About mjacobsen

mjacobsen · ‎06-05-2014

I think I found a better approach: <meta name="viewport" content="initial-scale=1.0"> <style> #content { border:3px solid#aaa; background-color:#fff; margin:1.5em; padding:1.5em; font-family:Tahoma,Helvetica,Arial,sans-serif; font-size:1em; } h1 { font-size:1.3em; font-weight:bold; color:#196390; } b { font-weight:normal; color:#196390; } </style> This works better for various screen sizes and also seemed to help with the GlobalProtect login page.

mjacobsen · ‎06-04-2014

If you customize the block page and put this in the "styles" section, it should look better: @media only screen and (max-device-width: 400px) { body { width: 82%; } #content { float: none; width: 100%; font-size: 300%; } h1 { font-size: 180%; } } Mike

mjacobsen · ‎06-18-2012

Are you still having this issue? I suspect the list of software files showed the 4.0.12 release slightly before the image had been fully uploaded. When I try now, it is working. Mike

mjacobsen · ‎03-13-2012

We absolutely use our own firewalls in all areas of our network. We have a mix of hardware models and software versions running in our production environments. Mike

mjacobsen · ‎03-13-2012

mikand: Done. nwallette: H323 support for NAT was a new feature that was added in PAN-OS 4.1. It wasn't a fix that was added to PAN-OS 4.1 is was a new ALG added to deal with H323 decoding and translation. BTW, SIP support for NAT was added in PAN-OS 3.1. As far as quality and stability, your comments are spot on. We do believe we have an ability to innovate in ways that other security vendors cannot but we need to be careful about balancing that with quality and stability. We take this challenge seriously and believe we have implemented processes that will ensure we deserve the trust we have earned. Hopefully the result is a company that can continue to deliver more innovation with better quality and stabililty than anything else on the market. Mike

mjacobsen · ‎03-13-2012

On the DHCP options configuration, this is something we have heard from other customers and something we should add to the product. As you have obviously recognized, it isn't there today. We do have a feature request in our system for this and I added you to the list of requesting customers. Can't communicate specific timelines at this point. On the other issues, it looks like we will need to take a look at the logs and see if we can figure out what is going on. To continue my role as Captain Obvious, you shouldn't be running in to these issues. It looks like there may be something particular to your config that is triggering a bug. Can you shoot in a support case with a tech support file that we can analyze? Mike

mjacobsen · ‎11-03-2011

A tech note detailing the steps for iOS connectivity is now posted in the tech docs section. Take a look and feel free to post if you run into issues. Tech Docs Mike

mjacobsen · ‎09-29-2011

I believe the dataplane must be restarted after removing any profiles with Block IP actions in order to avoid the problem. If you have done that and it is still happening, be sure to mention that to support as it would indicate that the issue might be different than the one being addressed in 4.0.6. Mike

mjacobsen · ‎07-23-2011

64-bit OS X is supported. Check your NetConnect version and make sure you are running 1.3.

mjacobsen · ‎07-22-2011

You can use an embedding trick to take care of it. Details on how to do this are here: Mike

mjacobsen · ‎07-22-2011

As Lee mentioned earlier in this thread, KnowledgePoint is not the place for product roadmap information. We are happy to discuss future plans under NDA as needed. Contact your Palo Alto Networks sales team to set this up if it is important to you. Mike

mjacobsen · ‎07-22-2011

In most cases, I would not recommend leaving the service/port definition as "any", particularly on inbound rules. For inbound rules, there is not really a good reason to wait to drop a session based on App-ID when you know you don't want the traffic coming in on that port in the first place. As a general rule, inbound policy should always include "application-default" or the specific port you know you have the service running on. For outbound rules, it is best to have the firewall policy reflect what your intention is. For example, if you want to allow users to run web-browsing or ssh on random ports, use "any" in the service column and they will be allowed to do that. I wouldn't necessarily recommend that, but the key is the write the policy that is appropriate for your environment. When you are protecting servers, allowing traffic on random ports is almost always a bad idea. When you are protecting users, it may still be a bad idea, but that will largely depend on your environment and the risk you are willing to allow and the threat protection you are employing on the outbound (and inbound response) traffic. Generally speaking, the smaller you can get the surface area of exposure, the better you can manage the risk. App-ID allows you to do that in important ways, but it doesn't mean you should increase the port-based surface area just because you can. Mike

mjacobsen · ‎05-26-2011

Obviously, we had no intention of making things less usable with the new styles. The disabled style has been modified for an upcoming maintenance release to have more contrast. We will take a look at the Panorama rules as well. If there are others areas that seem like a step back, please feel free to post some details and we will take a look. Our goal is to continually improve and your feedback helps us do that. Mike

mjacobsen · ‎05-02-2011

I think there may be some confusion over file management vs. log management. We don't expose the underlying raw files used to store all of the logs/events, but we do have the ability to control how much of the available space is used for each log type and you can allocate additional needed space to be used for logging if you need longer storage durations for a given event type. Panorama certainly doesn't replace a third-party log management infrastructure, but in some cases it may cover what is needed for basic retention requirements. Mike

mjacobsen · ‎05-02-2011

It is possible you are running into an issue we recently uncovered with NAT when a client and server both support FTP extensions and use EPSV/EPRT instead of the normal PASV/PORT commands for active connections. This is being addressed and should be fixed in an upcoming content release. If either the client or the server do not advertise support for those extensions, everything will work fine through NAT. Mike

mjacobsen · ‎03-24-2011

Actually, they have built an adapter and it was made available in their 8.1 release. Mike

mjacobsen · ‎03-02-2011

Actually, there is no need to submit feature requests for new apps. Anyone can submit them directly to our app research team through the Application and Threat Research Center's site: http://www.paloaltonetworks.com/researchcenter/submit-an-application/ Mike

mjacobsen · ‎11-10-2010

That's correct. Mike

mjacobsen · ‎11-10-2010

The login will not fail. The system will use the domain string stored with the auth profile to infer the users domain (assuming they have not entered a fully qualified username). This will then map to the groups retrieved from the User Identification Agent and be matched in either the allow list in an auth profile or in security rules based on group. Mike Message was edited by: mike EDIT: fixed a missing "not" in the comment about fully qualified username.

mjacobsen · ‎11-10-2010

The current tested limit is 50. We don't currently have capacity to test beyond this limit. We would be open to working through this jointly with the customer if they are open to it. If you are interested, contact your Palo Alto SE and lets discuss. Mike

mjacobsen · ‎11-08-2010

Today you would need to do this in a URL filtering profile. If you want them allowed, you can use the Allow List, if you want them blocked, you can use the Block List. These would only take effect on rules where this profile was applied and it would only effect HTTP (and potentially SSL) traffic. Mike

mjacobsen · ‎11-04-2010

Yes. You can do this. You would create an Address Group and add the desired addresses to the group. Mike

mjacobsen · ‎11-03-2010

Currently group definitions for users that come from a directory must also come from a directory. Local groups can only be used for local users. To accomplish what your are looking for, you would need to create a new group in AD that contains the users of interest. Mike

mjacobsen · ‎10-28-2010

I think these comments are missing your original question. There is a RADIUS VSA that you can use to have the RADIUS server pass the group info. It is called PaloAlto-User-Group. If you use this VSA on the RADIUS server, and then check the Retrieve User Group option you mention, the group name specified in the VSA will be checked in the allow list of the auth profile. You can enter the group names manually in the auth profile. Mike

mjacobsen · ‎09-27-2010

Actually, when you create an ad-hoc report, it will generate at that time based on the data matching the filter. In addition, you do not need to wait until the scheduled time to export. You can click the PDF link to download a PDF version of the results. Mike

mjacobsen · ‎08-11-2010

In addition to what is in that doc, you should also be able to use <threatname/> to get the name of the virus or exploit that was detected. Mike

mjacobsen · ‎08-03-2010

What is the application you are trying to allow through the firewall? In some cases, the response traffic will automatically be correlated to the request and allowed as needed. Mike

mjacobsen · ‎07-28-2010

You don't necessarily need to purchase a cert, but you do need it to be a cert signed by a CA that your browsers trust. If you have a CA in place for creating certs for internal services, the same could be used for this. Alternatively, you could create a CA and tell your browsers to trust certs signed by it. Mike

mjacobsen · ‎07-27-2010

For a specific example of a custom app for control specific browsers, see this example for MSIE 7.0 over in the DevCenter. How to filter browsertype based requests Mike

mjacobsen · ‎07-27-2010

In order to eliminate the errors you will need to install a cert that matches the IP address of the interface. Otherwise, the browser will still give certificate warnings. Mike

Date Registered	‎03-27-2009 07:42 AM
Date Last Visited	‎10-13-2018 07:52 PM
Total Messages Posted	174
Total Likes Received	22

Online Status	Offline
Date Last Visited	‎10-13-2018 07:52 PM

Strata

Prisma

Cortex

About mjacobsen