About BobW

I have seen this when a users home page defaults to https.  Just a thought. Bob ... View more

Thanks for your reply.  I use the non-reoccurring schedule option a lot.  I tend to forget to go back and remove the rules and schedules figure it might be nice to automate their removal. Bob ... View more

"Bob, good band-aids" Agreed.  As I say it seems to work 100% with Firefox and Chrome.  I truly believe it is an apple issue given it works different depending on the revision. Please keep us updated if you find a solid fix! Bob ... View more

Thank you for the reply. In my case, we are looking at going from 100 Mbps to 200 Mbps.  We are a K-12 school with 100+ boarding students. We have 800+ devices with lots of media streaming after hours.  The PA-500 handles 100Mbps very well with it's QOS, but I am concerned about the possibility of it handling 200Mbps with all of the options enabled AND it is roughly three years old. There is also something to be said about having the VM run on box  which is more redundant than a PA-500 (raid and dual power supply for example) and being able to restore a VM in case of hardware failure.  Not to mention,  I have a dual Xeon 2.9, quad core with 24 GB sitting around collecting dust. Bob ... View more

I contacted a VAR we use and asked them the same.  Their response is as follows.  I am still a bit stumped as I can not fathom how the throughput would be an issue if it was put on a piece of hardware with two Intel CPUs with quad  cores (or whatever) but here's what they said: Palo Alto states that the VM firewalls are not recommended for edge use.  Can you explain why?  If it is the only VM on an ESXi box, I can’t imagine how that would be less secure than a physical box.: Architecturally its just not going to deliver what PAN advertises – DoS, throughput are the two largest areas of concern – because everything is just virtualized on a intel CPU – no FPGA or math processor to offload the thinking of the box. – Also security concerns but if it’s the only thing on the box as you said its less of an issue. Complexity in the configuration is also a concern with uptimes of firewalls normally 5 9’s Do you have any clients running a PA virtualized?  Are they happy with it? Yes but all in test/dev environments nothing in production like suggested here Bob ... View more

We battle this one quite often.  Here are a couple thoughts: The apple devices, when they attach a wireless, automatically call the "success" page (randomdomain/library/test/success.html) on the apple domain.  The idea is nice, because it should autoopen the captive portal page as it tries it's http "success" page call  To get there it chooses from multiple domains.  There is quite a large list, some are shown here:  ios - ios7 and captive portals-changes to apple request URL - Stack Overflow. Having said that, I have found that even minor changes in the OS act differently.  (example not necessarily correct) IOS 6.01 works, 6.02 doesn't, 6.03 works sometimes etc. As I recall, the primary issue is related to Safari.  I had a case with Palo Alto where we did packet captures, etc and Safari would try to get out but would never get any packets back.  As I recall, we never did figure out why. Firefox and Chrome work without a problem. So what I ended up doing is Creating a rule to allow unknown user access to the apple subnet and the success page.  Effectively disabling the captive portal auto prompt. Made it clear to my users that if they have an issue with IOS devices, try using a browser other than Safari and it will work every time and they will not get any email, or apps, functioning until the open a browser window. When they open safari or chrome, make sure to go to an http page.  Google, for example tends to default to https. I may not have the above 100% as it has been a while, but hopefully that will give you some starting points. Bob ... View more

Steven, Thanks for replying, but I am still confused how running it on ESXi makes it less secure.  Assuming it was setup correctly (no ability to manage it from the outside), the exposed side of the firewall will appear as any other firewall to an outsider.  Any ESXi exploits are not valid as you are not exposing ESXi, only the appliance.  I just don't get it.... Publish servers through it, as far as anyone knows they just went through a physical firewall.  If you are in a position where someone gets in and can pivot around you have a lot more trouble than a virtual firewall. Thanks for your patience, Bob ... View more

I am curious how a hypervisor can be compromised in a situation like this?  Basically your are exposing a virtual port on a virtual switch which is effectively the same as a physical switch.  The port is fully controlled by the VM itself which handles all of the traffic.  I can't fathom how this is more dangerous than a physical link to a physical Palo Alto.  Please feel free to correct me and/or explain. I am in a similar boat, where the PA-500 may not be able to handle the expansion of our pip to 200 Mbps with all of the options enabled and I am up for renewal.    We routinely hit and exceed 100 Mbps on our PA-500.  I have a spare server with multiple NICs and dual power supplies.  Throw in a couple SSDs in a raid and I am fully redundant. Thanks, Bob ... View more

Just moved over to PAN-DB yesterday, pretty boring migration as it was way to easy.  BTW that is a good "boring". Bob ... View more

At last year's Ignite I asked about their URL DB and was told it did not do as well as brightcloud with regard to international sites.  As we are a boarding school with numerous international boarding students that is pretty important. Any thoughts on international URL filtering with PANDB? Bob ... View more

I would like to be able to block all of the chat roulette type sites.  I haven't looked in a while, but I don't think there is a category for those. Thanks Bob ... View more

Thank you for that explanation.  I kept seeing the DNS records being marked as bad, but never crossed my mind to search the logs for the other traffic to the sinkhole address! "can then search the traffic logs for the sinkhole IP address and can easily locate the client IP address that is trying to start a session with the sinkhole IP address." Bob ... View more

So what I have done is: Started sending our legit SMTP traffic through our spam filtering service (MXLogic in our case). Force all legit SMTP outgoing from our server to a particular external IP address. Allow SMTP from client apps to go out a group of 10 IPs via their rules. At least that will keep my primary IP off of any black lists. Bob ... View more

Yes that is helpful.  It sounds more like I am used to in the past.  I am now working at a boarding school and a number of Ipad Apps, web(ish) email programs etc., have a dependency in the PA on outgoing port 25 as well as port 587.  I am fortunate that the vast majority of workstations are Apple based so realistically not as big a concern as a Windows OS. Any additional thoughts would be appreciated, Bob ... View more

Thanks for your suggestion, however, I am more interested in if others are letting SMTP for all of the users who's apps require it. Bob ... View more

I saw a significant improvement in commit times by purchasing the memory upgrade for the PA500. Highly recommend it. Hope that helps, Bob ... View more

I have a similar situation with a single domain and captive portal.  I have found it occurs most often with IOS devices when they first connect and go the Apple "success" page.  Repeatedly connecting to the wireless eventually completes the connection. Bob ... View more