About das

When looking at the threat logs the vulnerability for spyware shows my servers as the attacker in the outbound direction. I have an inbound/outbound anti spyware policy and it caught jboss trying to access my network. Why does it show my servers as the attacker in the logs when the connection was initiated from the outside? ... View more

Is there a matrix or list of items that describes each of the plane functions? I know there is a management & data plane on the Palo but I'm not sure where to place the 'control' functions such as routing updates or switching path information and caching. For example, if you restart the mgmt plane, will this trigger HA failover? I am guessing (because I don't know) that the failover would take place. Because if the interface receives a heartbeat, the heartbeat 'ping' would be destined for the device itself and need to be processed by the route processor which resides in the mgmt plane, right? The fact that there is a separation of mgmt and data plane implies a table that is created from the control/mgmt plane to switch packets like a graceful restart when the managment plane is restarted. Is this the case? I'm aware of the single pass architecture but does the network processor on the data plane process packets destined for the device itself? If anyone could provide a listing of such things that would be greatly appreciated! ... View more

What is the benefit of Panorama templates? It seems like when creating a template and pushing it out to a device, it doesn't warn you when you are overwriting device configuration. For example, I have a layer 3 interface 1/10 and my template has interface 1/10 for tap. When pushing the template out, it overwrites the layer 3 interface without a warning. ... View more

The first question I have is how many layers will the file blocking inspect? For example, a zip in a zip has an exe that is malicious. If the PA doesn't inspect that far down wouldn't I be able to get through the firewall inspection? If the above is true and I am the security network guy that wants to block this behavior, could I set up wildfire to forward-and-continue to block this? In other words, I am aware that the limit is 4 layers deep (if that is actually the depth) and I want to make sure this is not a limitation I would want to set up wildfire to forward .zip files that could potentially have malicious data the normal file blocking mechanism can't see. Also, is wildfire able to tear down a file in such a way that EVERYTHING is seen in the file and run the way the attacker wants it to? Could a file potentially be flagged benign when it's actually malware in wildfire? If forward-and-continue is on and I deny the file can I get an email notification saying whether or not it was benign or malicious so that i don't have to log into the firewall and check every so often? I'm thinking of an entry box with something to the affect of "Enter you email for results" and then it emails the results. ... View more