About tezza

After enabling decryption recently we started to have a few issues with applications being identified incorrectly. A few common examples of this are sap, http-video and http-audio   These end up being blocked with "application default" for the service, this appears to be because in some instances sites use https anyway and once these apps are decrypted they show as going over port 443 rather than 80 which makes sense but is contrary to the app-id signatures default ports. I know we can create rules for applications like this to allow them specifically but this is starting to become very time consuming to create a rule for every application that has this issue. Is there a way to allow this traffic while still inspecting it with some sort of override? it feels a little like there should be a http-video (Decrypted) or https-video application.   I think it would be great to be able to create an application signature that overrides default settings, this would allow you to pick pre existing application signature and override the default ports for example. We can then add this overriden application to a pre-existing rule.   Is there another work around for this I have missed? ... View more

Hi, Can anyone please tell me if there is a way to stop my PA from responding to ICMP type 13 and 14 timestamp requests/replies? Cheers ... View more

Hi, I would really like an answer to this considering this is supposed to be a security product in the first place and I see several people have already asked the question. We have just had a security audit completed by a third party, they highlighted 2 issues with the address that our global protect portal and gateway reside on. SSL server accepts connections that use: 1. Rivest Cipher RC4 2. Cipher-block chaining (CBC) mode I noted that these 2 are similar questions that dont really have an answer, one tries to answer it but I'm not sure what FIPS is and enabling it (How to Enable or Disable FIPS Mode) sounds like a nightmare considering according to this article it erases your config and puts you back to defaults? Qualys Scans SSL Weak CBC Mode Vulnerability Is there a good way to fix this, maybe someone can answer all three posts by answering mine! ... View more

Hi, I have been tasked with creating a report out of our Palo Alto firewall that shows the following. For a period of 1 month Users Hours\Sessions on a website Top 20 visited websites. Top 20 Categories. We are using the user agent so all the data should be there, I can see some of it but getting this into a format that easy to read for a CEO? Can someone please help me? ... View more