About ksuuk

Version 398 is out. And includes some google apps modifications. Should we test it? ... View more

You can choose "none" only for custom url categories. ... View more

Yes, this works, but only for HTTP. How to make this work for FTP? ... View more

According to the such feature request is done already a year ago. It's actually very strange, that vendor, whose only product is firewall, is so behind with common features, that every other firewall vendor have. PaloAlto must do serious jump, as right now I feel that simple the term "next generation" doesn't ring the bell anymore. Also others vendors have made progress. I almost regret moving from CheckPoint to PaloAlto as I miss so much common features... ... View more

This all is very confusing. Device to Panorama official manual is outdated, some scripts have done, but lack of documentation, so I still can't figure out how to migrate existing device config to Panorama? Seems with official set &copy/paste method I can't migrate the whole config. Second option is manually copy/paste config parts from device XML to Panorama XML. Both methods seems crazy in year 2013, when others vendors do it automatically. So Your script sounds good. Can I migrate the whole config?  But please explain more, how to export data from device and import it into Panorama. Where to add device IP, Panorama IP etc. ... View more

At this point I'm 100% sure that the problem is in PAN skype-probe and skype app detection logic. See the logs. If skype-probe app once detects traffic for some ip as skype-probe, the how is possible that next detection is as unknown-udp. And how it takes 30 minutes ta match unknow-tcp as skype? Same destination IP, close destination port range. It's a huge bug. We need skype app update ASAP. ... View more

Yes. But for me the main problem is that when clients are using skype, I see a lot unknow-tcp and unknow-udp packed, which are dropped. Allowing them makes skype working but kills the firewall. ... View more

By manual, Yes skype-probe must be allowed for all, but I found, that it's not so mandatory. I'm using skype-probe and skype in one rule all next one is deny all. ... View more

Hmm, about Your rules, why are You: a) first deny unknow-udp and unknow-tcp for any? b) allow skype-probe for any? As I can't find the reason keeping skype-probe and skype in two different rules? I'm usind skype-probe and skype in one rule and below allow rule is deny rule for all. ... View more

What SkyPe version You are using? Is it default or edited version? Did You test messages, voice, and video? Did You test between internal <> external or between internal <>internal users. What PAN os? I also see, that wiyh such rules, like Yours, sometimes all works. One call gets true, next to same person fails. But as I have almost 10 000 users, then every call which fails, is a big issue. ... View more

Yes, using group policy supernode is disabled. And I have about thousand separated subnets, so this isn't an issue also:). The only issue right now is PaloAlto:(. ... View more

Ok, blocking is possible. But I have challenge to allow for some and block for some. So far I can block it for all, but I can't allow for some, as it works with random problems, no messages, voice ok, or no voice but messages ok. And I don't wan't to allow unknow-udp or unknow-tcp. ... View more

Works what? Blocking or allowing? ... View more

Actually we don't use ssl-decryption and we have problems with allowing SkyPe. We must allow SkyPe for some networks and block SkyPe for some networks. This did work fine before, with CheckPoint firewall and IronPort proxy, all was OK. CheckPoint blocked SkyPe totally, and SkyPe worked true proxy, using 443 port. But this doesn't work with PaloAlto, v5.0.2. I have checked the logs a lot, and seems that PaloAlto can detect Skype somehow 50/50. I also noticed, that destination IP -s, that PaloAlto detects as Skype, are sending ton's of packets back, but PaloAlto drops them all. This seems to be a bug. Some users can't connect. Some can. Some can connect, send messages, but can't make calls, messages are delayed etc. This is HUGE problem for us. I tried everything with PaloAlto, even allow only 443 port for Skype, still without luck. We tried upgrade SkyPe to the latest version, this is even worst for some users, seems PaloAlto can't detect SkyPe 6.1 properly. I asked to open support case also. What next? ... View more

Allowing unknown-tcp is same as not having firewall at all. ... View more