About Kaje

your admins should be able to click on the lock, on the top right, and either take the lock of the user, or remove the lock entirely.  We had a user that was not allowed by company policy to commit changes, she would build everything, then have other admins review and handle the commit.  ... View more

THe PA, will not be able to function as a proxy, (ie redirection in internet settings) but it will do everything else, and more. The websence I have worked with is a few years behind, so I might not be able to provide the best data, but from what i have seen the reporting in the PA is lightyears beyond what the websense did. you also have a lot more options in your filtering, like external dynamic lists, and all your IPS stuff.  ... View more

The reason to do both Zone and IP, is firewall with many zones, and possibly multiple virtual routers!   I personally dont have a problem with an ANY in the right spot, some times you really dont need to be that specific. some rules, you need to get VERY specific! ... View more

Yup, I have a few (excluding HIP profile) you just specify your zone, and source address, or source networks, Destination zone and networks, you can select multiple of any of these. Specify users (I do groups in AD)Then specify the applications or application filters, and there you go, a rule with no "ANYs".      ... View more

I believe you should be able to leverage the Firewall Migration tool, to import the 6.o config, and export the 8.0 config.  https://www.paloaltonetworks.com/products/secure-the-network/next-generation-firewall/migration-tool   ... View more

I can give you a guess,.. the document you linked has the best info.    But how much bandwidth do you puch thought the device? do you log everything? how about how many Zones do you have?   I personaly wouldnt want less then 100gb.. storage is cheap these days and most server VM enviroments should be able to support that without batting an eye.  Just a guess without knowing the enviroment, and the amount of gear you listed. I would want at least 500gb, 750 to 1tb would be a dream, but thats a fight you got to have with your server guys! ... View more

Looks like it will be easy. you just need to add a disk, and your logs will be automaticly moved over.    https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/set-up-panorama/set-up-the-panorama-virtual-appliance/expand-log-storage-capacity-on-the-panorama-virtual-appliance/add-a-virtual-disk-to-panorama-on-an-esxi-server   ... View more

In the CLI you can run the command   show system disk-space   the disks will start with sda, then the second will be sdb. if you have an sdb than you do have an dedicated log disk.    you can also do a  show system disk-partition   to see the partion sizes.  ... View more

Here is a link with the diffrences.  https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/panorama-overview/panorama-models mostly its just the volume of logs, and the size of disk supported. (8TB vs 24TB) Do you have a single install disk on your VM, or two?   ... View more

Most likely you are in legacy mode,.. Panorama has some steep CPU requirements. (24 I beleive)    to check the mode you are in, from a SSH sesion run the following command.    > show system info   at the bottom you should see this line,    platform-family: pc system-mode: legacy operational-mode: normal num-cpus: 4 ram-in-gb: 4   ... View more

yes it does. Having an logging enviroment with alot of quick sesions, will fill that up a lot quicker than an enviroemtn with not many sesions that move alot of data.    for my enviroment 500gb is a bit over a month of data. 120gb was around a week, but we log every rule, and have multiple DMZ zones.    If you are running in legacy mode, you can only have 1 dedicated log disk, and if you need to change it, you loose all logs and start over. if you are running in "panorama" mode you have more flexabiltiy to add or remove disks.  https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/panorama-overview/panorama-models I believe in a normal install, loging is part of the install disk, so you can easly add a dedicated disk easly without losing logs in any mode.    ... View more

Do you have Any AV or threat scanning enabled on this rule? Also are you doing Decryption?  Have you checked for URL filtering as well?   Some traffic does not handling being scanned, or decrypted well, also I recomend checking the URL filtering logs, just to be sure.  ... View more

I would recomend denying Quic, It is encrypted, and cannot be decrypted since its over UDP. That is why they are able to get past the URL filtering.    There is no negative to denying QUIC, except your users will have extreamly slight delay as SSL negotiates. (fractions of a second) ... View more

Yes you can, it involves exporting your config, then manualy editing the XML to remove and format some parts and then importing into exel, it sound like a pain.. but its only a couple minutes of work.    Here is a handy writeup.    https://indeni.com/how-to-export-palo-alto-networks-firewalls/   ... View more

Yup, you have to expand the network before you can do the DHCP pool.  ... View more