About Claw4609

We actually just ended up replacing all our 220s with 440s that Palo provided us because it was months before they identified the issue and theyre still not sure why it started happening. There was a debug build that supported provided that fixed the issue.    This is what support said:   The debug build was built based on a potential theory that the issue was caused by a situation where by two cores handle the same work or the same session at the same time. So they used the debug build to verify if the kernel driver (octeon-pow-ethernet) caused the issue. ... View more

You can override the default action of signatures in the anti-spyware profile from, in this case, "alert" to whatever youd like. Does this address what you need?    Edit adding more specifics: You can go to the signature exceptions tab of an anti-spyware profile, then select the show all signatures check box in the bottom left, find the signature you are looking for and change the action to what you would like, and make sure to select the enable check box on the signature itself for any signatures you edit. Then apply this anti-spyware profile to the rules you'd like, either directly or through a security profile. This is also all under the assumption you have a threat protection license.     ... View more

You'll need two different ssl/tls service profiles, one for the gateway and one for the portal. Heres examples of how the config would look.   Self-Signed cert chain:   SSL/TLS Service Profile (you'll need another one in addition to the image I have attached, one for your godaddy public cert):   GlobalProtect Portal Service Profile:   GlobalProtect Agent Certs: GlobalProtect Portal Agent Config:   GlobalProtect Gateway Cert:   Self-Signed Cert:     Does this help? I was able to test a similar setup and it works as intended       ... View more

On to the troubleshoot step that identifies 99% of the issues, checking global counters! Try this and see if it throws something to specifically identify whats stopping it.   How to check global counters for a specific source and destinat... - Knowledge Base - Palo Alto Networks ... View more

What is the session timeout of the device set to? It looks like the default value is 30 days if nothing is specified.    Device > Setup > Management > Authentication Setting > Max Session Time   Device > Setup > Management (paloaltonetworks.com)   "Enter the number of minutes (range is 60 to 1,499) that an active, non-idle administrator can remain logged in. Once this max session time is reached, the session is terminated and requires re-authentication to begin another session. The default value is set to 0 (30 days), which cannot be manually entered. If no value is entered, the  Max Session Time  defaults to 0." ... View more

Could you provide the output for the ms.log and devsrv.log at the time of the failure?   How to identify the commit failure reason when no error message... - Knowledge Base - Palo Alto Networks ... View more

Just out of curiosity do you have links stating that other vendors are applying updates to fix this? Microsoft said they weren't releasing anything for the build in Windows client and it doesn't look like Cisco plans a release either. It looks like Ciscos response is pretty much the same as Palos.    Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables Affecting Cisco AnyConnect Secure Mobility Client and Cisco Secure Client - Cisco   TunnelCrack: Widespread design flaws in VPN clients (mathyvanhoef.com)     ... View more

On the firewall itself are you seeing the commit job taking place and completely successfully? If so is it possible whatever your are pushing from Panorama has the config overridden on the local firewall?   If you look at the template stack, not the template, in Panorama are the changes reflected there fine? ... View more

A majority of mine have been re-categorized in under an hour. Then a few minutes after that the firewalls will pull the updated urls then may be another hour after that for any cache to clear.   I believe certain categories, such as phishing, take additional time to review. Any phishing re-categorization I have submitted in the past has been re-categorized in under 24 hours.  ... View more

The change request usually comes back with a result quite quickly but in the meantime if this is impacting things you should create a custom url category and set the action to alert/allow. Custom url categories will take precedent over the palo defined url categories.   Edit: I misread this question that it was affecting others. The recategorization usually takes affect quite quickly. ... View more

Are you using the built in user-id agent for this? If you go to  device->User identification->User Mapping then click the gear for Palo Alto Networks user-id agent setup, under the "server monitor account" there you'll fill out your account used for authentication as well as the "Domains DNS Name".   If you are not using the built in user-id agent, you can just go to the "server monitor" and "client probing" tabs and make sure everything is unchecked there. ... View more

You would effectively just need a certificate that your clients trust and can sign certificates on the fly.  ... View more