About jeff6strings

We have a 3020 firewall with version 8.0.10 and need to allow a new server access to resources in other zones. An existing server, 10.100.100.10 already has this access, so I need to mimic the access of this server.   In Objects\Addresses there is an entry for 10.100.100.10 with the name Server1. In Objects\Address Groups there are a couple of groups in which server name Server1 belongs.   In Policies\Security, when I search for Server1, four Security Policy Rules result. When I check them, all have Server1 in either Source or Destination.   When I search Policies\Security using the Server1 IP address, 10.100.100.10, a half dozen result, two of the results have Server1 name, but the other four don't. I checked these four, and they don't have the server name or IP address anywhere in the rule.   I appreciate any help in understanding the logic of how the other four policies result by IP address. Thank you. Jeff     ... View more

We have Palo Alto firewalls with version 8.0 and need to allow SQL Cluster synchronization from one zone to another. The servers are Windows 2016 with MS SQL 2016. I'm not a SQL expert but tasked with a firewall rule between these clusters. I appreciate any advice or help.   Jeff ... View more

We have a 3050 with one VSYS and is connected to an ISP with one IP address as we also use this VSYS for user VPN (Global Protect). All is working fine but we will be adding another VSYS to segregate another department’s Internet traffic. I would like both VSYS to share the same Internet and IP but I’m concerned if I read correctly about our existing Global Protect VPN configuration and the Shared Gateway being a problem.   I appreciate any help or insight. Jeff ... View more

We currently block the web mail category but I need to make an exception which I can place in our allow list. We need to allow outlook.com/domain.edu but not sure if I should use this full URL or if I do will it allow all of outlook.com or if I need to use a REGEX. I appreciate any help. Jeff ... View more

We have 2 3050 appliances (not in HA) managed by a Panorama VM. For now all are running version 7.0.x but we are upgrading to 7.1.x in coming months. We may have a requirement to retain user activity logs (mostly URL activity) for a minimum of 6 months to a year for around 1100 users. Looking for recommendations if we should increase our Panorama disk size to hold this amount of data or use dedicated log collectors which I really don't know much about. Appreciate any help. Jeff ... View more

With my new employer I'm managing a 3050 unit with a couple of Decryption Policy Rules which are configured to decrypt using SSL Forward Proxy. The Decryption Profile under Options is set to None. I can't find what the behaviour is when the decryption profile is set to None. I appreciate any help. Jeff ... View more

We have two 3050 units managed by Panorama. I have two related questions: What is the difference between Apps and Contents in Dynamic Updates?  If we have a support contract for the firewalls and Panorama but don't subscribe to Antivirus, Threats and Wildfire do we need Content updates or just Apps? Thanks for any help. Jeff ... View more

In referencing the link below (FAQ - Office 365 Access Control), I'm concerned with a destination in the Security Policy for Office 365. What is everyone else doing for destination? The list of IP addresses for Office 365 Business products is long and ever changing or can a URL Category be used in the Security Policy using the published FQDNs in the link below? Appreciate any feedback. Jeff   FAQ - Office 365 Access Control   Office 365 IPs and FQDNs ... View more

Regarding the User-ID Agent (Active Directory) feature of the firewall, I’m confused as to the difference and need for either the User Mapping and/or User-ID Agent. Is the User Mapping feature replacing the User-ID agent? The units we have were setup prior to my employment as we 6 office locations and two data centers each data center with a 3050 unit which have 11 MS AD monitors (an AD server or two at each site and in the data centers), 3 Exchange monitors, and 1 User-ID agent. All Internet traffic from the office locations will go thru a 3050 unit at either data center using our MPLS infrastructure.   I’ve read the User-ID best practices etc… but still confused as to what is needed and how each works. Appreciate any help and insight. Jeff ... View more

Can a firewall with software version 7.10 or later be used as an NTP server? Thank you. Jeff ... View more

Are Virtual Systems (vsys) in the Palo Alto firewall PCI compliant? Thanks for any help.   Jeff ... View more