About Andy123B

Our external email protection provider (Mimecast) provides safe versions of file attachments on incoming emails. There is also a one time link in the email to request that the original file is sent in case of any formatting issues. When the incoming mails are scanned by WildFire it sometimes follows the link in the email which triggers the release of the email from Mimecast.    Is there a way to filter out scanning / following of links for certain domain names within Wildfire config?   Thanks Andy ... View more

PanOS 9.1.4, GP client 5.2.7-6.  We have a split tunnel configuration with only 2 internal /32 addresses added to the access route include list. We regularly see traffic from GP clients destined for Internet IP addresses hit the Palo over the client tunnel. This is from several IOS clients - we don't have any other client O/S'es to test with. Is there any reason destinations not included in the include list would sometimes route over the tunnel?   PANGps.log shows the correct routes being installed on the client. The incorrect packets don't seem to coincide with any issues in the client log like a reconnection.  We have a fairly basic configuration. Connection method - On Demand, "No direct access to local network" option not ticked.    Researching the destination addresses and ports seem to indicate these are related to messaging clients and some are to apple's range on 17.x.x.x. I have also specifically added 17.0.0.0/8 to the  Exclude access rule but still receive traffic destined there.  Is it possible that some apps don't use the routing table on IOS and sometimes use the tunnel interface?   Thanks Andy ... View more