About mvidic

Can you confirm that Gratuitous ARP with a new MAC is sent after the HA failover? ... View more

What kind of NAT are you trying to do? It is possible to do dynamic-ip-and-port source NAT for sure, I haven't triend other scenarios. ... View more

You don't have to install the 7.0.1 version. You just download it as a base image and only install a desired version (for example 7.0.5) so you only need to reboot once. ... View more

Withiout SSL Decryption PA cannot see the requested URLs and will use the information writen in the certificate. Youtube uses *.google.com in its certificate therefore it will be recognised as google. Implementig SSL Decryption should solve your issues. ... View more

If you do not wish to log allowed sessions you can remove log forwarding from the rules that allow traffic. If you only wish to log detected viruses in allowed traffic for example you can create a log forwarding profile with no log forwarding under the traffic settings and enabled log forwarding under the Threat settings.   Unfortunately we are quite limited when it comes to forwarding of system logs. Under Device > Log settings you can only select the severity of the system logs that will be forwarded. Unfortunately you cannot change severity of a certain event (for example failed admin logon). The result of this is that you cannot tune which events you wish to forward and which you don't and you will always end up forwarding too many or too few events.   One possibility is to set up a syslog relay server where you filter syslog which is forwarded to SIEM.   LPM ... View more

Hi everyone. In my experience SSL decryption and blocking the application Psiphon was not enough, it was only the first step. Psihon was stll able to connect. I discovered that Psiphon creates a Proxy service on localhost and changes proxy settings in browser to redirect browser traffic over Psiphon application. Psiphon application then forwards the traffic to the internet by its own sneaky methods:) I did Wireshark analysis and discovered that after SSL connection was blocked by PAN, Psiphon created a gzip encoded streaming tunel over tcp port 80 and PAN recognised it as "web-browsing" which was allowed. I tried to create a custom application but without success. We successfully blocked the Psiphon by implementing SSL Decryption, blocking Psiphon application in the security policy and also by preventing users from changing their proxy settings using domain group policy. Creating custom application signature for port 80 traffic and blocking it in the security policy on PAN would be more elegant but my signature caused too many false positives and it was easier to create a group policy.   LPM ... View more

Hi, What does the traffic log say? Do you see the sessions? Are they allowed or denied? ... View more

Hi, if you are refering to pdf reports (Monitor>Reports...) they will adjust their mesure units automatically. For example if some application produces 15,000,000,000 bytes of traffic it will be show as 15 GB of traffic in the reports. If it produces 1,500,000 bytes of traffic it will be show as 1,5MB etc. When I read your question again I realised that this probably isn't what you were asking, sorry:) ... View more

@ethiSEC and @reaper are both correct but in my opinion issues arise sooner in the workflow. If there was just a rule missing we would still be able to see "Forward" action in the Data Filtering log. According to @jdprovine Data filtering log is empty.   Can you try this in the CLI:   test security-policy-match from srcZone to dstZone source srcIP destination dstIP protocol 6 destination-port 80 Enter the srcZone, dstZone, srcIP and dstIP for the session in which you download the test file.   Output will be the security rule that was used for accessing the test file. Then make sure the File Blocking profile you pasted earlier is applied to that rule. ... View more

Hello, We migrated a configuration from one platform to another many times. As @dmoudgil said, as long as you are on PA-4020 not using the interfaces that are not available on PA-3050 and you have same versions of PAN-OS you should be good. The versions even don't have to be completely the same. You can do for example 6.0.x->6.0.y or 6.1.x->6.1.y etc.   ... View more

In that case I would say it is one of the following: Your File Blocking profile is configured incorrectly Your File Blocking profile is not applied to the correct security rule You are using SSL  Can you download testfile again via http and then paste details of the session from the traffic log? ... View more

Is wildfire-test-pe-file.exe visible in Data Filtering logs? You should see two entries in that log: Forward and wildfire-upload-success. ... View more

SSL Decryption is not necessary for a wildfire (free or licensed). It is necessary to analyze files that were downloaded via SSL. To test free Wildfire only you should download a test file from http://wildfire.paloaltonetworks.com/publicapi/test/pe. File will be downloaded in clear text, therefore no SSL decryption is required and you will be able to confirm that your Wildfire configuration is correct. ... View more