About ggarrison

BearGolightly,   I have double checked with our engineering team, and have confirmed that DirectPath I/O is in fact not supported with PA-VM series devices on ESXi.  As an alternative to link monitoring, we recommend configuring path monitoring instead.  We are working with our team to make sure that all documentation and references to DirectPath I/O are updated to reflect the correct information.  Please let me know if there's anything else I can help you with. ... View more

Kalyanram, While there is no maximum number of captive portal sessions on any device, there is an effective limit of 64,000.  This is constrained by the maximum number of authenticated users on the device, which is 64,000.  Also, there is a limit of 2,500 concurrent captive portal sessions, and this is the maximum number of users that can be authenticating using captive portal at any given time, however the total number of users authenticated in this manner may be much higher (up to the limit of 64,000).  Regarding the device stability problems, I recommend opening a case with support if you have not already done so. Regards, Graham P. Garrison ... View more

Johan, The PAN firewall does not directly participate in Kerberos authentication of clients, it relays the requests from the client to the servers that are configured in your Kerberos authentication profile.  Consequently, no trust needs to be established with the firewall, as both members will have the keys necessary as they are both in the same domain.  Also, TGT renewal requests will be renewed by the end user's workstation. If you would like more information on Kerberos, please follow this link to Microsoft's TechNet: http://technet.microsoft.com/en-us/library/cc961976.aspx ... View more

Due to the way Skype content is identified by our Content and Threat Detection engine, it may first be listed as "unknown-tcp," then undergo an application shift to "skype" or "skype-probe."  The warning that you receive is just to notify you of this dependency, and is not actually an error.  You will continue to receive this warning until the policy is adjusted to resolve the dependency, however it can safely be disregarded if you have the application functioning in your environment.  "Unknown-tcp" traffic is any TCP traffic that does not match a signature from our content database.  During the course of the session, it may shift to another application once it is successfully matched. ... View more

Have you tried searching the entire registry for the keys in question? ... View more

Mike, As Dropbox uses a proprietary protocol for its file transfers, the signature is dynamic and can change over time.  If the content and threat detection engine is unable to match the specific signature that we have in our database for dropbox, it will fall back and identify it as SSL.  If you wish to submit the application to have a new signature generated, please do so using the following link: < http://www.paloaltonetworks.com/researchcenter/submit-an-application/ > It appears that you may have already submitted the request in the correct location.  You can check the release notes for each content update to see if dropbox signatures have been updated. -Graham ... View more

Please make sure that WINS servers are correctly configured for your SAMBA servers. The SMB protocol uses broadcasts which don't traverse through forwarded interfaces unless they are properly bridged, so you need to make sure the windows clients have the correct WINS info.  Also, I recommend verifying DNS settings on the client, and that valid entries exist for the SAMBA servers if they are being accessed by name. ... View more

I would concur with Renato's recommendation for 3.1.10 or 4.0.5 currently. ... View more