About oshcomp

Is there a way to track the status of open and resolved issues?  The Release Notes describe issues that are resolved by the release and those that are still outstanding.  I would like additional information such as the releases that are affected; the release where the issue was first discovered; and workarounds.  This type of information is necessary in determining which release is appropriate for my site.   Having a database of open issues would help in troubleshooting, as well. Thanks ... View more

Our threat monitor shows a lot of ZeroAccess.Gen Command and Control traffic, type spyware.  The default threat action is to alert.  I want to either block or drop.  What is the best way to block traffic for a specific threat signature but to use defaults on all others with the same severity?  The threat signature categorizes zeroaccess.gen, id 13235, as botnet.  Are threat signatures used as part of the behavioral analysis in determining probable botnets?  I don't see any correlation between destination IP addresses in the threat log and in the botnet report. Thanks ... View more

I am trying to set up notification for blocked urls.  I can see block-url syslog messages when I set log forwarding to log severity level informational.  Is there a way to modify the threat level for blocked urls?  I would like to use a higher threat level as an indication of when to send an email alert. Thanks. ... View more

I am trying to understand the sample OSPF Active/Passive HA configuration outlined in Tech Note: How to Configure OSPF  https://live.paloaltonetworks.com/docs/DOC-1939 .   The problem I have is with the floating static routes defined on upstream and downstream routers intended to reduce failover times.   Floating static routes are described in steps 12 through 14 in the Tech Guide.   In my small test network I have a session delay of 4 seconds (measured by continuous pings across the network) during a failover.  I believe my delay is actually OSPF convergence time.  Failover delay is shorter.  I don't think the floating static routes are helping to reduce delay. While OSPF is still converging I can see the static routes on the upstream router and on the downstream router.  However, they do not appear on the Palo Alto firewalls.  Until OSPF converges, only connected routes appear in the firewall routing table.  Since OSPF is momentarily unavailable and redistributed routes are gone, it seems that I would have to define static routes with a high administrative cost pointing in the appropriate directions on the Palo Alto firewall cluster as well as on the upstream and downstream routers. I appreciate comments. ingThanks. ... View more

I have been testing the security profile for vulnerability protection.  I set the action for all critical threats to block. What should I expect to see on the user computer screen if a site does contain a critical threat recognized by Palo Alto?  Should the user see a block page? ... View more