About Sergey.Ivashkin-PL

@BPry,  tahnk you for quick answer.   still can't get it. My DNS, for instance, located in different zone. palo intercepts the request to malicious server and - if block, don't send any responce to client (and C&C sleeps well till next attempt). If sinkhole, then send sinkhole address to client, so client do following request to that 'fake' address and we see alerts in threat and traffic logs, right?    "If your DNS server is in another zone from your internal clients, then it really doesn't matter if you sinkhole or block. You'll be able to see the actual client making these requests regardless of utilizing a block or sinkhole action. " - I will see only alert in threat log for that suspicious dns request. Difference that client in same or different zone is only source of that request (client itself or his DNS server),    Thank you!       ... View more

good day, what is difference between action on DNS Query - block or sinkhole?  ... View more

Hi, Is there were any improvements since your last message?  I have necessity to upload panorama config (with 2 templates and 6 vsys) to optimize it (convert objects to shared, remove duplicates and so on, sono changes in templates by now), but when I am about to drag&drop device-group to device-group's folder, I see that my device-group is transferred to shared and no new device group in OUTPUT config is created. So all my VSYSes goes to shared vsys, which is wrong. Thank you for advice in advance.      BR, Sergey ... View more

Hi, did you solve your issue? i also need to import azure ip range to palo. thank you in advance ... View more