About parmas

Hi, Thanks for your feedback, after investigation the issue was related to PFB..It was necessary to write a new rule stating that trafi from LAN to GP (global protect Zone) should not use PBF... After the commit, trafic is UP... ... View more

Suena a que lo mejor seria abrir un caso de soporte con el TAC, ya que es posible que se requiera reemplazar el equipo. ... View more

Hello, I would also update your agents if you are using them. Regards, ... View more

"Cutoff time" specifies the amount of time (in seconds) the agent will wait for gateways to respond before determining the best gateway to connect to. The agent will then attempt to connect to only those gateways that responded within the specified Cutoff Time. The default value is 5. A value of 0 indicates that there is no cutoff time; the agent will wait until the TCP timeout ... View more

Just to add something that has not been mentioned... It could be possible that the traffic is indeed reaching the firewall and the NAT itself working properly, but you need to make sure you have a route not only on the firewall to reach the private IP, but also a route configured on the server itself to get back to the outside world through the same firewall interface that was used to forward the incoming packets. Hope this helps. ... View more

What is what you're pinging? Have you run packet captures and any debugs? Packet Capture, Debug Flow-basic and Counter Commands ... View more

this is resolved when you register the firewall. Unregistered firewalls do not provide logging. ... View more

Gavin, I just tried this setup myself and it works fine, as you said. I´m thinking that there are alot of other applications, besides Google-Search, that are identified by PA as web-browsing which use port 443. So adding the application google-search would only solve one problem. What i´d recommend them to do is to either add port 443 as a default port for web-browsing or give the users the ability to add it themselves. I guess this could be done by creating a custom app with the same signature as web-browsing but port with 443 as an addition (again, theory haven´t tried it). I´m not sure if there are any security concerns with adding port 443 though. ... View more

also try google or ie development tool from the browser. They show a lot of info including timing ... View more

Something we've run into with numerous customers using indeni to watch their PANW's: They set up a dynamic block list, but then don't notice when the fetching of that list fails. It's basically a job that fails with the message "Unable to fetch external list. Using old copy for refresh." (see What Happens if the Server Configured for Dynamic Block Lists Becomes Unreachable?) So keep your eye out for that. ... View more

It is possible to write a custom signature for the SMB decoder....there is a context called "ms-ds-smb-req-share-name" which, I believe, is what you are looking to filter on? ... View more