About khuynh

For any feature request, please refer to your Palo Alto Networks local representatives, they will be able to help / forward your FR. ... View more

Hi,   The event means that Traps detected an attempt to exploit a Windows process. They are several types of memory corruption exploit, you can find a list here fyi : https://docs.paloaltonetworks.com/traps/3-4/traps-endpoint-security-manager-admin/exploit-protection/manage-exploit-protection-rules/exploit-protection-modules-epms   The way to "solve" these events (and more generally any Traps events) is to investigate further to see if it's an expected behavior (so these events  = false positives) or if it's a real threat detected on the systems. To investigate, you can retrieve data from the endpoints, you can ask help from your partners, etc. If its a False Positive, you can create an exception to exclude similar events, so they will not appear anymore on the GUI. ... View more

Hi,   Without mode information, it will be difficult to troubleshooting your problem, maybe a support ticket will be the best thing to do here. However, just in case of, the split tunneling per domain requires a GP subscription license on the Firewall. May be the cause of your problem. ... View more

I provided to my customers the same solution I provided to you: to open a ticket.   The TAC will then be able to share with you the specific IPs and ranges we use (I cannot list them in a public forum and you will easily guess why), so you can indeed block them. Another possibility the TAC would offer is to give us a list of your URLs/domains/IPs, so we can exclude them from analysis/scan. They will also be able to share with you what are our plans to be less intrusive in the future. Again, you will understand that these kind of information cannot be share like that in a public forum but again, our TAC will be happy to help you & share with you those internal information.   HTH     ... View more

@Rags I didn't mean to be rude, sorry if you feel that. I do work for Palo Alto as a SE, but I'm not responsible for the scanning of our internal teams. I have in my region several customers who have the same concerns as you, and I want you to have the most detailed answer and the best solution for you. The best way to figure out a good solution for your environnement is to go through our TAC, who will be able to deliver the best solution that fits you, depending on your architecture, devices, licenses, and so on.   A little bit sad to hear that we are not friend anymore on Live ;), but I will still go on and try to help people here to the best of my knowledge.   Regards,   PS: Feel free to drop me an email if you want to continue this discussion. ... View more

@Rags If you have any inquiries related to that traffic, please open a support ticket and our support team will help you and figure out how to make it more convenient for you. Regards,   ... View more

What about doing a destination NAT policy ? ... View more

If you are using 8.0, and for your case, you may also use the new feature 'Static Route Removal Based on Path Monitoring' instead, it's more simpler to configure than PBF.   https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/static-routes/static-route-removal-based-on-path-monitoring   HTH   ... View more

Hi Abkumar,   If you refer to the number max of secondary IPs on a same interface, it should be 255 IPv4 addresses.   HTH ... View more

Hello Nrobison, It can be related to a corrupted package (AV/WF). If you are using Threat Prevention and/or WF license, please download and install again the latest packages:   > request anti-virus upgrade download latest > request anti-virus upgrade install version latest > request wildfire upgrade download latest > request wildfire upgrade install version latest   If it still failed, try to restart the mgt server and the web server: debug software restart process management-server debug software restart process web-server   If it still failed, please open a ticket. ... View more

As far as I know, we only have one app for dropbox for now. You will have to make a packet capture for Dropbox for Business and regular Dropbox and try to figure out some differences (the URI, some HTTP headers, etc.) between those two captures so you can create a custom app for your dropbox for Business.    Decryption will be mandatory in this case.     ... View more

Hi Daniele,   Another suggestion: check the stats of interfaces. Maybe you have a duplex problem which can lead to slowness...  ... View more

Hello Steveblade,   I guess you have to download a base image first (8.0.5 or 7.1.0) and install the VM with one of these images. Then, you will be able to upgrade to the latest release.   HTH ... View more