About kfindlen

Using a custom signature to override the application identification performed by the firewall is limited to when the traffic is identified as only a base application which has a decoder.  Some examples of base applications with decoders: web-browsing  (http context) ssl ftp dns smtp .. and others.. You can find the decoder list current as of content 424 in the Custom Application Signatures document on page 7.  What this means in practice is that a session which is identified as one of the apps listed above can utilize custom signatures to further identify the traffic.  In your case, o nce the firewall identifies the application as skype there is no decoder being utilized on the session, so custom signatures would not be applied.  The custom signature can not override the built-in signatures for other applications which only have a dependency on one of these base apps (skype has a dependency on ssl). Like others have mentioned, I believe your only option is to utilize URL filtering to not apply the skype block when the URL matches "manager.skype.com", or explicitly allow any traffic to that URL. ... View more

The default action is defined by Palo Alto Networks on a per-threat basis as either alert or block. Every vulnerability has a "block" behavior.  Some block behaviors send a reset to the server or client, or in this case, both.  For this example the default action is block, and the block behavior is reset-both.  Even though the action being taken is block, the threat log will show the block behavior that was used to terminate the session under the action column. Quick edit: If you want to change the "block" behavior for a threat, you must configure an exception. ... View more

Are you expecting that the traffic will never reach the Edge firewall because of the deny policy on the Core, and therefore you should not even see a session on the Edge? Are the Core and Edge firewalls different vsys on the same physical device? ... View more

This is not correct.  The file will be uploaded to the WildFire service if the MD5/SHA256 hash has not been previously analyzed.  The process is the same for all supported file types. ... View more

Why would you need the original MAC address?  When the device is in HA it will never source traffic from the non-HA interface MAC address. The only way to determine the non-HA MAC is to disable HA.  The non-HA value is not stored in the configuration or system state in any way, it is simply derived from the device serial number. ... View more

Here is the correct call to modify the phash value of an administrator. http:// <firewall>/api/?type=config&action=set&key=<key>&xpath=/config/mgt-config/users/entry[@name='username']&element=<phash>password</phash> Replace the <firewall>, <key>, username, and password attributes to appropriate values.  Once the call is made you should be able to see the changed value via the get API call but the change will not take effect until a commit is completed. You can also use an API call to generate the password hash. http:// <firewall>/api/?type=op&cmd=<request><password-hash><username>user</username><password>password</password></password-hash></request> ... View more

Are you using an iPhone 5 or 5s?  I have tested X-Auth with IOS7 on the iPhone 5 and I have not seen any issues on both Wifi and LTE connections. ... View more

These errors indicate connectivity issues to the configured DNS servers.  Has there been any events which may have caused a loss of connectivity between the firewall and those IPs? ... View more

There is no capability through the web UI to bulk edit policies.  The only way I have seen is to either create SET commands via the CLI to update all of the policies, or export the XML, manually edit to add the profiles and then import it back to the device. ... View more