About mjacobsen

mjacobsen · ‎06-05-2014

I think I found a better approach: <meta name="viewport" content="initial-scale=1.0"> <style> #content { border:3px solid#aaa; background-color:#fff; margin:1.5em; padding:1.5em; font-family:Tahoma,Helvetica,Arial,sans-serif; font-size:1em; } h1 { font-size:1.3em; font-weight:bold; color:#196390; } b { font-weight:normal; color:#196390; } </style> This works better for various screen sizes and also seemed to help with the GlobalProtect login page.

mjacobsen · ‎06-04-2014

If you customize the block page and put this in the "styles" section, it should look better: @media only screen and (max-device-width: 400px) { body { width: 82%; } #content { float: none; width: 100%; font-size: 300%; } h1 { font-size: 180%; } } Mike

mjacobsen · ‎06-18-2012

Are you still having this issue? I suspect the list of software files showed the 4.0.12 release slightly before the image had been fully uploaded. When I try now, it is working. Mike

mjacobsen · ‎03-13-2012

We absolutely use our own firewalls in all areas of our network. We have a mix of hardware models and software versions running in our production environments. Mike

mjacobsen · ‎03-13-2012

mikand: Done. nwallette: H323 support for NAT was a new feature that was added in PAN-OS 4.1. It wasn't a fix that was added to PAN-OS 4.1 is was a new ALG added to deal with H323 decoding and translation. BTW, SIP support for NAT was added in PAN-OS 3.1. As far as quality and stability, your comments are spot on. We do believe we have an ability to innovate in ways that other security vendors cannot but we need to be careful about balancing that with quality and stability. We take this challenge seriously and believe we have implemented processes that will ensure we deserve the trust we have earned. Hopefully the result is a company that can continue to deliver more innovation with better quality and stabililty than anything else on the market. Mike

mjacobsen · ‎03-13-2012

On the DHCP options configuration, this is something we have heard from other customers and something we should add to the product. As you have obviously recognized, it isn't there today. We do have a feature request in our system for this and I added you to the list of requesting customers. Can't communicate specific timelines at this point. On the other issues, it looks like we will need to take a look at the logs and see if we can figure out what is going on. To continue my role as Captain Obvious, you shouldn't be running in to these issues. It looks like there may be something particular to your config that is triggering a bug. Can you shoot in a support case with a tech support file that we can analyze? Mike

mjacobsen · ‎11-03-2011

A tech note detailing the steps for iOS connectivity is now posted in the tech docs section. Take a look and feel free to post if you run into issues. Tech Docs Mike

mjacobsen · ‎09-29-2011

I believe the dataplane must be restarted after removing any profiles with Block IP actions in order to avoid the problem. If you have done that and it is still happening, be sure to mention that to support as it would indicate that the issue might be different than the one being addressed in 4.0.6. Mike

mjacobsen · ‎07-23-2011

64-bit OS X is supported. Check your NetConnect version and make sure you are running 1.3.

mjacobsen · ‎07-22-2011

You can use an embedding trick to take care of it. Details on how to do this are here: Mike

mjacobsen · ‎07-22-2011

As Lee mentioned earlier in this thread, KnowledgePoint is not the place for product roadmap information. We are happy to discuss future plans under NDA as needed. Contact your Palo Alto Networks sales team to set this up if it is important to you. Mike

mjacobsen · ‎07-22-2011

In most cases, I would not recommend leaving the service/port definition as "any", particularly on inbound rules. For inbound rules, there is not really a good reason to wait to drop a session based on App-ID when you know you don't want the traffic coming in on that port in the first place. As a general rule, inbound policy should always include "application-default" or the specific port you know you have the service running on. For outbound rules, it is best to have the firewall policy reflect what your intention is. For example, if you want to allow users to run web-browsing or ssh on random ports, use "any" in the service column and they will be allowed to do that. I wouldn't necessarily recommend that, but the key is the write the policy that is appropriate for your environment. When you are protecting servers, allowing traffic on random ports is almost always a bad idea. When you are protecting users, it may still be a bad idea, but that will largely depend on your environment and the risk you are willing to allow and the threat protection you are employing on the outbound (and inbound response) traffic. Generally speaking, the smaller you can get the surface area of exposure, the better you can manage the risk. App-ID allows you to do that in important ways, but it doesn't mean you should increase the port-based surface area just because you can. Mike

mjacobsen · ‎05-26-2011

Obviously, we had no intention of making things less usable with the new styles. The disabled style has been modified for an upcoming maintenance release to have more contrast. We will take a look at the Panorama rules as well. If there are others areas that seem like a step back, please feel free to post some details and we will take a look. Our goal is to continually improve and your feedback helps us do that. Mike

mjacobsen · ‎05-02-2011

I think there may be some confusion over file management vs. log management. We don't expose the underlying raw files used to store all of the logs/events, but we do have the ability to control how much of the available space is used for each log type and you can allocate additional needed space to be used for logging if you need longer storage durations for a given event type. Panorama certainly doesn't replace a third-party log management infrastructure, but in some cases it may cover what is needed for basic retention requirements. Mike

mjacobsen · ‎05-02-2011

It is possible you are running into an issue we recently uncovered with NAT when a client and server both support FTP extensions and use EPSV/EPRT instead of the normal PASV/PORT commands for active connections. This is being addressed and should be fixed in an upcoming content release. If either the client or the server do not advertise support for those extensions, everything will work fine through NAT. Mike

Member Since	‎03-27-2009 07:42 AM
Date Last Visited	‎03-13-2021 01:31 AM
Posts	174
Total Likes Received	23

Online Status	Offline
Date Last Visited	‎03-13-2021 01:31 AM

About mjacobsen

Re: Response Pages for Mobile Devices

Re: Response Pages for Mobile Devices

Re: PANOS can not be downloaded

Re: One day in production with 4.1.3

Re: One day in production with 4.1.3

Re: How to use "Retrieve User Group" feature in RADIUS profile?

Re: Customizing Captive Portal Response Page

Re: Response Pages for Mobile Devices

Re: Palo Alto Dev Adapter for BBNA

Re: Does Captive Portal work on Virtual Wires?

Re: Response Pages for Mobile Devices

Re: Response Pages for Mobile Devices

Re: PANOS can not be downloaded

Re: One day in production with 4.1.3

Re: One day in production with 4.1.3

Re: One day in production with 4.1.3

Re: SSL VPN and iPhone OS 4.0

Re: Any issues with PANOS 4.0.5?

Re: Does NetConnect Support Mac OS 10.7 "Lion"?

Re: Customizing Captive Portal Response Page

Re: SSL VPN and iPhone OS 4.0

Re: Is it better to have policy rules base on application instead of service ports?

Re: Can you use the PANOS 3.1 style (CSS) in PANOS 4.0 GUI?

Re: Log Management on Panorama

Re: Passive FTP

Seattle Hardware Beta

Network Security

Cloud Security

Security Operations

About mjacobsen