About mmcastr

I did something like you suggested to get the data from logs.   Thanks for the tip. ... View more

Hi @BPry We have a scenario where Internet access is blocked by default for most of users and the access is allowed by a custom URL object that have a list of URL or FQDN. I found a traffic related to one of the allowed FQDN that uses http referrer but is denied because the FQDN inside the URI is not inside the white list but it has into the http referrer the allowed FQDN.   Based on it I'm trying to allow this traffic based in this http field.   I didn't find the http referrer attribute inside the available options to http protocol when I was building the custom app. As we don't have a testing environment to homologate this custom app I'd like to ask you if I'm in the right way to match this kind of traffic and allowed.   Below I put the options I worked to build the custom app.   Application / Signatures   Signatures Name: http-scup      Scope: Transaction        Operator: Pattern Match        Context: http-req-params        Pattern: www.domain.com          Qualifier: http-method GET Thanks for your time. ... View more

I'm not comfortable with XML config yet but I'll study your suggestion. Thanks for this smart tip @BPry ... View more

@jvalentine There is no budget to follow suggestion #1. As I was reading about it we have a lot of work to do. We have so many pre rules to migrate to post rules. Thanks for this tip. ... View more

I opened a case on Palo Alto and the System Engineer discovered that it is a problem started on release 7.1.11 and will be fixed on release 7.1.15. The workaround for it by now is the command below that it must be applied on every restart because it does not be salve on settings.   >debug user-id query-unknown-ip yes ... View more

We've just talked about your suggestion here. We are trying this change on settings as a workaround for now. Thanks ... View more