About rgreens

Hello    Few Non-RFC Complaint signatures that was introduced in late last year and non-RFC Compliant SSL Traffic on Port 443(56112) is one of them. Please note that the main aim behind the signature TID 56112 is to detect suspicious and non-RFC compliant SSL traffic on port 443 or applications sending non-SSL traffic using port 443 or indicate possible malicious activity.  You can capture the facebook traffic from the android device on your Firewall and check the traffic SSL protocol.   Best Himani ... View more

The issue is with AD in the fact the Palo Alto's are only using "simple bind" with the LDAP lookup.  From what I found the AD should use lastlogonTimeStamp instead of lastlogon for "simple bind."  However it appears it is still not accurate.  Showed a user last logged on 7 days ago, but the are currently logged on. ... View more

Are there any screenshort for heartbleed attack into system ? Please share ? ... View more

rgreens, have you tried to exempt this threat if you consider it safe? ... View more

Thanks for the reply, as part of my ticket I had included the .pcap file from one of the "threats".  The issue is still happening, but the bizarre thing is only happening with a few users, most of the users have been able to do updates, myself included. As for the Wildfire that is what I thought from reading about it in the forums, but the fact there was no traffic reported for anything for 8 days had me a little concerned. ... View more

Hello, We apologize for the inconvenience caused. Please refer to the following document as it is a known issue: https://live.paloaltonetworks.com/docs/DOC-3860 Thanks. ... View more

I brought it to our SE who is making a case for this - he told me others have requested same.  One of the primary reasons they gave for having that way is for compulsory vpn connections to be able to still talk to captive portals in hotels, airports, etc.  I said, if that's the case, why not only allow the apps necessary to do captive portals and not wide open. Fingers crossed they'll make it at least a configurable option for their customers...  ... View more