About CCACieszkowski

@Naveed_Razaq, @LaneOneil - I have encountered the same error. Please check the firewall ms.log for similar entries (CLI: grep context 3 ignore-case yes mp-log ms.log pattern dlsrvr): 2021-05-06 09:37:16.178 +0200 Error: download_url(pan_deploy_client.c:554): Failed to get DLSRVR client key. 2021-05-06 09:37:16.189 +0200 Error: download_url(pan_deploy_client.c:591): Curl failed; Error: 'unable to set private key file: '/etc/dlsrvr.d/client_sha256.key' type PEM(dest => 172.20.3.20)' [Code: 58 (Problem with the local SSL certificate)] 2021-05-06 09:37:16.440 +0200 Error: pan_mgmt_cms_handle_xfer_request(pan_deploy_client.c:889): Deploy dl error: 58. 2021-05-06 09:37:16.440 +0200 Error: pan_mgmt_cms_handle_xfer_request(pan_deploy_client.c:1024): Download error: Problem with the local SSL certificate. (58)  If they are present reinstalling the current, or installing higher, PAN-OS version and rebooting the PA should resolve the issue. TAC was unable to explain why those files got corrupted in my case. ... View more

@OtakarKlier    Main reason would be that dns Application Signature does not detect all tunneling and  tcp-over-dns Application Signature covers only a small subset of tools (" (...) application identifies traffic from the following tools, tcp-over-dns, dns2tcp, Iodine, Heyoka, OzymanDNS, and NSTX."). dnscat2 goes through the firewall with ease.   Albert ... View more

Hi@Torito,   Heave you tried converting those signatures, if you want to use them, using the IPS Signature Converter Plugin for Panorama (https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/ips-signature-converter-for-panorama.html)? With what result? Another approach would be to use DNS Security Service (https://www.paloaltonetworks.com/products/threat-detection-and-prevention/dns-security).   Albert ... View more

Hi @Mohammed_Yasin,   http_method in the Custom Vulnerability Object is the http-method Qualifier and the http_client_body is the http-req-message-body Context, i.e.,:     Albert ... View more

Hi @Mohammed_Yasin,   To actually respond to your question: http_method in the Custom Vulnerability Object is the http-method Qualifier and the http_client_body is the http-req-message-body Context, i.e.,:     Albert ... View more