About kadak

kadak · ‎07-30-2014

Hello CHammock Each managed device maintains a flag for the rules that have a match. Panorama monitors each device, fetches and aggregrates the list of rules that do no have a match. On managed firewalls, that flag is reset when a dataplane reset occurs on a reboot or a restart, Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-24-2014

Hello infotech Example : If your security zone to which GP belongs to is 'GP_VPN' , you can build a query builder for that zone in custom reports. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-24-2014

No worries Welligton. I am glad that I can help you.

kadak · ‎07-24-2014

Hello aguley The hits counts on any policy can be viewed under Monitor > Reports > Traffic reports > Security rules. Or for a detailed report, you can create a custom report with a following template: The result: Hope that helps! Thanks and regards, Kuna Adak

kadak · ‎07-23-2014

Hello Welligton, I wanted to point out couple of important things for successful safe search enforcement: The following snippet was taken from the following document: New Features Guide 6.0 (English) (Page 26 onwards) Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello aguley, Since you don't have URL filtering license, I presume you don't have URL filtering profile applied to any of your security policies. If you don't have URL filtering profiles applied to security policies, then you won't see URL filtering logs. Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello aguley, Under Monitor tab, click on URL filtering logs. Under URL filtering logs, you need to have the 'source user' column. If it doesn't have by default, then you can add the column. Or you can enable it : Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello aguley, I hope you are looking into URL logs for X-forwarded information - not the traffic logs. Reference: x-forward source user information is not showing in traffic logs Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello apackard, The top verdict of the WildFire report is the final result for the entire sample, while the individual verdicts that are marked as malicious/malware are on a per virtual machine (VM) basis. Each VM creates a verdict based on file types, such as, exe and pdf. The VM verdict is authoritative for the individual VM run, and the verdict on the sample is authoritative for the entire sample. Additional heuristics are applied to the sample verdict. In the above case, the individual VM displayed some malicious behaviors but the applied algorithm deemed the sample was not malicious. The sample verdict is the superior result. Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello aguley, I went through Enabling support for the X-Forwarded-For HTTP header. document and didn't see the commit operation mentioned. If you have enabled it from the configuration mode, lets make sure you commit the configuration: > configure # set deviceconfig setting ctd x-forwarded-for yes #commit force Regards, Kunal Adak

kadak · ‎07-22-2014

Hello Roman, It is working as expected because when filtering Objects you have 3 options [equal, not equal and is present] and with Description you have only [contains]. Here is how you can view your available options (click on the 'plus' sign on the right hand side top corner): Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-18-2014

Hello CGSD, Looks like ' user name is ___empty_username___, domain name ' is not populating correctly for 8.1 Windows. May be this can help: GlobalProtect single sign on did not work Thanks and regards, Kunal Adak

kadak · ‎07-18-2014

Hello Ryan, If you are using PANOS 5.0 and above you wouldn't be required to include dependent applications in the security policies. Here is the document that explains the same: How to Check if an Application Needs to have Explicitly Allowed Dependency Apps Hope that helps! Thank and regards, Kunal Adak

kadak · ‎07-16-2014

Hello StefanV Please try this one: https://192.168.50.10/api/?REST_API_TOKEN=1239250485&type=op&cmd=<show><running><rule-use><vsys>vsys1</vsys><rule-base>security</rule-base><type>unused</type></rule-use></running></show> Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-14-2014

Hello Erwin, Here is the document that explains how to configure PAN for dual ISP failovers: Dual ISP Branch Office Configuration In short, you would: 1. Configure a PBF policy on PAN FW in HQ1, to route Internet traffic via ISP1 and enable monitoring in PBF. 2. Configure an IPSEC tunnel between PAN FW1 and PAN FW2 3. Configure a static route in the routing table of PAN FW in HQ1 to route Internet traffic using tunnel as an exiting interface. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-11-2014

Hello tiwara, Restarting the management server will always be a temporary workaround. We need to know what made the management plane go high (CPU wise) in the first place to identify the culprit. For that, TAC would require: 1.) Trace of the management server (debug software trace management-server). Associate the PID of the management server and find out what thread the function is being called. 2.) show system resources follow (1+shift H + C). That would give the top running resources with threads on and CPU's consumption on individual basis 3.) Core the management server process so that we can perform GDB analysis on it . Once a case is opened, a TAC engineer would help you gather that information and then can present his/her findings to the engineering team for RCA. FYI, there were are no known management CPU issues which are fixed in 5.1.7 and 5.1.8 Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-10-2014

Hello, Have you fetched the new licenses for PAN-DB? That option would only populate once the licenses are fetched. Here is the document that explains the same: How to Move from PAN-DB to BrightCloud on the Palo Alto Networks Device Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-09-2014

Hello cmateam, The transition should be pretty smooth and a reboot is not required. 1.) You can delete the expired license using : > delete license key <key name for the the expired license> 2.) From the web interface, you can Fetch the license under Device > License tab.This should fetch the purchased licenses with new expiration key. If you are using PAN-DB, you activate it using the following documents: How to Install and Activate PAN-DB for URL Filtering Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-09-2014

Hello Paulo_Aun, Could you please try username : admin/ password: admin Thanks and regards, Kunal Adak

kadak · ‎07-08-2014

Hello clint.leatherman, Could you provide me the link of the particular facebook page you are trying to allow. Thanks and regards, Kunal Adak

kadak · ‎07-08-2014

Hello TheBest, You can have multiple interfaces of same type (L2/ L3/ Vwire) in one zone, but cannot tie multiple zones to one interface. Having said that, it was always a best practice to associate the tunnel interface to its own zone - something like GP-VPN and then configure a security rule from GP-VPN to Trust and GP-VPN to Untrust. In that way, you not only have more control over the traffic but you can also turn on PAN's IDS/IPS feature by applying AV, anti-spyware, anti-vulnerability, URL-filtering and data filtering profiles. Thanks and regards, Kunal Adak

kadak · ‎07-07-2014

Hello s996kingsm, Can we make sure that the External interface, Global Protect portal, Global protect gateway, Authentication profile and LDAP server profile are a part of one Vsys (original vsys). Thanks and regards, Kunal Adak

kadak · ‎07-07-2014

Hello jprice2, Since Panorama itself doesn't have the session browser and botnet section under Monitor tab, you wouldn't find it under the admin role section. The only way to control is that, to switch the context to one of the managed firewalls and create an admin role where actually have control over the session browser and botnet section. The below screenshot is from a PA-200. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-07-2014

Hello TheBest, I would remove the AD group from the agent configuration and would use it in a security rule. For example, if your tunnel belongs to a zone called 'GP-VPN', I would create a security rule from 'GP-VPN' to 'Trust' and leverage the user-group feature in the 'source user' column of that policy and then test. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-03-2014

Hello EmyB, Here is the document that explains how to configure PAN for dual ISP failovers: Dual ISP Branch Office Configuration The gist is: 1.) Primary Internet uses Policy based forwarding to route Internet traffic. You can have a failover mechanism in the rule where you monitor an IP address, and if that fails - the traffic would look for routes in the routing table. 2.) Secondary Internet (Cradlepoint 4G) uses routing table (static default) route to Internet traffic Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-02-2014

Hello gelgin, As far as the firewall is concerned, the management plane would definitely take heavy toll if there are multiple administrators filtering traffic logs at the same time. In order to cope up with Service providers and Enterprise level environments, we have a central managing system (virtualized or hardware based) called 'Panorama' where is specially dedicated for logging and reporting purposes. Its a central management system that manages several firewall together and can be ready in situations like yours. More on Panorama: Panorama Administrator's Guide 6.0 (English) Panorama Design Planning If Panorama is not an option, you can enable syslogging on the firewall and certainly leverage third party vendors like SPLUNK and SPICEWORKS. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-01-2014

Hello Axca, If I understand you concern correctly, you would like the IP addresses assigned by GP ippool to be somewhat sticky for GP clients - similar to DHCP server leasing out IP scopes for clients so when the GP client re-connects, they get the same IP back. If that it is case, that would be a limitation on the Palo Alto Firewall for now. However, i do see a feature request (FR ID: 3550) been submitted to the development team for future inclusion. You can request your account's SE to vote for it so that it gets more traction. You can also change the registry key on individual client machines for PreferredIP under HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\PreferredIP. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-01-2014

Hello jmck9999, The following document illustrates Palo Alto's recommended best practices for HA failover scenarios for link and path monitoring: High Availability Failover Optimization Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎06-30-2014

Hello craigmueller, Here is the link you are looking for : Trigger Conditions for Brute Force Signatures Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎06-26-2014

Hello ericgearhart and DMast, Following is the feature request submitted to the development team for 'Where used objects functionality': FR ID : 1285 Thanks and regards, Kunal Adak

Date Registered	‎11-07-2011 07:38 AM
Date Last Visited	‎09-27-2019 05:34 PM
Total Messages Posted	259
Total Likes Received	101

Online Status	Offline
Date Last Visited	‎09-27-2019 05:34 PM

Enterprise

Prisma

Cortex

About kadak