About Bvance

We have a couple of tenants in our building and I was wanting to insure a guaranteed bandwidth of our 100 Mbs circuit for us regardless of what the tenants are doing. I was looking at something like this: I set all of our traffic to class 1 and all tenant traffic to class 2; create a QoS profile that sets class 1 with guaranteed bandwidth to 75 and 0 for max and class 2 with a 0 for guaranteed and 0 for max bandwidth. I am uncertain of what the 0 guaranteed will do. lets say one tenant is downloading a 35 GB file, will this QoS profile still guarantee us up to 75Mbs and the tenant have access to the remaining 25Mps + what we are not using of the 75Mps?   Thanks., ... View more

I was looking for EOL announcements for a couple of PA models and found this link: https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates. It doesn’t have dates for the 3032 or the 500. I just wanted to confirm this list is up to date or if there are dates posted for the two models mentioned? ... View more

This is a general question about PAN capabilities.   We are looking at acquiring a second, slower circuit for internet access backup. We would like this to be an automated fail over. I am trying to see if our PA 3050's are capable of this and am looking for the documentation on how to set this up on the PANs. Also, not sure how to route public DNS resolutions down second circuit after failover. Thanks, ... View more

I am following the document at https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/content-inspection-features/enhanced-security-for-url-category-and-application-based-policy in order to change the default action for spyware IDs 14978 and 14984. This is on an anti-spyware profile I had already created and in use on an existing security rule. I am running version 7.1.4 and application and threat version 711-4104. When I change the action on the two mentioned IDs I get the red flag in the upper left corner of the action field and it will not save my changes, it always reverts back to default (allow). I haven't yet fond the reason why it rejects the change. Any ideas? Thanks, ... View more

I have a second PA-500 I need to add to an existing production PA-500 for active/passive HA. I have read the admin guide for HA setup, but it appears to be for two pre-production firewalls. Are there any special precautions I need to take into account so that the post production firewall syncs it's config to the new firewall? The admin guide dosen't seem to say.   Thanks, ... View more

We have a PAN 3050 running 7.0.1. We are about to recieve a new circuit from our ISP that has a new /30 for the serial to the ISP. What I will have is a /30 (the serial connection) two /29's and one /28. I wil use the /29 for incomming request with NAT for port translation to access to backend, this subnet is already set up for this and in use. The /28 I am going to initially use for our outbound NAT DIP for translation to the internet. I know I can assign multiple IP's on the WAN interface but the one time I tried adding a /29 it caused a disruption on the WAN interface and access in/out was down.  Should I add the /30 address as a /32 for the actuall IP of the interface and then just simply add the other subnets as /29 and /28?  I have documentation on the basic configuration for the untrust interface, is there any for a WAN interface with multiple subnets?   Thanks for any advice, ... View more

I'm setting up a site-to-site VPN with static routes, which means the tunnel interface doesn’t need an IP address. But I would like to turn on tunnel monitoring and that does require an IP address on the tunnel interface. My question is does this IP need to be an actual publicly accessible IP or is it just two private IP's I define, both VPN peers in the same scope, for pinging? ... View more

I have block/continue set on a URL category and I was looking to see if there is a custome report I could build that would show me the users that use the continue password I have set and for which URLs they accessed? ... View more

Hello PAN, Today I had a client get infected with the "Windows Privacy Module" Fake AV, This wasn't cought by either PAN OS or Trend Micro while a MalwareBytes scan found it and removed it no problem. Is there something more I can do to increase the odds of my PA SG in catching these? I do keep th AV software up to date along with the PAN OS and I do have the Security profile on all ingress traffic set to block. Thanks, ... View more