About indup089

Hi mrsold, we can confirm the behaviour described from dyoung, we have PA-7050 as a core-router for several vlans with also dhcp-relay and secondary-IP in use. The key to solve this issue is that the DHCP server (Bluecat IPAM here) must be able to handle two scopes (the primary IP and seconary) when DHCP requests are received from one IP (in that case the primary IP from the interface-config in the PA used for DHCP relay) Best, Ulrich ... View more

Hi John, this requirement is not covered very well in PANOS (also not panorama) at this time. Starting with PANOS 5.0 you can use the search field in the security policy, but unfortunately this works almost for everything (object-names, IP-addresses, etc.) but at this time not for searching where a particular security-profile name is used in the policy. A workaround is to use policy-tags with the security-profile name . Any other ideas in the community? Best regards, Ulrich ... View more

Hi COS, I´ve also seen such frozen ike and ipsec sessions sometimes, but only with older PANOS version (most of the time 4.1.x versions). No obvious reason for this issue...you can open a TAC case, but this is imo only helpful if you are able to run several cli commands (show session id .... for the frozen session, show vpn ....,  tech-support-file) while the session is in this frozen state. However there is no obvious bug-ID in the current release notes 5.0.11 regarding this particular behavior I would suggest an update to one of the latest 5.0.x versions (5.0.10 is at this time very stable in my opinion). Best regards, Ulrich ... View more

Are we able to enable the application-blockpage for internal zones only to avoid the block-page for incoming untrusted/internet-sessions? ... View more

I also opened a TAC case for this, answer from there is that the information is not yet published in the security advisories because the fix for PANOS 4.1.x is not available until now.....discussible argumentation... ... View more

Hi Aarom, take a look at the DoS-protection differences for classified and aggregated traffic. This should be helpful: https://live.paloaltonetworks.com/docs/DOC-5078 ... View more

Hi, User-ID agent can be installed on 2012 without problems and is running fine but without support from PANW. TS-Agent on 2012 is also not yet supported at this time and harder to install, you have to use the windows compatibility mode for a successful installation. I have several running requests with our local PANW SEs regarding Win 2012 support for the Agents, until now without any concrete response. I guess support will (and must) be availble in the 6.0 agents which is beta at this time but unfortunately without available beta release notes... CU ... View more

There are some configuration-settings which can be configured from operational mode and therefore not resides in the configuration-file. For example you can configure "tcp-non-syn-check" in following two ways: 1. set session tcp-reject-non-syn <yes|no>  -> active but not in the config-file.... 2. config set deviceconfig setting session tcp-reject-non-syn < yes|no> commit  ->   active an in the config-file... As far as I know the only way to configure the bypass-exceed-oo-queue is the following: config set deviceconfig setting tcp bypass-exceed-oo-queue < yes|no> commit Though this setting should had definitely resided in the config-file....is the setting really not available under deviceconfig-stanza in the exported config-file..? If no indeed a very odd behaviour. Any statements from PAN-support yet? Regarding the gerneral PAN tcp handling the following document is maybe helpful for you: https://live.paloaltonetworks.com/docs/DOC-1731 CU ... View more

Hi Sandeep! Do you know if the marked DSCP via a securiy rule is preserved on the outbound traffic if the traffic enters a VPN tunnel on the PAN? Use case here is running IPsec-encryption over a provider MPLS and where the MPLS routers are using DSCP values for different QoS-Classes. Thanks a lot! U. ... View more

Hi Peter, if you are able to run a layer2-vlan "before" and "after" the PAN even through the distributed datacenter design, active-passiv is still possible. Best regards! ... View more

I also miss the removed telnet-client for troubleshooting purposes. Quite useful for testing any tcp-port reachability or smtp-tests from the box. I`m waiting for a statement from the SEs about that. Implementing the feature like a test-command as mikand suggested would be nice feature! ... View more