About pkruse

You will need a way to differentiate the HR group from all others, this might be achieved with an AD group that you can apply using the Pan-Agent. Once you have a method to identify them you will create a security rule that precedes the rule allowing everyone else outbound web browsing. In this rule you will identify your HR group, you will identify the web-browsing and SSL applications then allow this traffic but apply a profile that is a clone of the normal url filter with the exception of adding the sites of interest in the allow list for that profile. Commit and enjoy ~Phil ... View more

In the case of a failover you would need to re-establish your ssl/vpn connection. ~Phil ... View more

The number varies depending on the model of the PAN device. See the matrix.png file for the capacity matrix. Paloalto’s philosophy on QOS is that we use QOS to restrict bandwidth accorded applications vs. guaranteeing bandwidth to specific users or subnets. Of course our devices support both methods and any combinations of methods you might need but I would be remiss if I didn’t point this out. ~Phil ... View more

When you enable multi-vsys mode you will need to assign the appropriate vsys to each interface you configure. In your case you are enabling this mode after the system is placed in production so you will need to go through all your configured interfaces and ensure they are assigned to vsys1 so as to not interrupt the flow of traffic when you commit. ~Phil ... View more

VoIP and SIP are common traffic types encountered by the PAN Firewalls. There are several vendors and some have taken the time and effort to tune and tweak their clients just enough to require special attention when creating policies. For any specific application you can use the applipedia link via the support portal to identify all apps recognized natively. In the case of unknown apps we provide the tools needed to create custom apps or app overrides. ~Phil ... View more

As stated in the first response the sheer volume of data that must be queried will have a major impact on the speed by which the report is generated. Utilizing the Panorama product will allow you to offload this function to our remote managment/reporting platform. You could also offload to a syslog server and use your favorite SQL quiry tools to generate custom reports as granualr as you require. ~Phil ... View more

True, your DNS server will not be updated because our DHCP is not integrated within your environment. You could manually enter a value for a generic ssl/vpn connection or in the case of AD you can force a connection to the DC in order to resolve the login name to DNS. ~Phil ... View more

Jon Q, We do not provide a stand alone tool for reading logs, this doesn't mean no tools exist. If for instance you were to redirect logs to an external syslog server you could use your favorite SQL query tools to run reports. You can also use many embedded text editors to just search strings. ~Phil ... View more

Currently we do not support this type of history logging. I would suggest contacting your local SE and have a feature request submitted for this function. ~Phil ... View more

Are you saying the commit is failing or that when you commit you receive alerts and messages like dependency warnings? Please be verbose, can you cut and paste the output. ~Phil ... View more

We don't have a feature to provide that specific function however you could create a DOS protection rule against the smtp port and apply it to an ip address with a threshold trigger. Unfortunately we don't have a built in function to alert on an application based on threshold, I would recommend you contact your local SE and have them create a feature request.  ~Phil ... View more

With the possible exception of an abacus its a fair statement to say no product is without issues. PAN-OS 4.0.5 has been deployed throughout the world in very large to very small, simple to complex networks, in most cases without issue. Of course this isn't to say that we haven't had reports of problems with this code or any past code, rather to point out that we are a responsive developer and if you do encounter a problem PaloAlto Networks is committed to addressing and resolving these issues in a timely efficient fashion. We are a customer driven company and we welcome any input good, bad or indifferent from our customer base. ~Phil ... View more

Please be more specific, when you say support in what context are you referring? For instance, in the case of OSPF, RIP, etc. are you asking if we support these routing protocols as a layer three routing device? We support a wealth of applications and protocols and have the ability to create custom application signatures to address any apps that might be missing from our suite. For application control via our firewall and policy please refer to the applipedia for the apps in question. Thanks, Phil ... View more

The side with the non-static will need to be the initiator for your dynamic environment. This would explain the intermittent success. ... View more