About LCMember2860

LCMember2860 · ‎11-24-2014

Google have introduced a virtual IP to facilitate the enforcement of safesearch (: Block adult content at your school - Search Help (option 3 I too have found PAN's safesearch enforcement feature buggy and unreliable, and Google's own solution has the added advantage that it requires no end-user configuration at all - safesearch gets forced on transparently. It's straightforward to set this up on our DNS servers using RPZ (we're already doing this for Google's nosslsearch virtual IP), but... we don't force users to use our DNS so they can easily bypass this by using Googles (or some other) DNS. Is there some way to transparently proxy external DNS requests to our own servers - the DNS proxy feature seems to assume that requests are directed to the PAN firewall, so this isn't an option - maybe PBF or sinkholing could be used?

LCMember2860 · ‎09-24-2014

which data would you like to see?

LCMember2860 · ‎09-24-2014

LCMember2860 · ‎09-23-2014

Assuming the detailed logs haven't been purged I would expect the figure for total bytes to be approximately the same in both databases (for the same query) - we have 8T of log storage with 60% allocated to the detailed logs so this shouldn't be an issue on a query only looking at the last 24 hours. i.e. if there is a steady 1G of web-browsing in a 15 minute period, this should get rolled up to be 4G for the 1 hour summary, 96G for the daily summary etc - or am I misunderstanding how the summary works? Even if some of the detailed logs had been purged I would then expect the figure for total bytes to be higher from the Summary database, not lower as we are seeing.

LCMember2860 · ‎09-23-2014

I ran 2 Panorama reports, using the detailed and summary databases, on application usage over the last 24 hours (simple reports, just top Applications ranked by bytes, no filters) the results were completely different e.g the figures for web-browsing: Summary: 720G Detailed: 3.3T The detailed figure looks correct, why is the summary figure so out of line? Obviously we have quite a lot of traffic and logs and running reports using the detailed database takes forever, I'd prefer to use the summary database but the figures are completely wrong.

LCMember2860 · ‎06-12-2014

Realised yesterday that NFS had been unmounted on our Panorama box for some time, with the result that logs were going to the much smaller internal storage partition. No alarms on the GUI to tell us this, or in the logs. Is it possible to monitor the NFS status via SNMP?

LCMember2860 · ‎04-25-2014

I'm testing through the API browser (ie the GUI) so the key is automatically generated (that's the API_TOKEN in the URL I pasted above). It doesn't work using a generated key either - we're already using the API for other functions that work fine.

LCMember2860 · ‎04-24-2014

I want to use the API to query URL (Brightcloud) categorisation. This is the command in the CLI: pan1(active)> test url theguardian.com theguardian.com news-and-media (Base db) running the same check via the API browser: https://x.x.x.x/api/?REST_API_TOKEN=250290343&type=op&cmd=<test><url>theguardian.com</url></test> <response status =" error " code =" 400 "> <result> <msg> Unsupported command. </msg> </result> </response> the firewall is on 6.0.1, and I think this worked via the API on PAN-OS 5. Other commands under the API "test" hierarchy are coming back unsupported also - perhaps the syntax has changed? (can't find anything in the API reference though).

LCMember2860 · ‎04-22-2014

We have YouTube blocked for some users, but it appears they can still play videos via the mobile app version of YouTube (both Android and IOS) Testing this myself I find that blocking is intermittent and if you hit play a few times the video eventually streams. Correlating with the logs it appears that some of the traffic gets identified as the YouTube application and blocked, some of it as generic SSL with a certificate domain in docs.google.com Anyone else come across this, and found a solution (that doesn't involved decrypting all SSL going to Google's IP ranges)?

LCMember2860 · ‎03-11-2014

great - that was my experience with previous releases, but it's not clear from the release notes.

LCMember2860 · ‎03-11-2014

Is it possible to manage devices still on 5.x code after upgrading Panorama to 6.x? I've upgraded our test firewall to 6.0 but obviously with Panorama on an older build I can no longer manage it.

LCMember2860 · ‎05-27-2013

Hi, Seeing over the last few days traffic going from our users (various different users in different locations) to IP addresses in Google's range (74.125.0.0/16) being identified as TOR, and subsequently blocked - traffic is all dest port 443. This is preventing access to certain websites hosted on Google's platform - appspot.com for example. I assume Google is not running TOR nodes, and looking back over previous release notes I see PAN-OS has had trouble identifying TOR in the past. (irrelevant fields removed): Session ID 3133462 Type deny Action deny Application tor Rule Bittorrent and TOR Category web-advertisements IP Protocol tcp Bytes 2,665 Bytes Received 2,119 Bytes Sent 546 Repeat Count 1 Packets 9 Packets Received 4 Packets Sent 5 Source address x.x.x.x Source Port 1342 Source Zone trust Destination address 74.125.24.155 Destination Country US Destination Port 443 Destination Zone untrust Anyone else seen this? Liam.LL

LCMember2860 · ‎11-27-2012

Thanks Doris. There's fewer categories in PAN's database (59 vs 73 for Brightcloud). Mostly this is because Brightcloud have multiple categories for Malware and IT, but the one that jumps out is "Cult and Occult" for which there is no equivalent in PAN's database. We have this category blocked, I suspect many other educational implementations also have it blocked and we can't just block the "Religion" category. (I'd also note that Fortinet and Websense both have equivalent categories). Example URL: churchofsatan.com - philosophically one might argue that all religions are cults by definition, but school boards tend not to see it that way . Needs to be addressed before we could even consider migrating from Brightcloud to PAN (which I assume is what you want everyone to do eventually).

LCMember2860 · ‎11-22-2012

Is there any information on this anywhere (ie the new PAN database, not Brightcloud) Is there a list of categories, and how do they map onto the Brightcloud categories? How can I lookup what category a URL is in, and request a change if required?

LCMember2860 · ‎11-14-2012

so the long-awaited v5 is now available. What are the implications of upgrading to it? is rollback to v4 straightforward (we're on 4.1.8 now)? does it force you to use the new PAN web-filtering database, or can you continue to use Brightcloud? Do we need to make changes to our rulebase (in particular WRT to the changes in the way app dependencies work in v5)? I don't particularly want to be a guinea-pig, but I am keen to see what improvements have been made.

Member Since	‎11-07-2011 07:09 AM
Date Last Visited	‎08-04-2023 05:31 AM
Posts	35
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎08-04-2023 05:31 AM

About LCMember2860

Re: Safe Search Enforcement

Re: big disparity between Detailed and Summary logs

Re: big disparity between Detailed and Summary logs

Re: big disparity between Detailed and Summary logs

big disparity between Detailed and Summary logs

monitor nfs via snmp

Re: API test url category

API test url category

YouTube mobile app

Re: Panorama 6.0

Re: Log filterting on the firewall

Re: Error in commit after upgrade to 10.1.5-h1

Re: Safe Search Enforcement

Re: big disparity between Detailed and Summary logs

Re: big disparity between Detailed and Summary logs

Re: big disparity between Detailed and Summary logs

big disparity between Detailed and Summary logs

monitor nfs via snmp

Re: API test url category

API test url category

YouTube mobile app

Re: Panorama 6.0

Panorama 6.0

SSL traffic mis-identified as TOR

Re: URL filtering in PAN-OS5

URL filtering in PAN-OS5

PAN-OS 5