About Brandon_Wertz

@BPry  -- Other than XML "stare and compare" are there any other ways?  I'll be reaching out to my SE and get a FR.  Having this would be huge, and potentially prevent unintended changes to configs that have the potential to impact environments.  ... View more

Like @Brandonyawn mentioned here is the referenced link to that information:   https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-overview/about-globalprotect-licenses.html ... View more

@HIT_Bradley wrote: I understand that for an EDL of type URL, the format is either    company.com *.company.com   This will include any additional subdomains, whether at the beginning or the end of the URL.    Regarding the forward slash, will a URL like the following be a valid entry that will be processed?   company.com/subpage/QWERTY/   Additionally, does that mean only that subpage link be blocked and not any other subpages of company.com? If you put a block in for "company.com/subpage/QWERTY/"  it will block company.com/subpage/QWERTY/ and further extensions of this URL.  It won't block "company.com/kittens/QWERTY/"  It's an exact match and anything following.  --BTW-- this function has nothing to do with EDL, and more to do with the URL matching process in general. ... View more

@Sec101 wrote: Very thankful for this post.   Are most actually running 9.1 in production environments now - or is 9.0 the norm? We've got some 5250s, 5220s, 3220s, 3020s and 220s.  I haven't put 9.1.X on the 3020s or 220s yet, but 9.1.X is on the others.  We ran into a NAT oversubscription issue on the 3220s, but other than that the code seems stable.  (docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/nat/dynamic-ip-and-port-nat-oversubscription.html) ... View more

@nreynders wrote: Last year I implemented a rule to allow users in my company access to the reddit.com site. It is in our company policy to disallow sharing messages on social media, so I implemented this rule with URL filtering (chat/messages/etc...) and only allowing the appid "reddit-base", not "reddit-posting". This worked at the time, and has stopped functioning properly some time in the past year.   Now, users are still limited from messaging/chat/etc... but can post comments and new threads on the site.   This relates to SSL decryption as I was digging down the rabbit-hole and think that the "reddit-posting" appid has switched over to "web-browsing". I was wondering : 1. If I implement SSL decryption on reddit, will it pick up the "reddit-posting" appid again? 2. Why do I no longer see "reddit-posting" in my logs? 3. What can SSL decryption do--or can't do--to help me solve this issue? 4. Is this a more-so a question about how PA identifies appids for reddit?   When you built the policy last year and it worked with the proper APP-ID being identified had SSL decryption been configured?  In general the answer is always going to be, yes, to ensure proper application of policy and identify traffic as the right APP-ID SSL decryption will always be looked at needing to be deployed.  SSL decryption breaks open the SSL/TLS packets exposing the encrypted payload.  APP-ID is going to be based on being able to properly see a packets contents/payload.  So if the packet is encrypted there's certainly going to be a limitation of Palo's ability to apply the correct application to traffic traversing the firewall.  ... View more