About kadak

kadak · ‎07-30-2014

Hello CHammock Each managed device maintains a flag for the rules that have a match. Panorama monitors each device, fetches and aggregrates the list of rules that do no have a match. On managed firewalls, that flag is reset when a dataplane reset occurs on a reboot or a restart, Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-24-2014

Hello infotech Example : If your security zone to which GP belongs to is 'GP_VPN' , you can build a query builder for that zone in custom reports. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-24-2014

No worries Welligton. I am glad that I can help you.

kadak · ‎07-24-2014

Hello aguley The hits counts on any policy can be viewed under Monitor > Reports > Traffic reports > Security rules. Or for a detailed report, you can create a custom report with a following template: The result: Hope that helps! Thanks and regards, Kuna Adak

kadak · ‎07-23-2014

Hello Welligton, I wanted to point out couple of important things for successful safe search enforcement: The following snippet was taken from the following document: New Features Guide 6.0 (English) (Page 26 onwards) Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello aguley, Since you don't have URL filtering license, I presume you don't have URL filtering profile applied to any of your security policies. If you don't have URL filtering profiles applied to security policies, then you won't see URL filtering logs. Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello aguley, Under Monitor tab, click on URL filtering logs. Under URL filtering logs, you need to have the 'source user' column. If it doesn't have by default, then you can add the column. Or you can enable it : Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello aguley, I hope you are looking into URL logs for X-forwarded information - not the traffic logs. Reference: x-forward source user information is not showing in traffic logs Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello apackard, The top verdict of the WildFire report is the final result for the entire sample, while the individual verdicts that are marked as malicious/malware are on a per virtual machine (VM) basis. Each VM creates a verdict based on file types, such as, exe and pdf. The VM verdict is authoritative for the individual VM run, and the verdict on the sample is authoritative for the entire sample. Additional heuristics are applied to the sample verdict. In the above case, the individual VM displayed some malicious behaviors but the applied algorithm deemed the sample was not malicious. The sample verdict is the superior result. Thanks and regards, Kunal Adak

kadak · ‎07-23-2014

Hello aguley, I went through Enabling support for the X-Forwarded-For HTTP header. document and didn't see the commit operation mentioned. If you have enabled it from the configuration mode, lets make sure you commit the configuration: > configure # set deviceconfig setting ctd x-forwarded-for yes #commit force Regards, Kunal Adak

kadak · ‎07-22-2014

Hello Roman, It is working as expected because when filtering Objects you have 3 options [equal, not equal and is present] and with Description you have only [contains]. Here is how you can view your available options (click on the 'plus' sign on the right hand side top corner): Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-18-2014

Hello CGSD, Looks like ' user name is ___empty_username___, domain name ' is not populating correctly for 8.1 Windows. May be this can help: GlobalProtect single sign on did not work Thanks and regards, Kunal Adak

kadak · ‎07-18-2014

Hello Ryan, If you are using PANOS 5.0 and above you wouldn't be required to include dependent applications in the security policies. Here is the document that explains the same: How to Check if an Application Needs to have Explicitly Allowed Dependency Apps Hope that helps! Thank and regards, Kunal Adak

kadak · ‎07-16-2014

Hello StefanV Please try this one: https://192.168.50.10/api/?REST_API_TOKEN=1239250485&type=op&cmd=<show><running><rule-use><vsys>vsys1</vsys><rule-base>security</rule-base><type>unused</type></rule-use></running></show> Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎07-14-2014

Hello Erwin, Here is the document that explains how to configure PAN for dual ISP failovers: Dual ISP Branch Office Configuration In short, you would: 1. Configure a PBF policy on PAN FW in HQ1, to route Internet traffic via ISP1 and enable monitoring in PBF. 2. Configure an IPSEC tunnel between PAN FW1 and PAN FW2 3. Configure a static route in the routing table of PAN FW in HQ1 to route Internet traffic using tunnel as an exiting interface. Hope that helps! Thanks and regards, Kunal Adak

Member Since	‎11-07-2011 07:38 AM
Date Last Visited	‎09-17-2021 06:21 PM
Posts	259
Total Likes Received	113

Online Status	Offline
Date Last Visited	‎09-17-2021 06:21 PM

About kadak

Re: How Does the "Highlight Unused Rules" Option Work on Panorama?

Re: Remove access report

Re: Safe Search Enforcement

Re: Reports

Re: Safe Search Enforcement

Re: will an unlicensed Palo Alto pass traffic?

Re: Forwarding with ICAP

Re: Any way to Manually Sync LDAP Group Mapping?

Re: GRE- plans to support on PAN

Re: Firewall Statistics Report

Re: How Does the "Highlight Unused Rules" Option Work on Panorama?

Re: Remove access report

Re: Safe Search Enforcement

Re: Reports

Re: Safe Search Enforcement

Re: PA5020 and Proxy Server

Re: PA5020 and Proxy Server

Re: PA5020 and Proxy Server

Re: Wildfire Alert - Malicious status but benign detail

Re: PA5020 and Proxy Server

Re: Filtering Systemlog

Re: Anyone successfull with Global Protect Single Sign on and Windows 8.1 client?

Re: Application Dependency

Re: Using the API to get unused and used rules

Re: How to configure PaloAlto to Fail-over to another ISP on a remote location

Network Security

Cloud Security

Security Operations

About kadak