About david_scott

We're thinking about enabling user-id agent and captive portal to more closely monitor and segment our user permissions. I'd like to know, however, if there is a document somewhere that details what information is captured and logged regarding username->ip address mapping through user-id agent. Does such a doc exist? ... View more

I have a Palo Alto 2050, software version 4.1.6 I have a user behind my Palo who can't log on to his Nike+ account. When he attempts to log on he gets redirected back to the sign on page continually. We've tested this outside the firewall and he has no problem. Anyone else seen this problem Thank you, David Scott ... View more

I'm in a position where I need to move a device that is currently inside my network to a DMZ on my Palo 2050. Which puts me in a position where I need to create a DMZ on my Palo. Does PA have a good document for creating a DMZ? I haven't been able to find one searching the forums. ... View more

I have a PA-2050 running 4.0.7. I have an IPSec tunnel that runs between 2 sites (one is a Palo, the other is ??) I would like to guarantee some level of bandwidth available for this tunnel, to ensure that it gets a level of priority at least over basic web and streaming traffic. I'm confused about how to assign this priority. Here's what I've done, based on the doc "How to Configure Quality of Service (QOS)" for PanOS 3.0.0 and above. I've created a QoS policy Called "Bandwidth Guarantee", with the source zone being "Untrust" and the source IP being the Internet IP of the remote site. The "Destination" zone is also "untrust", with my internet facing IP as the "Destination address". I've added IPSec and IKE as the applications this guarantee applies to. I assigned it to "Class 1". Next, I created a QoS network profile called "Rate Guarantee" and assigned Class 1 a "Guaranteed Egress" of 50 mbps, a "Maximum Egress" of 100 mbps, and a priority of "Real Time" Finally, for network QoS I added my Internet facing ethernet interface (ethernet1/1), enabled QoS, assigned "Clear Text" traffic the default QoS policy, and assigned the "Tunnel Interface Default Profile" to "Rate Guarantee". Now, I would expect that once I committed this config, that I would be able to look at the QoS statistics and see the traffic from my tunnel being applied to Ethernet1/1...Tunnel Traffic...tunnel1.1...Class 1. However, I see nothing being applied, even though the tunnel is up and functioning. I'm sure I'm missing something. What am I missing? ... View more

Is there a way - CLI or GUI - to view active connections to my Palo Alto? ... View more

I work in a University, and recently our library began to use - or try to use - an app called "Able" from http://able.nationalbindery.com We're behind a PA 2050 running 3.1.5 firmware. The site uses an embedded Java app to communicate with a remote server. From what I can tell, the client initiates a session to dst port 80, then the server responds and all future communication happens across remote tcp port 9000 (and whatever random port the client chooses). I can't seem to create a policy that will allow this traffic. I've created a policy from "Trust" to "Untrust" allowing "Service" tcp 80 and tcp 9000. I've also added a policy from "Untrust" to "Trust", allowing port 9000. Nothing. Does anyone have any experiece with this app? I can provide a pcap if necessary. Thank you, David Scott Freed-Hardeman University ... View more

I'm new to the PA 2050. I'm trying to determine the best way of forwarding multiple incoming services on multiple external addresses to multiple internal servers. My PA 2050 is set up in L3 configuration. I have NAT policy rules for all my external->internal address pairs. My delimma: I have several internal SMTP/FTP/WEB servers behind my 2050, listening on several external addresses. It appears I can NAT each service as a separate NAT policy rule, OR, I can leave the 1 to 1 NAT rule and create a security policy for incoming traffic from "untrust" -> "trust", "any" source address, and select the destination server and application/service to forward the traffic on to. Or can I? Is one more efficient and/or flexible than the other? Thanks, David Scott ... View more