About gtomte

8.0.0 ... View more

Thanks ... View more

This is doable today, by using 802.1q for the two vlans you mention, with subinterfaces. and use the same vlan number for both. In that way, these two vlans are connected. No redirect. No rewrite. But connected together. ... View more

The setup you see here, is used for port to App-ID migration. Customer migrating from other firewalls, port based, to Palo Alto Networks, will typically be done with no policy changes as the first step. Then App-ID adoption is the next step.   Other customers start from scratch, building an App-ID based ruleset from day 1. Then the 3 policy lines you see will be used. The last rule you could call a "clean up rule". Everything that are to match that rule, are for you to move into one of the two above. Me personally would have moved the known bad to the top. When you've cleaned up things, after verifying for days or weeks, depends on you gut feeling, and when you see close to nothing in the last rule, you could just disable/delete the any rule. Then you've created a Application based White List ruleset. And that's what Palo Alto Networks is all about, bringing back the default action of the firewall, by doing what the intention of the firewall has always been, to control what you allow.  ... View more

@syadav. I know that might help, but it shouldn't be necessary. But it's a last option, and will be tested if nothing else works. It sounds like there is a bug in the images, since 7.0.0 isn't a valid base image anymore. ... View more

I have a customer running 6.1.8, have downloaded 7.0.1, and tries to download 7.0.4. Fails the same way. I've asked him to test with 7.0.2 or 7.0.3 to see if there is something wrong with the 7.0.4 image. ... View more

6.1.8 is a recommended release, and should be fine.    7.0.4 has not been in the market long enough to become recommended, but many are running 7.0 today. ... View more

http://researchcenter.paloaltonetworks.com/2015/12/some-clarifications-and-commentary-on-network-security-and-covert-channels/ ... View more

Have fun with this test: http://pdftest.ngfw-test.com/   GT ... View more

There was a bug in the AV signature update for Eicar a while ago, but it's working fine again now. I'm right now using AV version 1707-2185. Are your AV signatures updated?   Go to Monitor -> URL Filtering, and filter out "( referer eq 'http://www.eicar.org/85-0-Download.html' )". You could perhaps also add "and ( url eq 'www.eicar.org/download/eicar.com' )" if you clicked the first test object on Eicar.   Check the column "Rule", to see which rule it hits.   Then check the policy, and the correct Rule, to see if you have a working AV profile there. Action "allow" in the profile will most likely not log anything.   When everything is working, you should be able to click the magnifier for the selected logs in URL filtering, and in there see related logs, and there the Eicar virus. ... View more

I see you use profiles. Anything in the threat logs? Have you tried a policy without profiles? ... View more

I'm sending you different info to play with.   http://serverfault.com/questions/709860/fix-tls-error-tls-handshake-failed-on-openvpn-client   Check the detailed info for the session that says "insufficiant", to see if you have traffic in both directions.   Do a pcap on the fw, to see what happens. Is there a NAT problem?    You did an app override, for port 443, while all logs you are showing are port 1194. Perhaps you should one for port 1194 as well, plus adding the custom apps to the policy as well.   When doing a google search on "TLS handshake failed", there are many posts. Here's one of them: - https://openvpn.net/index.php/open-source/faq/79-client/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity.html   To better understand the messages the Monitor are giving you, read here: - https://live.paloaltonetworks.com/t5/Management-Articles/Not-Applicable-Incomplete-Insufficient-Data-in-the-Application/ta-p/65711   Insufficient data in the application field Insufficient data means not enough data to identify the application. So for example, if the three-way TCP handshake completed and there was one data packet after the handshake but that one data packet was not enough to match any of our signatures, then user will see insufficient data in the application field of the traffic log.   Meaning... The FW doesn't see enogh packets.   From this site: https://openvpn.net/index.php/open-source/documentation/howto.html   Troubleshooting If the ping failed or the OpenVPN client initialization failed to complete, here is a checklist of common symptoms and their solutions: You get the error message: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity). This error indicates that the client was unable to establish a network connection with the server.   Solutions: Make sure the client is using the correct hostname/IP address and port number which will allow it to reach the OpenVPN server. If the OpenVPN server machine is a single-NIC box inside a protected LAN, make sure you are using a correct port forward rule on the server's gateway firewall. For example, suppose your OpenVPN box is at 192.168.4.4 inside the firewall, listening for client connections on UDP port 1194. The NAT gateway servicing the 192.168.4.x subnet should have a port forward rule that says forward UDP port 1194 from my public IP address to 192.168.4.4. Open up the server's firewall to allow incoming connections to UDP port 1194 (or whatever TCP/UDP port you have configured in the server config file). Good luck. ... View more

Are you saying traffic is matching disabled rules? ... View more