About upelister

Hello,   Chrome sometimes using tricky quick protocol so in firewall appliaction as seen "quick" in firewall logs. Do you have any chance to try this.   For Security Rule; From a Test host to internet block "quick" so chrome cannot change its behaviour. For Decryption Rule; From a test host to internet decrypt all traffic. *I am using TCP and UDP 443 on decryption policies.   Then analyze log maybe this method can give a clue about why msi file not blocked by firewall.   *before testing be sure, there are no active connection exist from test host to internet, monitor tab>session browser if there is any kill them all.   Have a nice day. ... View more

Hello,   Maybe, decryption broker option can be helpful. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/decryption/decryption-broker  ... View more

Hello,   If there is an clean up rule before default rules, which allows intrazone traffic. There shoud be a specific rule above cleanup rule in oreder to allow ping, icmp and trace route. You can try this allowing gp-zone to gp-zone; source as any and destination as any, service as application default and application any (to monitor what happens).   Also check the windows firewall if windows firewall is on, host machines not reply ping request.  ... View more

Hello,   I noticed i forgot to mention, every change in regedit requires reboot. Second option you can try,  Uninstall current installation Remove all Program Files and Appdata Folders to related Palo Alto Networks. Remove all Regedit entries HKLM and HKCU related to Palo Alto networks. Reboot Stop the wmi service. in windows service pane ( you can call it via starting a commad promt as admin rights than type services.msc) Try installation Reboot. Use recommended version I thing 5.1.3    Good Luck.     ... View more

Hello,   You can try; Uninstall all Global Protect installation if there is exist. Remove all Remainings under; AppData C:\Program Files Under Regedit HKLU Programs Palo Alto Networks HKLM Programs Palo Alto Networks Also Search Regedit because there are entrys for Global Protect Driver and network card entries in the registry. I mean remove all reaming value about Global Protect from Regedit I created a powershell script I hope it works.You can edit and add desired search location to Bold typed are. I hope this can be helpful to you, have a nice day.    $RE = 'GlobalProtect' $Key = 'HKLM:\SOFTWARE\' Get-ChildItem $Key -Rec -EA SilentlyContinue | ForEach-Object {    $CurrentKey = (Get-ItemProperty -Path $_.PsPath)    If ($CurrentKey -match $RE){      $CurrentKey|Remove-Item -Force    } }   ... View more

Hello, İ cannot run syslog miner, dasboard says it is on, after sending syslog to 13514 nothing happens. anyone knows how to run syslog miner? *l forwarded port 13514 to container.   Thank you. ... View more

Hello,   When using APP-ID default port is recomended also you can set service port to force allowed application to use specific port. My suggestion Create a application based rule with identical action before your old rule and monitor them what is hitting.  After your rule table is clean you can create and enfor application filter and groups to block unwanted application which your company requires. ... View more

Hello, You can try this, in custom category filter *.googlevideo.com should be added. You can capture youtube main URL's with using chrome developer option just pressing F12 on keyboard and seleck network tab and reload page.   For testing I put *.youtube.com and *.googlevideo.com on custom category and it worked for me. ... View more

Hello,   Free- Options; 1- Nagios : Which requires too much effort to pring up i  tired once but give up. 2- Pandora FMS: installation nice but after putting snmp libs was hard, i could not succeed. 3-ZenOss: once was my favourite becouse you can create scripts to automate task in linux enviroment based on alerts, it supports winrmc and winrms feature whic you can connect and take action in windows enviroment. 4-Ganglia and etc. was frusrating spending too much time on monitoring software not an option allways.   My Suggest; Half Free option is PRTG 100Sensor is free, Download Prtg on windows server and install. Download PRTG MIB importer to your computer. Go to support page and downlod required MIB files, open PRTG MIB importer and import it. After import save odlib file to PRTG Server library. After Save go to prtg and add device without autodiscover (up to you you may want to try). open device in Prtg admin page then select add sensor. Then select custom library and find imported mib library file. And select required sensor for you.    Have a nice day.     ... View more

Hello,   When i send a test message i got following message how can i solve this issue?   /config/data/miner1/append?h=miner1&t=localdb: 401 Unauthorized ... View more

Hello,   Client should trust, the ssl certificate presented from firewall, Firefox keeps certificates on seperate store when importing proccess select all the checkboxes.   Other possible reasons are; there another device which is making ssl inspection between client and firewall, or between firewall and the destination server. if firewall and clients are on different location maybe a mpls connection, routing problems coauses this error which i experienced before. SSL connection is sensitive to routing problems. ... View more

Hello, I think your enviroment like this;       To Check- İnterface types should be L3 and ip address assigned. Same default router shoul be used. Else you must crate a routing entry for each subnet in each VR. You can put them in different zone or same zone up to you. İf different zone, you have to create a rule. İf same zone Default allow rule will allow traffic. İf there is clean up rule before default rules, a permit rule must be created even if they are in same zone. İf there is an allow rule logging should be enabled. Link States must be Green not red or greyed out. Assingnin a ping enabled management profile to interface’s good for trouble shooting. ON cli you can check arp entry’s to verify hosts are connected properly. )> show arp ethernet1/1 or )> show arp ethernet1/4   If you are using VM Palo Alto, “promiscous mode” has to be enabled all interface’s. İn ESX. For 100.0 network host can ping to its gateway. For 130.0 network host can ping to its gateway. Trace route can be helpful. Have a nice and healty day. ... View more

Hello, Yes port forward mandatory. ... View more

Hello, Zone protection feature should be handled carefully every feature requires uniqe apporach, for me i am using with block ip with duration 1Hour+ option against bad guys. İnstead of using a general zone protection i choose to implement every single zone an individual zone protection profile. For startup some higher thresholds rather than default can be used with "alert" action. After creation of profile with desired thresholds, monitor alerts on threat log it would appear as "scan". Enabling extensive logging feature considerable. Zone protection works on ingress zone only. If every zone has a zone protection profile keep an eye on email servers. Adjust threshold levels as "scan" attacks count. My solution was checking threat logs when i see a "scan" threat than i check traffic logs and counting connections corresponing source ip to identify scanning timing. ... View more

Hi, Yes Palo Alto NGFW has; Nice to hear everything gets normal. Zone protection profiles. (should be applied on ingress zone, exhibit on last picture.) DoS profiles. ( Should be used carefully classified or non-classified) Packet buffer protection (Global setting should be applied on required zone)           ... View more

Hello,   Maybe Some sort of broadcast traffic hitting the FW, checking interface traffic via monitoring software can give clue. ... View more

Hello,   Option-1; Static IP address. Option-2; Dynamic DNS. For both option you need a good upload and Download speed.   If you have budget you can use a small PA box else you can run a virtual Firewall on local server/computer. -I used my computer for this but ADSL line was not enough. ... View more

Hello,   Network Enforcement should be on Portal Configuration for all users,  You can verify in registry "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings" you should see a "enforce-globalprotect" entry with value "yes". This Registry key can be deployable via Group Policy Object. On Gateway Config; "0.0.0.0/0" should be used. "No direct access to local network" checkbox should be on. Global Protect client should be on recommended version for all clients. As my info its 5.0.9-15         ... View more

Hello, Yes, you can create and use Custom URL Categories manually for filtering/decryption puposes on device also Palo Alto Networks Permits one shot trial for per device URL filtering Demo license. Custom free category providers can be found on internet. For example if you want to decrypt outbound traffic for a specific site/domain, you can use Custom URL categories to identify and use prevention/inspection features. SSL Decryption should be on, else Firewall cannot take desired action for custom created URL categories. İf you want to take an action on Google Url's, a custom category for *.google.com should be created and added to decryption policy, than you can take an actions on google URL's. You can Bulk  import/export Custom Categories easly with text files. Using URL Filtering license is much better.         ... View more