About Gregoux

a source nat was implementing between the palo and the hsm and there is a verification of the palo ip with ntls ipcheck fonction enable by default   LUNA doc   and to resolve just disable it with this command on the luna HSM ntls ipcheck disable      ... View more

Hello    could you verify this counter show counter global filter | match url_request_pkt_drop   you obtain something like this url_request_pkt_drop    334056   10 drop   url   pktproc   and  if you have some drop packet it's du to the   waiting time for url categorisation  request   to resolve this modify this parameter set deviceconfig setting ctd url-wait-timeout  and define a value greater than 5 and less than 60   by default panos use a value of 5 s and  the PA-500 is to light to process the categorisation and takeover the limit of 5s you and increase the capacity of the PA-500 but increase the acceptable time to resolve the query   regard's   you can find more info  https://live.paloaltonetworks.com/t5/Management-Articles/What-is-the-Cause-of-Packets-Dropped-Due-to-URL-Look-Up-Failure/ta-p/59703   ... View more

hello your security policy is configured may be with service application default. may be when you decrypted the the session the flow stop to match you policy because you tried to catch the application name on the 443 port and now the traffic is not seen as SSL. be sure that you create asecurity policy which match the good app on the good tcp port like 443, and apply on it the security profile which handle the file blocking action. regard's ... View more

yes you right thank you very much I'm going to sleep now ... View more