About Brandon_Wertz

@BPry  -- Other than XML "stare and compare" are there any other ways?  I'll be reaching out to my SE and get a FR.  Having this would be huge, and potentially prevent unintended changes to configs that have the potential to impact environments.  ... View more

@HIT_Bradley wrote: I understand that for an EDL of type URL, the format is either    company.com *.company.com   This will include any additional subdomains, whether at the beginning or the end of the URL.    Regarding the forward slash, will a URL like the following be a valid entry that will be processed?   company.com/subpage/QWERTY/   Additionally, does that mean only that subpage link be blocked and not any other subpages of company.com? If you put a block in for "company.com/subpage/QWERTY/"  it will block company.com/subpage/QWERTY/ and further extensions of this URL.  It won't block "company.com/kittens/QWERTY/"  It's an exact match and anything following.  --BTW-- this function has nothing to do with EDL, and more to do with the URL matching process in general. ... View more

@Sec101 wrote: Very thankful for this post.   Are most actually running 9.1 in production environments now - or is 9.0 the norm? We've got some 5250s, 5220s, 3220s, 3020s and 220s.  I haven't put 9.1.X on the 3020s or 220s yet, but 9.1.X is on the others.  We ran into a NAT oversubscription issue on the 3220s, but other than that the code seems stable.  (docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/nat/dynamic-ip-and-port-nat-oversubscription.html) ... View more

@nreynders wrote: Last year I implemented a rule to allow users in my company access to the reddit.com site. It is in our company policy to disallow sharing messages on social media, so I implemented this rule with URL filtering (chat/messages/etc...) and only allowing the appid "reddit-base", not "reddit-posting". This worked at the time, and has stopped functioning properly some time in the past year.   Now, users are still limited from messaging/chat/etc... but can post comments and new threads on the site.   This relates to SSL decryption as I was digging down the rabbit-hole and think that the "reddit-posting" appid has switched over to "web-browsing". I was wondering : 1. If I implement SSL decryption on reddit, will it pick up the "reddit-posting" appid again? 2. Why do I no longer see "reddit-posting" in my logs? 3. What can SSL decryption do--or can't do--to help me solve this issue? 4. Is this a more-so a question about how PA identifies appids for reddit?   When you built the policy last year and it worked with the proper APP-ID being identified had SSL decryption been configured?  In general the answer is always going to be, yes, to ensure proper application of policy and identify traffic as the right APP-ID SSL decryption will always be looked at needing to be deployed.  SSL decryption breaks open the SSL/TLS packets exposing the encrypted payload.  APP-ID is going to be based on being able to properly see a packets contents/payload.  So if the packet is encrypted there's certainly going to be a limitation of Palo's ability to apply the correct application to traffic traversing the firewall.  ... View more

@calumetcounty  Are you doing any SSL decryption?   --edit-- Also try using this site as a confirmation of throughput testing.  https://www.thinkbroadband.com/download in the past working with Palo TAC engineering team they recommended using more of a "file transfer" versus the theoretical throughput testing sites. ... View more

@GuzmanDiaz18 wrote: I have realized that the license has expired for the equipment, what happens is that I am arriving at an organization whose previous system administrator has left and I am practically verifying several problems.     In my organization there are still computers that have Windows XP and Windows 7, if I also update GLobalProtect to the most recent version, will there be problems? I'm honestly not sure.  Win XP, Win7, GP4.0, GP 4.1 are all end-of-support software releases.  I would say to expect the unexpected and for things to not work.  Which is what you're seeing with VPN ceasing to work after sometime. ... View more

If create a PCAP of the traffic and give it to TAC they could help create an update to the APP-ID itself. ... View more

@GuzmanDiaz18  Is your 820 licensed?  Can it contact Palo's cloud for updates?  The only time I've see the results you're posting is when the device isn't licensed or can't reach Palo's cloud. ... View more

@MohammedAsik wrote: Hi Team   Currently we have two Palo Alto Firewall & one " Panorama" but we are getting only Panorama backup. we want to confirmation whether   Panorama  having only panorama devices backup(   Excluding Palo  alto Firewall   ) or its having including  Palo  alto Firewall.   Regards Mohammed If the 2 firewalls are managed by Panorama then by default the FWs will have backups stored in Panorama.  You just need to go to the managed devices section.  Next to the device on the right you will see the automatically stored backups.   ... View more

Can you clarify what you mean by VPN?  Is this a newly stood-up Global Protect VPN on the 820?  Do other people have the same issue when on VPN?  If it's something new it sounds like maybe there's a routing issue when on VPN?   ... View more

It's great to have the opportunity to assist the community as well as learn from everyone's shared experience too. ... View more