About TSPI

Hello TSPI, Are you talking about threat ID-12652 "Mariposa Command and Control" as mentioned below..? If so,then it should drop all packet for that session. The default action of this spyware is set to "drop-all-packet". I would request you confirm, whether traffic is passing through the correct policy, where you have configured the anti-spyware profile. Thanks ... View more

Have you talking about bidirectional NAT for this particular case, if so I think that is good solution.... Regards, Predrag ... View more

The PA unit doesnt do any analyse on its own. You setup firewall rules on which traffic (files) to be sent to wildfire for analyze (allow-and-forward). If you have a WF-500 appliance the files never leave your datacenter (compared to the cloudbased Wildfire where the files are sent into some Amazon EC2 cloud setup) unless when malware is detected then the malware file is being forwarded to PaloAlto so a signature will be created. Once the files has been sent the first check (unfortunately) is if the binrary is signed by a trusted CA or not - if its signed it wont be checked (I hope this will change in future looking at cases such as stuxnet and flame who used real CA certs from Realtek (among others) to sign their malware) samt goes if the file has already been investigated previously. Once its being checked and if identified as malware the signature for this file will be available within one hour for those with a wildfire-subscription - the rest will have to wait for the weekly updated of the threat db to get the same signature. ... View more

Management Plane CPU:1.3.6.1.2.1.25.3.3.1.2.1 Dataplane CPU 1.3.6.1.2.1.25.3.3.1.2.2 ... View more