About rps

The multi wildcard in a *.* format is unsupported and it would block all raffic if added to a block list. The example you gave shold be *.foo.com ~Phil ... View more

A workaround to take care of browserbased stuff would be to enable captive portal and set it to "ntlm auth" (in order to make it transparent for the user). Note however that the PAN unit currently only cache the ntlm auth per ip (which means if you have one user per ip then you are safe, but not if you have several users per ip like with terminalservers). I have been told that this (ntlm caching per ip) willl most likely be fixed in upcoming versions (so it will be an option to cache per session instead making it work with terminalservers similar to how Bluecoat does its user-mapping). ... View more

What is on your allow list? Perhaps you have enabled msn2go (or a category/subcategory where msn2go exists in) by accident (which is basically browserbased msn chat), on the other hand I have been told that PAN will have "deny" as highest prio (like if one rule says deny msn and the other rule says allow msn2go then the deny rule should win). ... View more

How is the traffic recognized in your traffic log, as ssl or as paloalto-userid-agent? There is an application named "paloalto-userid-agent" (or similar) which in case you use a non default port you might need to setup an "application override" for so the PAN will know its userid-agent traffic. However when you setup a policy for this traffic (if reach through one of the interfaces on the dataplane) I think you need to setup both ssl and paloalto-userid-agent as allowed applications. ... View more

Looks like you can do a few things: Configure the management interface so it does not use a proxy Change the interface used for updates to the external transit interface (Service Route configuration under the Device/Setup area) Manually pull the latest 3.1 update from the Support site and upload to the box via Web GUI or CLI.  After upgrading the OS the updates should work fine through the proxy. Cheers, Kelly ... View more

Hello Sandeep, I'll check on this again with my partner Kind Regards Franz Leippert ... View more

How come? ... View more

Cant you set QoS based on filetype? Because most stuff on windowsupdate is just gif, html etc until you actually starts to download the updates which are .exe or .cab. ... View more

Another option would be to setup a /30 net (private ips) between the PAN and the isp and then let the isp route all /24 to the private ip of the PAN. In the PAN you will then setup DNAT and/or SNAT rules regarding if its incoming or outgoing traffic you want to let through. Would look something like: ISP: 10.0.0.1/30 PAN: 10.0.0.2/30 PAN def gw: 10.0.0.1 ISP route: x.x.x.x/24 next hop 10.0.0.2 DNAT x.x.x.101 (server1) -> 192.168.1.101 (traffic towards x.x.x.101 will be destination nated and sent to 192.168.1.101 on the dmz zone) SNAT 192.168.0.0/24 -> x.x.x.200 (traffic from client zone will be source nated into x.x.x.200 (all clients will be hidden behind one ip)) or whatever your network will look like... This way you will have a single (and a straight forward design) connection to the isp and at the same time having your internal zones (dmz + client) to use private ips (the PAN will perform the nating) while the public ips wont change. ... View more

Hi Samuel, Can you try adding the magic word "all" (without the double quotes) in your Authentication Profile -> Edit Allow List -> Additional Users : "all" It should work if you run 3.1.x, and hit commit. Arnaud. ... View more

I agree with you that deny, tcp reset, and packet drops will produce the same result where the users will see errors on the web page.  That's why I think a request to do tcp reset/drop is not necessary as it will not produce the desired result. If we set the adserver hostname to 0.0.0.0, the contents will not be displayed but there will be red X's where the contents are supposed to be.  So the result is that users will see broken links via the red X's, think something is wrong, and call the helpdesk. While the method of 1-pixel image is not perfect, it is the best option.  You don't have to set it for all category, just the ads category. Thanks. ... View more

  Here are the services using the open ports you have indicated. 6080-6081 - Captive portal, Captive portal redirect and URL override page 6082- Captive portal  Captive portal redirect with certificate. ... View more

SSL (https) is not only used to keep traffic secure from sniffing / routing errors on the internet but also a way for malware (spyware, virus and stuff) to avoid being detected by an antivirus engine (until it reaches the victim) since the traffic is encrypted when it passes the firewall. When you enable forward decryption the PAN unit will act as a man in the middle attack by decrypting the ssl-session, investigate the traffic (be able to find out which app is used, scan for vulns, scan for virus, scan for spyware etc) and then encrypt it again and send it to the client (if the policy says to allow the traffic). In order to do this in silence the client must have the ca.crt which the PAN unit will use to encrypt the ssl between itself and the client (otherwise the client will get an error that the cert is issued by a ca which is not trusted). If you want to protect your net you can enable forward decryption for all outbound traffic (NOTE: do NOT enable it for the PAN unit itself otherwise the managementplane will become instable 😃 which means that ssl stuff that cannot deal with a custom ca.crt will simply be blocked (that is block traffic that you cannot inspect but this depends on the usage of the PAN unit and company policy surrounding the nets involved). The downside is that this MITM attack doesnt work if the client already have stored the cert which the server will use (since the certs will no longer match). This is the case for windowsupdate for example which means that you need to setup a "app: ms-update" + destination of windowsupdate servers as "no decrypt" rule before your "forward decrypt" rule in SSL Decryption settings. Example: rule1: from trust to untrust source: any destination: *.windowsupdate.com (etc) app: ms-update action: nodecrypt rule2: from trust to untrust source: any destination: any app: any action: forward decrypt In the above case you must decide if you want to allow traffic from windowsupdate servers to be unscanned (but allowed for the client) or block this traffic all together (by simply just delete/disable "rule1" above). ... View more

Thank you for this quick answer, this is indeed what I had deduced too. So is there a way to achieve this ? We are already generating an "odd behavioured machines" repport on allowed trafic, but having also the denied one would make this repport muich more usefull. Any thoughts ? ... View more

I got a suggestion for workaround in https://live.paloaltonetworks.com/thread/1276?tstart=0 I will contact our support and file this as a request. ... View more