About bat

bat · ‎06-25-2015

Hi cjsteele To know the status of rule query should be: https:// <ip>/api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='<rule-name>']/disabled Let me know if this is what you are looking for.

bat · ‎04-23-2015

If Panorama fails, then you can disable Panorama Policy and Objects Under Device > Setup > Panorama. While disabling you get the option to locally save the Policies and Objects (Same for Device and Network Template) which then you can edit later. Please do mark helpful/correct answers.

bat · ‎04-23-2015

I don't think you can. You will have to change it through Panorama

bat · ‎03-19-2015

Hi alexander.graser Yes the application is excluded from SSL decryption but if the SSL connection is rejected right away by server i.e. server does not send a HELLO in response to HELLO from client SSL decryption exclude list will not be checked. To have the application excluded you will have to create a no-decrypt policy for URL update.microsoft.com, *.update.microsoft.com Hope it helps!

bat · ‎03-05-2015

Hey cgaona Please go through this: Re: Tengo problemas con PAN no puedo entrar por via web

bat · ‎03-05-2015

Hi prestonhartley I don't think you can suppress type 5 LSA on the firewall.

bat · ‎03-04-2015

I tried this and worked, I think you missed the space after '[' [edit rulebase security rules TESTRULE] firewall# set destination [ HOST1 HOST2 ] ***Please do mark helpful/correct answers

bat · ‎03-04-2015

Just do set destination HOST1 set destination HOST2

bat · ‎02-27-2015

sphippen URL encode for & is %26 I am not why you have that extra "amp" in there, may be that is causing the issue ?

bat · ‎02-23-2015

Hi CoS You can check the sessions from CLI using the below command: show session all filter nat-rule <rule-name> To see what NAT rules are matched for a specific traffic you can also use the test command: test nat-policy-match <criteria>

bat · ‎02-20-2015

Dataplane can be down in some situations that is the reason there is a segregation between dataplane and management plane so even during high traffic you can easily access the device through management plane. You can disable services under management-profile applied to that interface to restrict access ( or not use a management-profile at all)

bat · ‎02-19-2015

Hi dannon You will have to allow SSL on service TCP-636 to make this work. Firewall will not be able to identify it as LDAP unless you enable decryption.

bat · ‎02-13-2015

I could not find any documentation specific to "Maximum number of interfaces" but there is a document on how to check system limits: What is the Command to Display System Limits?

bat · ‎02-13-2015

Hi @mike_cc I think this is a hardware (+software) limitation, you can find the limit using the below command: show system state | match max-qosif cfg.general.max-qosif: 6 **EDIT: The above output is from 3050 so you can have 6 max qos interfaces on your device. Hope it helps !

bat · ‎02-13-2015

mbeghdadi There is no need to define all the IPs on the public Interface, if they are all of the same network then just create NAT rules using and device will automatically respond to ARP for these IPs You will have to create NAT rule if you want to 1-1 mapping between the LAN networks and public IPs I don't think there is any need of virtual routers on LAN side as long as all the networks are different. Hope it helps!

bat · ‎02-11-2015

Hi Nathan, Yes RIP works over a VPN tunnel. You can try configuring filters for RIP packets and see if they are getting dropped.

bat · ‎02-10-2015

Hi Paulo_Aun SSL and IPSec connection in GlobalProtect use port 443 (TCP) and port 4501 (UDP) respectively which is different from what Site-to-Site VPN uses (Port 500/4500 UDP) so that should not cause any issue. For global protect configuration: https://live.paloaltonetworks.com/servlet/JiveServlet/previewBody/6586-102-15-33414/GlobalProtect_Admin_Guide_v6.0.pdf Hope it helps !

bat · ‎02-10-2015

Could you please confirm if that tag already exists on the firewall ? I just tried the following command and it worked: https://10.66.18.85/api?type=config&action=set&key=<key>&xpath=/config/devices/entry[@name="localhost.localdomain"]/vsys/entry[@name="vsys1"]/address/entry[@name="dmz-L4"]&element=<ip-netmask>1.1.1.1/32</ip-netmask><tag><member>internal</member></tag>

bat · ‎02-10-2015

atelcom Could you please try putting the netbios domain name in the domain name field of authentication profile ?

bat · ‎02-10-2015

mrsold Could you please explain your query in more detail ? I think DHCP requests will be accepted for both networks and will be forwarded to DHCP server ?

bat · ‎02-10-2015

Hi @COS You can find the examples here: URL Categorization Change Request | Webroot BrightCloud Hope it helps !

bat · ‎01-20-2015

AXI_IIEN_Remo Just tested this and it worked fine (with local authentication). Add this in the <head> section of the page: We will be using Jquery to remove the attribute: <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.js"></script> <script type="text/javascript"> $(document).ready(function() { $('input[name=passwd]').removeAttr( "maxlength" ); }); </script> Hope this helps !

bat · ‎01-19-2015

Yeah I meant that way.

bat · ‎01-19-2015

Could you try this in the javascript: document.getElementsByTagName("passwd")[0].removeAttribute("maxLength"); Let me know how it goes.

bat · ‎01-19-2015

AXI_IIEN_Remo Could you provide the URL to your global portal page I will try it on my PC

bat · ‎01-19-2015

Hi AXI_IIEN_Remo How did you remove the maxlength attribute ? If that works then we can try to remove the attribute using javascript.

bat · ‎01-15-2015

irishjd There are multiple documents available you can start from this one: Custom Application Signatures Hope it helps!

bat · ‎01-14-2015

irishjd There is an application available for minecraft and for other games you can use URL filtering by blocking the category "games". Hope it helps !

bat · ‎01-13-2015

VSU_ITSEC The block page is global I don't think you can create a separate one for some URLs.

bat · ‎01-12-2015

Hi injazat-soc Did you go through this document: How to Block Google Chrome Look for the user-agent for IE 10 requests and allow that application only. Hope it helps!

Date Registered	‎06-20-2014 04:47 PM
Date Last Visited	‎02-18-2017 09:37 PM
Total Messages Posted	263
Total Likes Received	74

Online Status	Offline
Date Last Visited	‎02-18-2017 09:37 PM

Strata

Prisma

Cortex

About bat