About PanIst

Hi,   anyone knows why this is not working ? ( vulnerability signature - 40021) tried many rdp attemps but cannot trigger 40021 although selected very low number.     https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/Brute-Force-Signature-and-Related-Trigger-Conditions/ta-p/52284   but how to protect ? even 1 attemp 100 seconds not working (tried with credentials)   Thanks ... View more

Hi all,   there is a domain abc.com and there is an ipv6 dns record for that.so when using ipv6 from cloud is it possible to destination nat this to the ipv4 server inside.   I know as a workaround we can add an ipv6 ip to that server but it is not possible now.     (INTERNET)ipv6 (client)----- ipv6 FW  ipv4 ---- ipv4(server)     Regards   ... View more

Hi,   is it possible to do that   with commands clear user or debug user-id reset captive-portal it is not logging out.   Thanks ... View more

Hi, İs it possible to protect from ?    Regards   ... View more

Hello all,   There is a problem with a smb traffic(very very slow) For the related source and dest. ip address 2 filter is configured and show counter output has :   flow_fwd_mtu_exceeded 9 3 info flow forward Packets lengths exceeded MTU flow_ipfrag_frag 18 6 info flow ipfrag IP fragments transmitted   There is no drop. All devices through the way has mtu as 1500 like paloalto.   Any idea ?   Thanks ... View more

Hello   When scanning management interface or enabled https layer3  interface it shows the related vulnerability,   is there a way to fix.version is 6.1.10   https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555”   thanks.   ... View more

Hello   I'm trying to do a NAT from ipv6 to ipv4. On commit I have an error   "Nat64 needs an ipv4 in the rule for dest xlat"   Rule : from untrust to untrust , destination ip is ipv6 and translated address is ipv4 destination NAT   Thanks. ... View more

Hello all,   3 domain and single forest. (root domain)  named as domainA and domainB and domainC   we created 3 LDAP profile for each domain. we can see members from all domains. we can see groups for each domain also.   But problem is, if we create a group named ALLVPN in root domainA and there are 3 members in this group. member1-groupC which is member of root domainA member2-groupD which is member of domainB member3-groupE which is member of domainC   show user group name ALLVPN only shows member of groupC. Does paloalto support this ?   we tried also port 3268 instead of 389 but nothing changed.       ... View more

Hi, we're having an issue with 3050 very high cpu.new installed device and when checking dp file we see that , anyone can tell what can be cause this ? probably  ? Thanks. panos 6.1.4 packet buffer is not high, packet descriptor is not high session count is normal throughput is normal packet rate is between 80000-100000 at problem time. Resource monitoring sampling data (per second): : :CPU load sampling by group: :flow_lookup : 97% :flow_fastpath : 90% :flow_slowpath : 97% :flow_forwarding : 97% :flow_mgmt : 60% :flow_ctrl : 60% :nac_result : 97% :flow_np : 90% :dfa_result : 97% :module_internal : 97% :aho_result : 97% :zip_result : 97% :pktlog_forwarding : 98% :lwm : 0% :flow_host : 60% : :CPU load (%) during last 15 seconds: :core 0 1 2 3 4 5 : 0 60 97 97 98 98 : 0 59 97 97 97 97 : 0 59 98 98 98 98 : 0 59 98 98 98 98 : 0 56 97 97 98 98 : 0 57 98 98 98 98 : 0 59 97 97 97 97 : 0 57 94 94 95 95 : 0 56 95 95 96 96 : 0 53 95 96 96 96 : 0 49 93 93 94 94 : 0 50 94 94 95 95 : 0 52 95 95 95 95 : 0 61 96 96 96 96 : 0 64 98 98 98 98 : :Resource utilization (%) during last 15 seconds: :session: : 20 20 19 19 19 19 19 19 19 19 19 19 19 19 19 : :packet buffer: : 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 : :packet descriptor: : 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 : :packet descriptor (on-chip): : 7 6 3 3 4 4 4 4 3 5 4 3 3 5 6 : : :Resource monitoring statistics (per minute): :CPU load (%) during last 15 minutes: :core 0 1 2 3 4 5 : avg max avg max avg max avg max avg max avg max : 0 0 53 60 95 99 95 99 96 99 96 99 : 0 0 55 66 96 100 96 100 96 100 96 100 : 0 0 55 66 95 100 95 100 96 100 96 100 : 0 0 58 69 97 100 97 100 97 100 97 100 : 0 0 57 65 97 100 97 100 97 100 97 100 : 0 0 59 69 99 100 99 100 99 100 99 100 : 0 0 59 73 97 100 97 100 97 100 97 100 : 0 0 57 65 98 100 98 100 98 100 98 100 : 0 0 54 66 97 100 97 100 97 100 97 100 : 0 0 55 67 97 100 97 100 97 100 97 100 : 0 0 53 63 96 100 96 100 96 100 97 100 : 0 0 52 58 96 99 96 99 96 99 96 100 : 0 0 46 57 93 99 93 99 93 99 93 99 : 0 0 47 62 92 98 92 98 93 98 93 98 : 0 0 55 70 95 99 95 99 95 99 95 99 :Resource utilization (%) during last 15 minutes: :session (average): : 19 21 19 20 20 20 21 20 20 19 20 19 18 19 18 : :session (maximum): : 20 22 20 21 20 21 22 22 20 20 21 20 19 19 19 : :packet buffer (average): : 0 0 0 1 0 1 1 1 0 0 0 0 0 0 0 : :packet buffer (maximum): : 1 2 1 1 1 2 1 1 1 1 1 1 1 1 1 : :packet descriptor (average): : 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 : :packet descriptor (maximum): : 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 : :packet descriptor (on-chip) (average): : 4 5 4 6 4 6 6 6 4 5 4 4 3 5 5 : :packet descriptor (on-chip) (maximum): : 8 24 9 22 7 20 14 18 11 17 10 8 8 31 28 : :-------------------------------------------------------------------------------- :Number of sessions supported: 524286 :Number of active sessions: 103036 :Number of active TCP sessions: 52227 :Number of active UDP sessions: 45340 :Number of active ICMP sessions: 89 :Number of active BCAST sessions: 0 :Number of active MCAST sessions: 0 :Number of active predict sessions: 1981 :Session table utilization: 19% :Number of sessions created since bootup: 24249791 :Packet rate: 95996/s :Throughput: 574825 kbps :New connection establish rate: 2316 cps :-------------------------------------------------------------------------------- :Session timeout : TCP default timeout: 3600 secs : TCP session timeout before SYN-ACK received: 5 secs : TCP session timeout before 3-way handshaking: 10 secs : TCP half-closed session timeout: 120 secs : TCP session timeout in TIME_WAIT: 15 secs : TCP session timeout for unverified RST: 30 secs : UDP default timeout: 30 secs : ICMP default timeout: 6 secs : other IP default timeout: 30 secs : Captive Portal session timeout: 30 secs : Session timeout in discard state: : TCP: 90 secs, UDP: 60 secs, other IP protocols: 60 secs :-------------------------------------------------------------------------------- :Session accelerated aging: True : Accelerated aging threshold: 80% of utilization : Scaling factor: 2 X :-------------------------------------------------------------------------------- :Session setup : TCP - reject non-SYN first packet: True : Hardware session offloading: True : IPv6 firewalling: True : Strict TCP/IP checksum: True :-------------------------------------------------------------------------------- :Application trickling scan parameters: : Timeout to determine application trickling: 10 secs : Resource utilization threshold to start scan: 80% : Scan scaling factor over regular aging: 8 :-------------------------------------------------------------------------------- :Session behavior when resource limit is reached: drop :-------------------------------------------------------------------------------- :Pcap token bucket rate : 10485760 :-------------------------------------------------------------------------------- ... View more