About Art

We have a situation where a site categorized as "computers and internet" (allowed for all users in our environment) references a pdf located on Google Docs (which is categorized as online personal storage).  An example is docs.google.com/viewer?url= http://www.netapp.com/us/media/ds-3546-0114.pdf&embedded=true .    This uses the app Google-Docs-Base (risk 5) to display the docs.     I am wondering if anyone has set up read only access to this type of site/destinaton without having to allow access to Online Personal Storage categorized sites? Thanks Art ... View more

Question:    Can the log records in the panorama internal storage mount point be migrated (through some process) to the external (NFS) storage? Thanks Art ... View more

Hi Everyone,    I have been reading the release notes... and Panorama 6.0.1 is looking really good.... but is it solid???    Also, our firewalls are on PAN-OS 5.0.8 ... will Panorama 6.0.1 have any issues managing firewalls on 5.0.8? Thanks Art ... View more

Hi     Has anyone set up iCloud's Find My Phone to work through the PANs?     We use URL Filtering and other aspects of the PANs... We prevent employees from going to Online Storage without prior clearance; and we have a request to allow iCloud.com/find (and only that functionality) through the firewalls.     I see only iCloud-base being used when I experiment with finding my iPad and watch the traffic.     Anybody else out there done this successfully? Thanks Art ... View more

Hello Everyone,    One of our Application Support Teams were trying to move from using servers being an ACE to servers behind a NetScaler last night... as part of the ensuing situation I was asked to check and if necessary clear the ARP Table on the PANs (PA-5060's running 5.0.8 in HA Failover)...    So, I hop on the active PAN and do a 'show arp all' and got these results ae2.109           w.x.y.z  00:0b:fc:fe:1b:02 ae2            c      756  (results somewhat redacted)    I asked and was told the ARP Table should be showing a MAC address of 'x:y:z:d:b:4f:77' (don't remember all the values :S)    I was asked to clear the ARP Table to see if that would clear things up and get to what they needed.    'Clear all arp' was issued... but the value didn't change...    I found Bug #54000 (see below) in 5.0.9's release notes... but this isn't quite the situation....                • 54000—The ARP entries associated with a Layer 2 interface that is a part of a Layer 3                     VLAN interface were not cleared from the ARP table when the Layer 2 interface went  down.     Anyone encountered this type of thing before? Thanks Art ... View more

I am hoping this is an "easy" question that I am just missing having been on calls since 4:24 am this morning :smileyconfused: I have used tcpdump to confirm that one of our PAN firewalls are sending syslog traffic to a specific destination (w.x.y.z) which it is not supposed to. (we don't want it going to that 'collector' for band width reasons - we have a 'closer' collector.    Anyone have a trick to figure out what rule/construct is sending the syslog traffic to server w.x.y.z?    BlueCoat has a "Trace" functionality on their SG-OS that shows the evaluation by each rule as the traffic is evaluated ... that would be helpful... is there a similar thing in PAN-OS? Thanks Art ... View more

Hello,    I am researching how to better controll the use of Remote Access Tools, such as LogMeIn, by the user base.    I know we have the sub-category of "remote-access" that I can use to create an application filter.  Which I can then use on a rule... This strikes me as a "put head against wall and push till wall falls" method... it will work ... but not very finesseful.    Anyone have more finesseful ways to do this? Thanks Art ... View more

Hello All,    I am configuring our Captive Portal and was wondering how other sites are using Captive Portal?    We have 2 primary use cases -       - Shared Workstations       - Unidentified Devices (Macs, Mobile Devices)    How successful has your Captive Portal implementation been? Thanks Art ... View more

Hello,    We are on PAN-OS 5.0.8 and use PA-5050, PA-5060, PA-200 (test boxes) and PA-3020's.    We use the User-ID Agent running on VM servers.    I have a couple questions,     1) When the PAN "loads" the group membership from our LDAP instance... we get the users that are part of the AD Groups we have "Group-Mapped"... Which is good and as expected.  But if there are Groups 'nested' in an AD Group - they don't show up.  Is there a way to get the 'nested' group members "loaded"?     2) Should Universal Groups work like Global Groups? Thanks for your time and help! Art ... View more