rule. To ensure forwarding through PBF rules, application-specific rules are not recommended. Marco

ExclusiveNetworksGermany · ‎10-22-2012

Hi, this behavior is a known Bug in User Agent 4.1.4 & 4.1.5 Although there is no hint in the Release Notes it seems that User Agent 4.1.6 is working again. (as far as i can see in my own tests yet) Regards Marco

ExclusiveNetworksGermany · ‎10-18-2012

As you have already discovered LDAP is not selectable as Service Route. Only Solution for this is to put the LDAP Server IP under Destination Service Route (right Tab) and source all requests for this IP on the selected L3-Interface May be you would like to place a Feature Request with your SE Regards Marco

Date Registered	‎08-12-2009 12:45 AM
Date Last Visited	‎11-17-2016 12:34 PM
Total Messages Posted	52
Total Likes Received	27

Online Status	Offline
Date Last Visited	‎11-17-2016 12:34 PM

Strata

Prisma

Cortex

About ExclusiveNetworksGermany