About sebastian

Hi there, I already read the QoS in PAN-OS 4.1 document and the QoS section in the Panorama Administrator's Guide 6.0 (English). But there a still big question marks hovering over my head. :smileyconfused: The examples show only one use case/qos-profile at one time: "QoS for a Single User" or "QoS for Voice and Video Applications" or "restrict downloads to 15 Mbps". But I dont see a configuration where all these use cases are combined together. Maybe someone can provide me with proper screenshots of their qos configuration? So lets say: ethernet1/1 - zone untrust = 300MBit internet link ethernet1/22 with different sub-interfaces = 10GBit = development clients ethernet1/23 with different sub-interfaces = 10GBit = server infrastructure ethernet1/24 with different sub-interfaces = 10GBit = clients also different wireless clients/interfaces At first I didn't understand the need to setup the Egress Max (Mbps) on the physical interface. Ok at ethernet1/1 this is the only place where it makes sense, I have a 300MBit internet link. (Physical connected to 1GB) But it's only the egress traffic (uploading to the internet). But what should I do with the ingress traffic from the internet? I can't limit the egress max on the physical interface for ethernet1/22-24 to 300MBit (as seen in other discussions) because there is a lot of other traffic not only from/to the internet. And also different interfaces connects to the internet (ethernet1/1) To classify the traffic is easy-peasy but then? To start with: a) I want all salesforce traffic to be in class3 (prio high) and a "Egress Guaranteed" with 30MBit b) I want all video application to be in class1 (prio real-time) and a "Egress Guaranteed" with 20MBit c) normal web-browsing to be in class5 (prio medium) and a "Egress Guaranteed" with 20MBit but should not have an effect when I browse to an internal server (standing in ethernet1/23) I should not create a single QoS-Profile for salesforce and video application and web-browsing? Should i create a QoS-Profile incoming-untrust and outgoing-untrust? Where is the right place to set the egress maximum for the ethernet1/1 (ingress/downloading)? On the QoS-Interface it would affect all traffic not only the traffic that is coming from ethernet1/1 is'nt it? So I have to do that on the QoS Profile? Seems that correct to you? And what happends to all the other traffic? Goes than untouched bypass-traffic? Phew! Sebastian ... View more

Hi there, today a user tried to download a wallpaper from www.wallsave.com Wildfire says it is Malware. https://wildfire.paloaltonetworks.com/wildfire/reportdetail/2d6540e44f081882b611e1ed702e8f0032d309f0311ae0232f9a9a8da082e306/422433975/2 A few engines from virustotal also: https://www.virustotal.com/de/url/59e5f7d67a03d71946dd6b617c1ff130aec6b6b4178519ad9d77cc076b5c7a17/analysis/1403173699/ (www.wallsave.com/get/2588352) So my question is: why or when is this site marked as malware in the pan-db cloud? actual: >test url-info-cloud http://www.wallsave.com/ BM: wallsave.com,9,3,shareware-and-freeware Thanks, Sebastian ... View more

Hi there, I'm facing the following challenge. We have various guest users being authenticted via the captive portal after that, they are using their cisco vpn client. So there is only one session. And because all traffic is routed to the vpn connection no new sessions would be established. Our idle timer was 1800 minutes and after that the connection was disabled. Any smart ideas how to handle that or is the only way to increase the idle timer? #show user ip-user-mapping all type CP IP              Vsys   From    User                             IdleTimeout(s) MaxTimeout(s) --------------- ------ ------- -------------------------------- -------------- ------------- ip-address    vsys1  CP      username                  275            41399       #show session all filter source ip-address -------------------------------------------------------------------------------- ID      Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port]) Vsys                                      Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 824354  ciscovpn       ACTIVE  FLOW  NS  vsys1                                    ... View more

Hello, i'm testing wildfire at the moment. We had a security incident on a corporate notebook there were a lot of dropped "ZeroAccess.Gen Command and Control Traffic" in the thread-log. We scanned the laptop with different virus/spyware scanners and found a file which i'm uploaded to wildfire and virustotal. Wildfire says it's Benign. Virustotal with 24/44 detect ratio says its a backdoor. Antivirus scan for a928ac4e1a34c4eb035b4ed6a8f7a6cb at 2012-11-27 21:16:41 UTC - VirusTotal So who is wrong? Sebastian ... View more

Hi, today i tried to debug a packet flow via the "debug dataplane packet-diag" command. I did that by using this guide. Unfortunately this causes our PA5050 Active/Passive Cluster to complete stop working for a few minutes. :smileyangry: Is this a known bug in PAN-OS 4.1.7? I used a packet filter so cpu can't/should not be an issue. Here my debug settings > debug dataplane packet-diag show setting DP 0: -------------------------------------------------------------------------------- Packet diagnosis setting: -------------------------------------------------------------------------------- Packet filter   Enabled:                   no   Match pre-parsed packet:   yes              Index 1: 10.100.1.37[0]->10.242.3.22[80], proto 6            ingress-interface any, egress-interface any, exclude non-IP -------------------------------------------------------------------------------- Logging   Enabled:                   no   Log-throttle:              yes   Aggregate-to-single-file:  yes              Output file size:          10489183 of 10485760 Bytes (full)   Features:     flow    : basic   Counters: -------------------------------------------------------------------------------- Packet capture   Enabled:                   no   Snaplen:                   0            -------------------------------------------------------------------------------- DP 1: -------------------------------------------------------------------------------- Packet diagnosis setting: -------------------------------------------------------------------------------- Packet filter   Enabled:                   no   Match pre-parsed packet:   yes              Index 1: 10.100.1.37[0]->10.242.3.22[80], proto 6            ingress-interface any, egress-interface any, exclude non-IP -------------------------------------------------------------------------------- Logging   Enabled:                   no   Log-throttle:              yes   Aggregate-to-single-file:  yes              Output file size:          4869970 of 10485760 Bytes   Features:     flow    : basic   Counters: -------------------------------------------------------------------------------- Packet capture   Enabled:                   no   Snaplen:                   0            -------------------------------------------------------------------------------- ... View more

Hi, how can I debug the Captive Portal logon process? Because i getting a failed authentication error. The username and password are definitly correct. The user is in the group for the Captive Portal. Aug 29 09:51:32 pan_authd_process_authresult(pan_authd.c:1247): pan_authd_process_authresult: domain\name authresult not auth'ed Aug 29 09:51:32 User 'domain\name' failed authentication.  Reason: Invalid username/password From: ip-address. Via show user user-IDs match-user username i got an output of this user. The "debug user-id test cp-login" doesnt really help here because it doesnt check the existence of the entered username. So i do a debug authd on debug right? And then? The debug output would not written to the auth.log? Cant find any information regarding the debug process at all in the documentions. ... View more