About asia

asia · ‎11-19-2012

Thanks for the answer, but i dont understand, is it the number of custom url category or the number of entries in a category? Also, is it 50 for PA-5050 or 50 thousands ? Regard's.

asia · ‎11-15-2012

Hello, What is the maximu number of custom url category on a PAN device? Regard's

asia · ‎11-07-2012

Hello, We are using XML REST API to do some configs on our PAN devices ans our Panorama, we are looking for a way to import an url file into a custom url category using the API. Is it possible? Regards.

asia · ‎03-07-2012

Hello, We have an issue with captive portal not correctly redirecting https traffic. The https traffic is sometimes allowed without redirection to the captive portal, and sometimes dropped, without any logs, the only way to see the issue is to make paket capture. The captive portal is configured in redirect mode. Any idea please? regard's.

asia · ‎12-06-2011

Hello, We have an issue occuring in a HA cluster, the HA connection goes down, so a passive device transit to the active state and thene backword to passive due to a split brain recovery procedure (is it because of the heart-beat backup configured ?) and a second after all network interfaces goes up/down. Is this a normal behaviour? We are running PAN-OS 4.0.5. Regards

asia · ‎12-02-2011

Hello, Is it supported to authenticate administrators throw a free-radius server and authorize them using a custom role? I see that there are 5 VSA in the radius dictionary on the PAN firewall for free-radius witch correspond ti the predefined admin roles. Is it possible to expad this list? Regard's.

asia · ‎08-24-2011

Hello, Is it possible to make PAN-OS upgrade from 3.1.9 directly to 4.0.4?

asia · ‎08-16-2011

Hello, We try to make ping throw a PAN-4020 device, whene we try with a 1023 byte pakets it works, but wehen we try with a 1024 byte pakets this is rejected by the PAN. Is there any limit on the icmp paket size? Also, whene we activate the jumbo frame mode on the device, is there any impact on traffic or on the function of the device (reboot required,...) Regard's.

asia · ‎06-10-2011

Ok, thanks for the answer. Could you tell me at least what is the maximum value that we can configure for the timer to read the server sessions? Regard's

asia · ‎06-06-2011

Hi, Is there a radius dictionary file for use with free-radius? Regard's

asia · ‎06-06-2011

Any idea please about this request? Regard's

asia · ‎05-26-2011

Hello, In pan-agent, is it possible to disable server sessions monitoring and to work only on security logs, is there any option in GUI or in configuration file of the pan-agent that can be modified to reach this bheaviour? Regard's

asia · ‎02-23-2011

Hi swythe, As mentioned in your document, w e tried to configure the appliance to send the Hostname in syslog message, checking "send hostname in syslog" in the device/management section on the gui. But It does not work. We still receive the ip address instead of the name. You will find below an example we received on our syslog server : 02-23-2011 16:38:06 Local1.Info 10.x.x.x Feb 23 16:38:06 10.x.x.x 1,2011/02/23 16:38:06,0006C100733,SYSTEM,general,0,2011/02/23 16:38:06,,general,,0,0,general,informational,User xxxxx logged in via Web from 10.x.x.x using https<000> I read another case on this site about the same problem but I did not understand the answer. We use the 3.1.5 version. Could you please help. Thank you very much in advance

asia · ‎02-16-2011

Hello, We want to use inbound NAT in different VSYS on a PAN 4020 device. The question is, is it possible to use adresses(mip equivalent on netscreen devices) from the same subnet on different phisycal interfaces in different vsys? On netscreen devices we must split adresses in different subnets and make routing on network routers behind the firewall, is the same condition present on Palo Alto devices or we can make it work without this kind of segmentation. Thank you for your answers. Regrd's.

asia · ‎01-03-2011

Hello, I noticed that whene creating custom reports on "url log", it is not possible to make conditions on custom url category, any idea? Regard's.

asia · ‎12-23-2010

Hi, We are planning to use custom url categories and block/allow list to make url filtering, i want to know if in this situation the url filtering license is required. In the same time, can i put my own urls (those that will be authirzed) in a custom category, and block all the rest of the categories to make an efficient fiternig? Regard's

asia · ‎11-18-2010

Hello, Thank you for the answers, but the problem here is not the age out of routes, but the issue is that the PAN device don't flush LSAs in the lsdb concerning a neighbour wich is gone (down), what we noticed, is that whene the PAN loose the neighbourship with the router, it marks it down as a neighbour, it flush the routes, but it does not flush the LSAs, and continue incrementing there age and advertising them to other neighbours, hope my clarifications will be useful to a more precise understanding of the issue and more efficient fix :smileyplain: Regard's.

asia · ‎11-16-2010

Hello, We were doing some tests on ospf, and we noticed that the firewall dont flush his ospf adjacency table even if a nheibour goes down, and this for a duration of one hour, in wich it continue to include the wrong information (concerning the gone neibour) into it's advertisement, wich cause inconsistency in routing politique. Is ther any idea, is it a known bug? Regard's.

asia · ‎10-13-2010

I have this errors when updating my brigjtcloud url filtering dtabase : Oct 13 17:55:35 Newer update available... Oct 13 17:55:35 Best IP for database.brightcloud.com is 0.0.0.0 Oct 13 17:55:35 Failed to download 'full_bcdb_3.458.bin' Oct 13 17:55:35 Error: pan_bc_download(pan_bc_url.c:1200): Failed to perform download and update Oct 13 17:55:35 Error downloading latest URL database failed gethostbyname for service.brightcloud.com failed gethostbyname for service.brightcloud.com failed gethostbyname for database.brightcloud.com failed gethostbyname for database.brightcloud.com Ssl error: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Any idea please? Regards.

asia · ‎09-30-2010

And what about block action in url filtering profile, is it a quite drop or a RST ?

asia · ‎09-29-2010

Hi, I have recently installed a pan device in TAP mode, with a port mirroring on a cisco switch that copy traffic to the tap interface. On the policy cofigured to allow all between TAP zone and TAP zone, i have configured default security profiles, specially url filtering profile that block some categories by default, so the question is, while beeing in tap mode, is it possible that the firewall actively participate in the traffic, by blocking some urls for example? I wanr also to know if the block action in url fiktering profiles is achived by a quiet drop of paquets or by a sending of TCP RST paquet? Regards.

asia · ‎09-13-2010

Hi, I noticed that rules pushed on devices from panorama are not editable directly on the device, is ther any way to make it possible, we can imagine a situation in witch panorama is down, and there is an urgent need to modify some rules. Regrds.

asia · ‎09-08-2010

Hi, Whene creating reports within Panorama, and whene choosing database for the report what is the diffrence between panorama database such as "panorama traffic log" and the other databases such as "traffic log". Regards.

asia · ‎08-26-2010

Hi, Whene triying to configure tow interfaces(eth1/17 and eth1/18) on a PAN-4020 device in an aggregate interface the interface eth1/18 never goes up. Whene switching the same cable on the eth1/19 all things works well. I have incountred this problem on tow PAN 4020 devices always the issue is with the eth1/18 if. I'am using PAN-OS 3.0.10. Any idea please? Regard's

asia · ‎07-21-2010

In the service column i allow "any" service, in the admin guide it is recommended to not use "use application default" for user defined applications. The destination ports marked as Unknown-tcp are various (internal developement applications) and different from those defined in the application default ports definition and those defined in the application override rule. Regards.

asia · ‎07-20-2010

In my case, the logs mention the same rule that allows the applications defined by application override. Normaly, the rule must allow only the ports/ip mentioned in the application override rule. And there is not other rule that allow the traffic marked as unknown-tcp. Any other idea please? Regards

asia · ‎07-19-2010

Hi, I'am using PAN-OS 3.0.9, and i have configured some policies in witch i allow some applications defined by application override. I noticed that in the logs associated to this policies, there are lines that are identified as "unknown-tcp" with action :"allow" and type "end", is this normal? Normaly the firewall should not allow this connexions because they are not part of the application override, and should only allow this applications. Any explanations please. Regard's.

asia · ‎06-08-2010

Thanks stephen, In this case, can you telle me the meaning of this point in the release notes. Regards

asia · ‎06-07-2010

Hello, I noticed this in the PAN-OS 3.1.2 release notes : Captive Portal Session Enhancements – The captive portal web forms method of authenticating and identifying a user’s IP address has been modified to include a session cookie. This session cookie is used to maintain the user to IP mapping as long as the users’ browser remains running. In addition, an option to use an explicit L3 interface for the captive portal web form can now be used to avoid certificate mismatch issues when presenting the form via SSL. Does this mean that we can directly connect to captive portal web form without having the need to be redirected? If yes, i have installed the 3.1.2 version of PAN-OS, but i don't find any option to slect this kind of function. Any idea? Regrd's.

asia · ‎05-20-2010

I'am using pan agent 3.1.0 and PAN-OS 3.0.9. I have some issue that are not affecting traffic, but i want an explanation for it. First, the agent status indicate that it cannot read security logs on a DC, even if it has the rights to read it, and there is no log messages in the pan agent log file indicating the issue, is it a folse positif? and if yes, is there any bug in the 3.1.0 version? Second, whene i issue the comand show pan-agent statistics, the status is "connected, reading", i think that in normal conditions it should be "ceonnected, ok", so is there any issue with this. Regards.

Date Registered	‎12-15-2009 02:48 AM
Date Last Visited	‎08-18-2015 09:06 AM
Total Messages Posted	71
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

About asia

Re: What is the maximum number of custom url category in PAN device?

What is the maximum number of custom url category in PAN device?

Is it possible to import an url file using the XML API?

Is HTTPs traffic correctly rdirected in PANOS 4.0.8?

Network interfaces goes Down/Up after a HA failover

What is "distribution groups"

Why permitiing web-brosing is required while permitting custom http-based apps?

Re: What is the maximum number of custom url category in PAN device?

What is the maximum number of custom url category in PAN device?

Is it possible to import an url file using the XML API?

Is HTTPs traffic correctly rdirected in PANOS 4.0.8?

Network interfaces goes Down/Up after a HA failover

Radius authentication with custom admin roles

Upgrade path to 4.0.4

Is there a limit on the icmp pakets size?

Re: Disabling server sessions on PAN agent ?

PAN radius dictionary for free-radius

Re: Disabling server sessions on PAN agent ?

Disabling server sessions on PAN agent ?

Re: PAN-OS Syslog messages

Is it possible to use public IPs on the same subnet on different interfaces?

Is it possible to make custom reports on custom url categories?

Is url filtering license required to use block list and custom url category?

Re: Is ther an OSPF issue in PAN-OS 3.1.5

Is ther an OSPF issue in PAN-OS 3.1.5

URL update problem in 3.1.5?

Re: Is it possible that a firewall configured in tap mode block traffic?

Is it possible that a firewall configured in tap mode block traffic?

Is it possible to modify panorama created rules directly on PAN devices?

Creating Reports on Panorama

Interface problème whene using aggregate with PAN-OS 3.0.10

Re: Uknown-tcp in application based policy logs !!

Re: Uknown-tcp in application based policy logs !!

Uknown-tcp in application based policy logs !!

Re: Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2

Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2

PAN-agent 3.1.0 problems

Strata

Prisma

Cortex

About asia