About pkruse

You will need a way to differentiate the HR group from all others, this might be achieved with an AD group that you can apply using the Pan-Agent. Once you have a method to identify them you will create a security rule that precedes the rule allowing everyone else outbound web browsing. In this rule you will identify your HR group, you will identify the web-browsing and SSL applications then allow this traffic but apply a profile that is a clone of the normal url filter with the exception of adding the sites of interest in the allow list for that profile. Commit and enjoy ~Phil ... View more

In the case of a failover you would need to re-establish your ssl/vpn connection. ~Phil ... View more

The number varies depending on the model of the PAN device. See the matrix.png file for the capacity matrix. Paloalto’s philosophy on QOS is that we use QOS to restrict bandwidth accorded applications vs. guaranteeing bandwidth to specific users or subnets. Of course our devices support both methods and any combinations of methods you might need but I would be remiss if I didn’t point this out. ~Phil ... View more

When you enable multi-vsys mode you will need to assign the appropriate vsys to each interface you configure. In your case you are enabling this mode after the system is placed in production so you will need to go through all your configured interfaces and ensure they are assigned to vsys1 so as to not interrupt the flow of traffic when you commit. ~Phil ... View more

VoIP and SIP are common traffic types encountered by the PAN Firewalls. There are several vendors and some have taken the time and effort to tune and tweak their clients just enough to require special attention when creating policies. For any specific application you can use the applipedia link via the support portal to identify all apps recognized natively. In the case of unknown apps we provide the tools needed to create custom apps or app overrides. ~Phil ... View more