About CoreySteele

Some of my customers get lists of hashes of files that are bad but that don't show up in antivirus or malware detection systems.  E.g. from DHS, FS-ISAC, etc.  The point is, the protections available to me via a PA are essentially wildfire (i.e. hoping someone else gets hit before me), or threat protection (e.g. antivirus and IDS signatures).  But if neither of those catch the bad thing, I'm boned.  -C ... View more

Hi cjsteele To know the status of rule query should be: https:// <ip>/api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='<rule-name>']/disabled Let me know if this is what you are looking for. ... View more

I'd like to create a custom app-ID signature to allow me to block all use of IE on the network... I'm having trouble with the regex for the user-agent string... anyone care to help? :smileyblush: ... View more

IPv6 dynamic routing is added through OSPFv3 support in PAN OS 6.0: OSPFv3 Support—OSPFv3 provides support for the OSPF routing protocol within an IPv6 network. ... View more

Creating Custom Threat Signatures should be able to help you! ... View more

I agree, there should be a way to easily do this. The only way I can see that it is possible currently aside from using a SEIM or Kiwi based alert would be to email every Informational log entry. You could selectively send informational logs to a Kiwi server. In Kiwi or SolarWinds it could discard everything but the auth-fail informational messages and alert on those. It is something built right into several products, including FortiGate firewalls. It would be great if those logs were built into the reporting fuction on the PA. mlutgen, cjsteele ... View more

As long as you have solid, real-world experience with PAN-OS, including dynamic routing (e.g. BGP and/or OSPF), good networking fundamentals, and know the product line well, you should be able to get by with reading the design recommendation guides a couple of times, spending some time on the GUI, and reading-up on Panorama.  That's basically what I did.  Mind you, I have installed a couple of dozen PA boxes because I work for a VAR, so my experience is a bit unfair compared to someone who's married to a single install. ... View more