About pkruse

You will need a way to differentiate the HR group from all others, this might be achieved with an AD group that you can apply using the Pan-Agent. Once you have a method to identify them you will create a security rule that precedes the rule allowing everyone else outbound web browsing. In this rule you will identify your HR group, you will identify the web-browsing and SSL applications then allow this traffic but apply a profile that is a clone of the normal url filter with the exception of adding the sites of interest in the allow list for that profile. Commit and enjoy ~Phil ... View more

In the case of a failover you would need to re-establish your ssl/vpn connection. ~Phil ... View more

The number varies depending on the model of the PAN device. See the matrix.png file for the capacity matrix. Paloalto’s philosophy on QOS is that we use QOS to restrict bandwidth accorded applications vs. guaranteeing bandwidth to specific users or subnets. Of course our devices support both methods and any combinations of methods you might need but I would be remiss if I didn’t point this out. ~Phil ... View more

When you enable multi-vsys mode you will need to assign the appropriate vsys to each interface you configure. In your case you are enabling this mode after the system is placed in production so you will need to go through all your configured interfaces and ensure they are assigned to vsys1 so as to not interrupt the flow of traffic when you commit. ~Phil ... View more

VoIP and SIP are common traffic types encountered by the PAN Firewalls. There are several vendors and some have taken the time and effort to tune and tweak their clients just enough to require special attention when creating policies. For any specific application you can use the applipedia link via the support portal to identify all apps recognized natively. In the case of unknown apps we provide the tools needed to create custom apps or app overrides. ~Phil ... View more

As stated in the first response the sheer volume of data that must be queried will have a major impact on the speed by which the report is generated. Utilizing the Panorama product will allow you to offload this function to our remote managment/reporting platform. You could also offload to a syslog server and use your favorite SQL quiry tools to generate custom reports as granualr as you require. ~Phil ... View more

True, your DNS server will not be updated because our DHCP is not integrated within your environment. You could manually enter a value for a generic ssl/vpn connection or in the case of AD you can force a connection to the DC in order to resolve the login name to DNS. ~Phil ... View more

Jon Q, We do not provide a stand alone tool for reading logs, this doesn't mean no tools exist. If for instance you were to redirect logs to an external syslog server you could use your favorite SQL query tools to run reports. You can also use many embedded text editors to just search strings. ~Phil ... View more

Currently we do not support this type of history logging. I would suggest contacting your local SE and have a feature request submitted for this function. ~Phil ... View more

Are you saying the commit is failing or that when you commit you receive alerts and messages like dependency warnings? Please be verbose, can you cut and paste the output. ~Phil ... View more

We don't have a feature to provide that specific function however you could create a DOS protection rule against the smtp port and apply it to an ip address with a threshold trigger. Unfortunately we don't have a built in function to alert on an application based on threshold, I would recommend you contact your local SE and have them create a feature request.  ~Phil ... View more

With the possible exception of an abacus its a fair statement to say no product is without issues. PAN-OS 4.0.5 has been deployed throughout the world in very large to very small, simple to complex networks, in most cases without issue. Of course this isn't to say that we haven't had reports of problems with this code or any past code, rather to point out that we are a responsive developer and if you do encounter a problem PaloAlto Networks is committed to addressing and resolving these issues in a timely efficient fashion. We are a customer driven company and we welcome any input good, bad or indifferent from our customer base. ~Phil ... View more

Please be more specific, when you say support in what context are you referring? For instance, in the case of OSPF, RIP, etc. are you asking if we support these routing protocols as a layer three routing device? We support a wealth of applications and protocols and have the ability to create custom application signatures to address any apps that might be missing from our suite. For application control via our firewall and policy please refer to the applipedia for the apps in question. Thanks, Phil ... View more

The side with the non-static will need to be the initiator for your dynamic environment. This would explain the intermittent success. ... View more

Absolutely you can setup the PAN to send you email alerts each and every time you miss heartbeats or have a failover. Now for the warning: When you set up your e-mail alerts they are not based on the Type of alert rather they are based on the severity. If you were to set your alerts to send on everything from informational to critical you will quickly begin seeing a flood of emails alerting you to everything from a catastrophic failure to a successful ssl/vpn login. I would strongly suggest you spend some time observing your system logs so that you can make a informed decision on what level of alerting will best meet your needs. ~Phil ... View more

Please look at the attached file and tell me, is this the setup your describing? If yes there is not a good reason for dropped packets originating from or destine for the broadcast domain local to your inside interface. Configuration would be the logical area to review and viewing the system logs may reveal any proxy id issues. If you are unable to resolve this problem in a timely manner on your own I would direct you to open a case with support so that can help you resolve your problem quickly and efficiently. Thank you, Phil ~Phil ... View more

Please look at the attached file and tell me, is this the setup your describing? If yes there is not a good reason for dropped packets originating from or destine for the broadcast domain local to your inside interface. Configuration would be the logical area to review and viewing the system logs may reveal any proxy id issues. If you are unable to resolve this problem in a timely manner on your own I would direct you to open a case with support so that can help you resolve your problem quickly and efficiently. Thank you, Phil ... View more

Wow! Thats off the beaten path. Can you please open a support case s that we can work directly with you on this issue. ~Phil ... View more

Does your monitor show the ping? Can you see the session from the CLI? "show session all filter source xxx.xxx.xxx.xxx application ping" ... View more

The multi wildcard in a *.* format is unsupported and it would block all raffic if added to a block list. The example you gave shold be *.foo.com ~Phil ... View more

Hello and thank you for yur question. The PaloAlto device does not have a garbage script, instead we set the lease time and rely on the client side to renew in accordance with the RFC. The timer begins running as soon as the lease begins so even if your client was to receive an 8 hour lease, logout and walk away for 4 hours they clock is still running. Once the lease has expired the IP will be returned to the pool unless the client side renews the lease. Thank you, Phil Kruse ... View more

The Palo Alto Firewall requires a varied number of packets to traverse the data plane in order to collect sufficient data to identify an application. The number of packets will vary from app to app. Several applications require unknown TCP and unknown udp traffic in order to establish a session. These unknown packets often are little more than a port scan used by the parent app to dynamically determine an available port for the session to run over. Skype and other P2P apps commonly use this method to find holes in a firewall. ~Phil ... View more

Does this happen with any weekly report or is it confined to a specific report? If you change to another day or time do you see the same behavior? What version of the PANOS are you running? The more information you can provide will help in determining the cause. ~Phil ... View more