About bjdraw

I did restart the Mgmt server, but the App, Content and AV version still mismatch, any other suggestions? On Another hand, Version are matched on secondary FW. ... View more

For the safety of data transportation, experts advise students to use the HTTPS protocol, because any information entered using SSL is encrypted, so in case of interception, the attacker receives a random set of characters and can download your dissertation. https://customwritingz.net ... View more

I have the same problem and confirmed that configuring the Skype client to use a specific UDP port to listen on and then creating a NAT rule to forward traffic to that port on the computer with the Skype client, greatly improves the picture quality (and a UDP relay isn't indicated in Technical Call info). I'd really like a more scalable way to improve my user's Skype conference calls (that are used to communicate with offshore staff) then creating inbound NAT rules for each user. ... View more

I'm not sure if this document has been updated, I thought it might be useful for people to know that PAN OS prior to 7.0 only use IKEv1 and do not support the Windows Azure Dynamic Routing, Static Routing is required when using IKEv1 with PAN OS prior to v7.0 ... View more

There are all sort of solutions depending on your needs, taste and size of wallet 🙂 I have over the years been playing with for example Ironport which is nice but really expensive. What it comes down to in terms of anti-spam is a combination of actual contents of the email in combination with some kind of "reputation" filtering (mails sent from known spamsources will get a higher point of probability of being a spammail). Another thing to not ignore is the possibility of false positives. A common setup is to use "reputation" filtering to simply drop connections from wellknown spamsources and then forward the rest to the client but tag the subject (or so) with [Possible Spam] or similar so the client can then have a rule to place those mails in their own folder (this will also ease the needs for administration from the IT-department to all the time scan for mails that shouldnt be dropped/quarantined or for that matter people who wants their mail to get released from the quarantine - the later will of course still exist if your email policy is to not allow executables to be sent through and stuff like that). ... View more

Ok, as a work around I uninstalled the GlobalProtect client and configured a IPSEC VPN the same way as was documented for iOS devices and 4.1.x. Worked perfect and no entry in the menu bar. ... View more

Basicaly you have to configure a Decryption Policy under Policies>Decryption. I'd start by reading the PAN help, search ssh-tunnel, and the Tech Note “Controlling SSL Decryption,” for instructions on managing SSL certificates to avoid certificate mismatch errors, and “Controlling SSL Decryption” might be a good start as well. ... View more

Hi Darcy, If you are not hosting a server on the guest wifi network, you won't need an inbound NAT rule.  In other words, if guest-wifi users only need to be able to connect out from this network, you only need source NAT.  For the packets coming back from servers on the internet that match a session initiated by a guest in the guest-wifi network, the firewall will automatically perform the reverse translation. Thanks, Nick Campagna ... View more

I was running 4.0.8 (can't remember the exact 4.0 release) and I didn't get a warrning because my policy for traffic destined for the internet from the LAN was 'any' and I just added exclusions to block SIP and SMTP. If I had put an explicit rule allowing Facetime from the LAN to the Internet then I would've gotten an error. ... View more

It was my zone protection, I unchecked "Suppress ICMP TTL expired error" and tracert works end to end. Thanks! ... View more

Microsoft isn't the only one who makes HTTP application firewalls. You can even find dedicated hardware based appliances. F5's ASM actually includes prebuilt modules for OWA so deployment is pretty easy. ... View more

I had this issue once and also blamed it on the PAN, only to discover that it was another hop along the way. In the end this netsh command on the RDP server fixed it. netsh interface tcp set global autotuninglevel=disabled Worth a shot as it can easily be turned back on. ... View more

Guys the supplicant native to Phones and IPSec in general use XAUTH, certificate authentication.  We developed a solution in house that does just that, profiles for VPN and Wifi and connecting them to the PAN agent.  Works on Android, Blackberry, IOS and Symbian etc. If your phone has VPN settings the XAUTH is usually the way to go.  That way when they upgrade you don't need your VPN client to upgrade as well. Same for Wifi.  The key thing here is client auth certificates replace credentials such as Windows etc. General use of a single p12 per client and OSCP or a CRL makes PAN able to use the same cert for Wifi, VPN and SSL Decryption (even wired if you want to go 802.1X). ... View more