About notleyhigh

In theory yes. However DLP is basically a stringmatching engine which gives that if the search is htmlencoded or unicode or such you might miss it if you just search for "keyword" (your searchstring must then contain all variants). ... View more

High School students are sure  getting lazy. :smileysilly: You could build a RegEx expression and use data filtering if you have seven characters to match on. Use the URL filtering to block adult websites also. There's also a custom app you can import to force safe search on Google and Bing. I'd really recommend it in your case. How To Control Image SafeSearch for Google and Bing I would also recommend blocking proxies in the URL filtering and using the application filter to block proxy web apps as well. (Because that's how I got around the filtering in high school to play Pocket Tanks. ) ... View more

The PA-500 has an ARP limit of 500. The PA-2020 has an ARP limit of 1000. The PA-2050 has an ARP limit of 2500. I was able to work around the issue by front ending the firewall with a router or a L3 switch.  It worked pretty well for our environment. One other thing to note is the firewall bandwidth limit of the PA-500 is 250Mbps. Hope this helps. ... View more

The session does look correct. Also we can see there are no s2c packets: layer7 packet count(s2c)      : 0 I would refer to my previous post as it appears the PAN is not receiving SYN-ACK from the server - web server not receiving SYN (problem with PAN sending SYN out or device in between) - web server receiving SYN and not responding(problem with web server service/route/firewall) - web server receiving SYN and responding with SYN-ACK(need to check with pcaps if PAN is receiving SYN-ACK) - Stefan ... View more

If possible (as a test) you can use appid:any and service:any and enable log on session start AND session end. Then take a peak in the traffic log to see how the traffic is being identified, lets say "sharepoint" (or whatever). Finally change this rule from any into appid:sharepoint (or whatever you found), service:application-default (or manually specify which TCP/UDP ports you wish to allow) and disable "log on session start" (just keep log on session end). Dont forget to enable the IPS while your are at it (in the options). Edit: And if you have SSL traffic you should take a look at enabling SSL-termination so the PA device can inspect the encrypted data aswell... ... View more

No need to move the management to dataplane. Instead go to Device -> Setup -> Services and click on Service Route Configuration and change so just the updates goes through that dataplane interface. ... View more

I would recommend you to use the physical mgmt-interface (on the box) as your primary way of management. In Device -> Setup -> Services you can click on Service Route Configuration in case you need to "reroute" which interface is used for updates as example (updates goes through mgmt-interface by default but you can "reroute" this to use a dataplane interface instead without having to expose your management for the whole world). Then if you need a secondary mgmt-interface you can create such in Network -> Network Profiles -> Interface Mgmt by setting up a Interface Management Profile, dont forget to define Permitted IP Addresses while you setup this dataplane mgmt interface. ... View more

SSL Decryption Certificates (Rev C) https://live.paloaltonetworks.com/docs/DOC-2006 Controlling SSL Decryption (Rev C) https://live.paloaltonetworks.com/docs/DOC-2008 Also described in the PA-4.1_Administrators_Guide.pdf ... View more

I hope this might be helpful for you: ... View more