About BenjAudy.MTL

BenjAudy.MTL · ‎04-06-2017

Hi, The GlobalProtect UWP client is in the Microsoft Store. Last time I checked, it needed the mobile GlobalProtect license even if it was installed on a Windows desktop. Benjamin

BenjAudy.MTL · ‎04-03-2017

That's correct. It's exactly what I did when I received my Panorama appliances. Benjamin

BenjAudy.MTL · ‎03-29-2017

Hi, Do you have an enterprise wifi? At my work, we started feeding ip address/username associations from Clearpass (Aruba Networks wifi) to our firewalls and it is so much better than having to dig through authentication logs to find out who did what. Benjamin

BenjAudy.MTL · ‎03-29-2017

Hi, Did you verify how much class 2 traffic goes through your firewall when you test Skype? Does it constantly cap at 25 Mbps? You can see the real-time statistics under the Network tab, then QoS and click on Statistics for the desired interface. Benjamin

BenjAudy.MTL · ‎03-10-2017

A quick and dirty way to know if an object is in use is to delete it. You can click on the first entry and shift click on the last one to select all the objects. If an object is in use, it will not be deleted (an error message will appear). You can then preview the changes to see what is actually not used. Make sure you revert to the running config after doing that! Also, you coworkers might freak out when they see you do that. Benjamin

BenjAudy.MTL · ‎03-10-2017

It should be amazon-instant-video, but depending on which country you live in, the video stream might show up as http-video. I have a case open because the traffic is not properly identified in Canada. Benjamin

BenjAudy.MTL · ‎03-06-2017

Hi, The VLAN tag is part of the Ethernet frame and is used for networking, so I doubt Palo Alto Networks will ever offer the ability to create a custom application signature based on it. What is the original problem that made you want to have a custom app based on a VLAN tag? Benjamin

BenjAudy.MTL · ‎03-06-2017

I'm not sure I understand your problem. You mean you have a blocking rule with the FQDN as the destination address? If you want to reroute the traffic to some identified malicious websites, why do you have a blocking rule in the first place? Benjamin

BenjAudy.MTL · ‎03-06-2017

It will work, but you will get a warning for each rule using the the URL profile every time you commit. It gets annoying pretty fast. Benjamin

BenjAudy.MTL · ‎03-02-2017

It looks like content update 667 added a new file type to detect ELF files (ID #52175). Benjamin

BenjAudy.MTL · ‎02-25-2017

Hi, It's a limitation of the ACC. This data is based on the traffic logs, and the logs are generated at the end of the session. You will have to look at the netflows if you want something closer to the actual traffic passing through the firewall. Benjamin

BenjAudy.MTL · ‎02-25-2017

@bradk14 I concur! Benjamin

BenjAudy.MTL · ‎02-23-2017

Hi, The mongod process is the Mongo database used for the correlation engine, if I remember correctly. How long has it been using high CPU time? Did it happen after a reboot? Benjamin

BenjAudy.MTL · ‎02-20-2017

For question #2, any superuser should be able to remove a lock added by any user. I cannot answer your first question as we don't use automatic locks. Regards, Benjamin

BenjAudy.MTL · ‎02-15-2017

URL filtering logs are included in the threat database, so you might want to increase the threat quota considerably. Maybe you thought those went in the URL summary database? I had a weird bug once when I allocated exactly 100% of the quota. I ended up with a negative unallocated value and I think I lost some logs because of that. You seem to have 5% unallocated space, so this is probably not related to your problem. Benjamin

BenjAudy.MTL · ‎02-12-2017

You should do a packet capture on the server to see if it actually receives the packets and if anything is sent back. After that, do a packet capture on the firewall to see if it's receiving the response and if it's dropping it. Benjamin

BenjAudy.MTL · ‎02-10-2017

We use a pair of PA-5060 (active / passive) firewalls in layer 3 mode in our datacenter and it's working well for us. As @nextgenhappiness said, make sure to size up your box properly. Benjamin

BenjAudy.MTL · ‎02-07-2017

You're mentioning templates, but maybe you meant device groups? Address objects are in device groups: set device-group [device group name] address [Name of object] description [blablabla] ip-netmask 10.11.12.13 Benjamin

BenjAudy.MTL · ‎02-06-2017

Do you have multiple vsys in Panorama and the target firewalls? Do you see something unusual there?

BenjAudy.MTL · ‎02-06-2017

Hi, On my Panorama appliance (v7.0.12), all of my IP addresses all light blue and there is no underline unless I put the mouse cursor over them. Which version are you using? Benjamin

BenjAudy.MTL · ‎02-03-2017

Hi, Usually when it happens to us, it's because a virus was detected in the file. Check your threat logs for any virus detected at that time. You can then put an exception in your security profile if you think it's a false positive, and report it to Palo Alto Networks. Regards, Benjamin

BenjAudy.MTL · ‎02-03-2017

Hi, I think it's for the on-demand video offering from Amazon. Palo Alto Networks should update it to include Prime Video. Here in Canada, the traffic for Prime Video shows up as SSL. Benjamin

BenjAudy.MTL · ‎12-27-2016

Hi, Personally, I would never use 192.168.1.0/24 or 192.168.2.0/24 as a business network because so many home routers use those networks and you will run into overlaps. In your case, the local route for network 192.168.1.0/24 of the remote computer will have precedence over the default route 0.0.0.0/0, so the packet will not go through the VPN tunnel. Benjamin

BenjAudy.MTL · ‎12-23-2016

I normally use the following command to restart the GlobalProtect service: launchctl kickstart -k gui/`id -u`/com.paloaltonetworks.gp.pangps Similarly, for the agent: launchctl kickstart -k gui/`id -u`/com.paloaltonetworks.gp.pangpa Benjamin

BenjAudy.MTL · ‎12-20-2016

Hi, So you mean it works from the terminal, but not from your management software? What is the command you're using to restart the client from the terminal? By the way, I don't think we can access your cases. Benjamin

BenjAudy.MTL · ‎12-18-2016

Hi, Yes, it is the default behavior. The logs appear with other threat logs, but they are not configured through the profiles. You configure it in the zone protection section. Benjamin

BenjAudy.MTL · ‎12-08-2016

Hi, In addition to specifying users or groups in your security rules, you could configure different IP address pools for different types of users (if you have PanOS 7.0+). This way, your staff can configure their servers or other equipment to let VPN connections coming from the staff pool, and not from the support organisation address pool. Benjamin

BenjAudy.MTL · ‎11-21-2016

Hi, I don't think it would make sense to have a template per customer. It makes sense for device groups, though. I don't understand why you cannot reuse the same zone name for different vsys. You tried it and you got an error message? Benjamin

BenjAudy.MTL · ‎11-18-2016

Hi, What is the session end reason in the traffic logs? Benjamin

BenjAudy.MTL · ‎11-16-2016

Hi, I never tried it, but I guess you could create a new vulnerability that looks at the HTTP response code 200 (http-rsp-code equals 200) and JBoss HTTP header (Pattern match http-rsp-headers on X-Powered-by ...). You could then create a combination signature that includes threat ID 38507 with the new signature you made. Benjamin

Date Registered	‎12-06-2013 11:53 AM
Date Last Visited	‎04-12-2017 10:07 AM
Total Messages Posted	123
Total Likes Received	44

Online Status	Offline
Date Last Visited	‎04-12-2017 10:07 AM

Strata

Prisma

Cortex

About BenjAudy.MTL