About mindterra

I would mirror on the TX from the Trusted Network. I would mirror on the RX on the DMZ. (Presuming there is NO reason why the DMZ should be TX traffic to the Trusted side of the network).  If DMZ is sourcing traffic to Internet, then maybe you can mirror on TX side then. I would mirror on the RX on the Internet (presuming you have switch on OUTSIDE of the current FW, so this is TX into the network, not being TX out to the Internet, as you already caught that traffic on the Trusted side TAP interface) I do not think you need to tap on VS for eval purposes.  Use Vsys1. ... View more

Also you can block torrent files (the start point that the torrent program uses generating threads to pull down the file pieces). Phil ... View more

Hi, Not sure if this helps, but what we've done in this scenario is implement a little javascript heartbeat function on the (captive portal) destination server such that users close the page to trigger a logout() function (via window.onbeforeunload), which in turn clears the user-ip mapping in the palo via the restful api call.. https://HOSTNAME/api/?type=op&cmd= <clear><user-cache><ip>USER_IP</ip></user-cache></clear>&key=APIKEY I wont post any example code here as what weve used is a little more convoluted (in that we use websockets to push messages via an AMQP broker that has workers proxying api calls to the palo) but please let me know if you want further details.. cheers damian ... View more

I believe you would have to bypass the built in captive portal page to do this. (Or maybe not. Depending how you want to do it.) You could setup a web server inside that zone that would handle the user authentication using the UserID-API and PHP. The user would just have to remember the web server DNS name/IP address to get back to the log off link. Just make sure your security policy has the source user set to either the specific user/group or known user. The short answer is it's possible. ... View more

If the diagram is accurate, then no.  OTOH, if the clients are in different subnets and those subnets route through the PAN, then yes.  The vwire deployment won't work b/c of the capwap/lwapp tunneling, the PAN can't inspect that, so no policy can be enforced. Mike ... View more

I think that should work as long as your Alcatel devices can form some sort of "virtual chassis" or other method so they can form a single aggregated link even if they are 2 or more physical devices. ... View more

Do you have any proxy setting in the browser that you are using. Try using a different browser and check if that allows you to upload the file. Please let us know if this helps. Regards, Numan ... View more

you can do that when the test is being runned with snmp (various counters there) - but dunno how to get the stats afterwards... ... View more

I'm having the same problem as was solved ... View more

What if you add "all" in the end? show user ip-user-mapping all edit: Uhh, was already answered 🙂 How come one cant select vsys within the command itself, would be (at least for me) more obvious that way (like vsys <name> | all ) ... View more