About Brandon_Wertz

@VzServiceDesk wrote: Hi Everyone,    As per PA-3220 datasheet IPsec throughput can be 2.5Gps. https://www.paloguard.com.au/datasheets/pa-3200-series.pdf   The palo in my environment got  1 Gig interface (internet facing) and multiple ipsec tunnels are configured to communicate to different cloud providers without any rate limiting....so question is how to figure out what would be the actual throughput of the VPN tunnels  ? as the physical interface speed is 1G maximum..   You have 1 physical interface with a maximum throughput of 1G.   Let's say you have 5 IPSec tunnels connecting through this 1G interface.  The most the aggregate of these 5 tunnels will get is 1Gb.   1 tunnel might get 900Mb with 25Mb shared across the other 4.  Or any variation you could think of totally 1Gb, but the total throughput of your tunnels will never exceed 1G. ... View more

@RichardKnox wrote: Good morning, My company uses Global Protect for its connection to our corporate network when I work remotely. I recently been having issues where it says its connected, but only part of the applications are able to access the network. Skype works, I can see the local drives, access Projectwise, but Outlook (Microsoft exchange) keeps asking for a password. I have to go and reboot my ISP modem, shut Outlook off and then once Skype is back online restart Outlook and it connects just fine. I have a Arris Cable modem ( MODEL: DG3270A) provided by my ISP. The only reason I am looking at Global Protect is there are times I will watch it connect/ disconnect multiple times in a row, before establishing a permenant connection. The modem is also a router that can be disabled, which I did because I already had a home router system installed in the house prior to having this "Upgrade" installed with the faster speed. So, please any suggestions?   Since you say, "my company," I'm guessing you don't own the VPN service.  It sounds like you should contact your company's network team to look into this for you. ... View more

@Jafar_Hussain wrote: @SutareMayur  I have tried this but it is not working as well as i have cheked with decryption but still same issue persists. In the traffic logs for the video content what's the application being defined as? ... View more

@AvinashKukkapalli wrote: Attached screen shots for reference I refer you to my posts in this thread.  https://live.paloaltonetworks.com/t5/General-Topics/PA-3260-and-using-non-dedicated-as-HA1-interface/td-p/308152   Are you trying to use a different pot for HA-1 because you need fiber?  HA-1 has to be used on the dedicated port. ... View more

@AvinashKukkapalli wrote: Hi Team , Can we route HA traffic between two 3260 firewalls through cisco switch using L2 vlan.  My requirement is to run firewalls in HA and devices will be in different buildings. Buildings are connected with dark fiber. As PAN dedicated HA ports are ethernet i have to use another converter or switch to make them communicate in HA ports.  i did l2 vlan on 9500 switch but HA1 never comes up. Can we do like this? Technically no, but you can switch the traffic...Ok, I'm done splitting hairs.   You 10000% can do this.  As long as both switches participate in the same layer 2 domain it should work without issue.  (This would also mean that the link the switches are connected has the access VLAN on the trunk the HA-1 ports are on)   Say you have FW-1 connected to SW-1 with the FW-1 HA-1 with the IP of 10.10.10.1 on an Access VLAN 10 to SW-1   You'd need FW-2 connected to SW-2 with the FW-2 HA-1 configured with the IP of 10.10.10.2 on Access VLAN 10 to SW-2.   You would do the same for HA-2 ... View more

@MP18 wrote: Yes it is a fiber connection connection between our Data centres for HA! Can you land this fiber into a switch?  Then plug copper from the switch into HA1? ... View more

@MP18 wrote: We have 2 PA 3260  across Data Centres. We tried to use Eth1/13 as HA1 port but under ha1 interfaces it does not show option to choose  eth1/13.   IS this by design that HA1 interface to be dedicated? for now we used management as ha1 interface.   is this good to use management interface as ha1?   Regards Mike Why can't you use the HA1 port even if the firewalls are across DCs?  (I'm guessing you're needing a fiber connection?)     I've got a 5220 pair spreed across 2 DCs that are 800+ miles apart using HA1 in a switched environment w/o issue. ... View more

Your question is kinda hard to follow.  What are you trying to understand?  The link you posted merely defines the zones you'd need to create in a Palo SD-WAN environment.  Those zones based on their name have a specific use case based upon their name. ... View more

@sbaghel wrote: Thanks alot for your response. I was missing User-ID check on the untrust zone. After enabling the same it is working like a charm. Appreciate your help on this. Have a good one !!!! I'd be careful with this setting:   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVPCA0   " Resolution Only enable User-ID on trusted zones By only enabling User-ID on internal and trusted zones, there is no exposure of these services to the Internet, which helps to keep this service protected from any potential attacks.  If User-ID and WMI probing are enabled on an external untrusted zone (such as the Internet), probes could be sent outside your protected network, resulting in an information disclosure of the User-ID Agent service account name, domain name, and encrypted password hash.  This information has the potential to be cracked and exploited by an attacker to gain unauthorized access to protected resources.  For this important reason, User-ID should never be enabled on an untrusted zone." ... View more

@Parthipan wrote: Hi,   I have many sites with different network infrastructure in different countries and i would like to deploy Paloalto firewalls below wan link, please help to  to decide method of Paloalto firewall deployment L3 or vwire in an existing network infrastructure    I have been assigned to study the infrastructure and decide L3 or Vwire and to give the justifications on my deciding   Thanks.   The one thing to consider is requirements and limitation or complications of either deployment.  I know vwire deployments can't do somethings that other deployments can (maybe only a L3 type deployment, but I'm not sure.)     For instance though from this Palo page:   https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/networking/interface-deployments/virtual-wire-deployments "Y ou wouldn’t use a virtual wire deployment for interfaces that need to support switching, VPN tunnels, or routing because they require a Layer 2 or Layer 3 address. " ... View more

@MikeSangray2019 wrote: We are working with a partner who is using Google Cloud VPN and we are seeing latency issues. They will only reference Google documentation and will not set MTU on their end. On our end we are trying to determine the optimal MTU setting, but it's a bit tricky. It also looks like setting MSS is not really an option for us as it's an interface-only option and can't be configured on a tunnel.   Has anyone dealt with the other end of an IPSec VPN tunnel being a Google Cloud VPN?    Background: we recently migrated from a Sonicwall to a Palo Alto. The Sonicwall performed better and without MTU being configured.   We have ours set to 1427 and I haven't heard about any issues. ... View more

Do you have an "Interface Management Profile" applied to your "Untrust" Zone?  Without this being applied captive portal won't kick-off.   I pulled this from the contextual help menu:   "Response Pages—Use to enable response pages for: Captive Portal—The ports used to serve Captive Portal response pages are left open on Layer 3 interfaces: port 6080 for NTLM, 6081 for Captive Portal without an SSL/TLS Server Profile, and 6082 for Captive Portal with an SSL/TLS Server Profile. For details, see Device > User Identification > Captive Portal Settings.URL Admin Override—For details, see Device > Setup > Content-ID." ... View more

Can you log into the FW with an account not leveraging a custom role? When you log into the FW with that account can you see the ACC tab? You keeping showing the role, which shows what you've been configured to be able to see, and you think that's proof something is wrong. It looks like someone has set this role up with ACC removed and for some reason they've also still allowed that account with that role to see these custom groups. I bet if you log in with an actual admin (like I said before) you'll see that the role you're using has been disallowed from seeing ACC. "Please do the needful!!!!" (hahahahaha) ... View more

@Amin2 wrote: I have been going through the PAN OS 9.0 curriculum and I am confused about ACC Global Filters.      Three way to apply a GF: Set Global filter from the table from any widget and apply the attribute as GF. Promote LF as GF, when this is done it will update on all the TAB in ACC Define a GF: Define a filter using the GF pane on the ACC.   To me items 1 and 3 look the same?    Any clarification someone could give would be a great help.   Thanks -Amin   They are different...   A widget is a widget and a "pane" is a pane.   ... View more

@Meshall ... Ditto, to what I commented about @aljohani1409 had posted.  @kiwi was more than likely spot-on with identifying the issue. ... View more

@aljohani1409 wrote: Right now I'm  using admin (superadmin) still i can not found ACC !      @aljohani1409 as @kiwi and others have already pointed out, you're 99.9999999% probably using an account via a role that isn't configured to see the ACC tab.     The account in your screenshot even says you're using an account called "securityadmin."  While you might preceive this role to be a "superadmin" that might be for your role/function in your company for your use of the firewall, but from the actual FIREWALL side, the administrative control of the firewall itself, I'd bet my month's pay check your "securityadmin" isn't a "superadmin."   I'd talk to the person who owns the control of your firewall. ... View more

Could it be related to DSRI being enabled on the security rule the traffic is matching?   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpfCAC  https://live.paloaltonetworks.com/t5/General-Topics/Slowness-with-http-file-transfer-after-placing-PA-in-line/m-p/70621#M40559     ... View more

@shiprian wrote: @Brandon_Wertz we got this report from a client    We recently had an e-mail problem with all e-mails from the domain arhimar.ro (that means that Hor**** has not received any e-mails from AR**** since 20 November 2019 – see below).   Our IT cannot solve the problem. They told me that Arhimar has to initiate this. They provided me with the following information for your IT responsible:   “Our e-mail service provider qualifies mails from your domain as phishing mails, because of the URL arhimar.ro in your e-mail which is listed up the Blacklist of PaloAlto. Please contact PaloAlto to get removed from their blacklist to enable a stable email communication to all companies which uses PaloAlto as an external serviceprovider to validate email against spam/phishing.”   Would you please forward this information to your IT responsible and ask him to follow these instructions in order to reestablish a safe e-mail communication between Arhimar and Horn****?   Thank you very much for your support.   Sorry I don't know how else to help you.  I don't work for Palo, but am a customer of their products.  This other entity which is blocking your emails is saying Palo has the domain listed as malicious but Palo's URL filtering lookup doesn't corroborate that. ... View more

I looked up your domain " a rhimar.ro" and it doesn't appear to be in a blacklist to me.   ... View more

@Shuaib_Khalid wrote: ...I think above workaround cannot be consider as a permanent solution. Hence I am planning to upgrade the OS to 8.1.10 as suggested above. I will share the outcome with you guys after up-gradation. For the future as a general rule when doing upgrades it's best to go to the "preferred" release.  When you upgraded from 8.0.X into 8.1.0 you unfortunately upgraded into a code version that already has lots of documented bugs which have been mitigated in the subsequent releases (8.1.1 - 8.1.10) ... View more

Management profiles create the way you can disable response pages.  Create a new management profile with "response pages" unchecked. ... View more

@MickBall wrote: Have a look at captive portal.   it can be used transparently as per comments below.   The firewall uses   Kerberos single sign-on (SSO)   to transparently obtain user credentials. To use this method, your network requires a Kerberos infrastructure, including a key distribution center (KDC) with an authentication server and ticket granting service. The firewall must have a Kerberos account, including a principal name and password.   captive portal info here.. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-web-interface-help/policies/policies-captive-portal   Sure Kerberos could be used for SSO, but it's just easier to use the NTLM credential forwarding or sharing from the web browser.  Using CP and NTLM SSO Palo doesn't have a known user association the firewall (I think it's the FW and not the UIAs) will ask the browser via NTLM for the credentials the web browser has.  The FW then takes those creds and asks AD if they're valid.  If they are then that user mapping association is stored in the FW for the configured time period.   Using this NTLM method doesn't require anything additional to be setup in anyone's environment.  The draw back here is, it requires the use of a web browser.  So if there's an IP change and a lack of user attribution and the user is only using "thick clients" (Like outlook) this NTLM feature won't work.  The user would need to browse the web for this attribution process to work. ... View more

@regahamz wrote: We have newly implemented PaloAlto in our network. Internet access provided for the user using the AD username. Using User-ID Agent in Active directory. When a user is logged in with wired connection and switched to wireless the internet is getting disconnected.Internet is working if the user logoff and logs in again. Is there anything we can do to avoid this disconnection? Is there any configuration to be done in firewall or User-ID agent to avoid this? Note: Wired and Wireless connection different subnets. The whole subnet is included in the user-id agent. Appreciate if anyone can help on this regard I posted about this back in 2015.  https://live.paloaltonetworks.com/t5/General-Topics/Dual-NIC-IP-Mapping-Issue/m-p/63710#M38291   Unfortunately it's not as straight forward as you'd think.  If you have a windows client that has both a wired and wireless NIC Windows will NOT perform authentication against both NICs.  It chooses one or the other.  So "those event IDs" that Palo UIAs need to monitor in order to perform IP to ID association will only happen for one NIC at a time, and it's only going to happen once; until another scenario comes along that requires the authentication.   There are ways in Windows to make a particular NIC the "preferred" NIC, so say setting Windows use the wireless NIC over wired, Windows won't always adhere to that.   Your best bet is going to be to use the layered authentication mechanism to catch on-the-fly the user mappings you need.  This means using captive portal with NTLM (SSO) authentication.   Ultimately Palo will tell you the "fool proof way" to get the user mapping is to deploy Global Protect clients.  Merely using them for user tracking will give you a more reliable way of making sure you always have an IP to ID association. ... View more

@vsys_remo wrote: *This is only my personal recommendation and nothing official, but because of too many problems in the past I will always wait until x.x.8 or even x.x.9 version until I upgrade to a new majorversion. Agreed.  I deployed a 5220 running 8.0.5...Thought it was a stable code, ended up crashing both the A/P box because a netflow bug.  The bug wasn't fixed until 8.0.8.   So for a major enterprise I'd wait until at least .7+ of a patch level on a new major release. ... View more

Put your site here https://urlfiltering.paloaltonetworks.com/ from that site you can request a recat. ... View more