About CMG

Hi,   Is there a configuration avaialble to not enforce the requirement of a BGP peer including their AS in the advertised path?   This is required in peering exchanges where there are central route servers which function transperantly by advising of next hop and AS numbers associated with specific prefixes, but don't inlcude themselves in the path.   Regards,       ... View more

Does PAN have any plan for better managing the current state of TLS decryption now that Diffie-Hellman based ciphers are becoming the default standard?   PAN currently only supports the below ciphers, and when presented with a website that ONLY supports DH ciphers it appears to just reset the connection instead of failing open. Manually whitelisting/ excluding sites which only support DH ciphers these days is starting to become a too labour intensive manual process.. TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES128_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA   Does PAN have any plan to better manage this?  Shouldn't "active" forward proxies be able to to support DH from proxy to website? Or should we just consider this the death throes of PAN's gateway decryption/ visibilty functionality? ... View more

Had a brief glitch recently on PANOS 5.0.6 where it appears that an administrator perhaps RDP'd (or something similar) to a Citrix Xenapp server which triggered a user-id/ ip mapping and doing so seemed to override the TS-Agent user mapping for existing Xenapp users on the same server.. i.e when users got a url block page it informed them their user account was the "administrator" account.. So the question is .. was this just a temporary glitch in the matrix... and TS-Agents ip/port mapping should always have priority.. or Should as best practice the ip addresses of all Xenapp servers be manually excluded from active directory userid user/ip mapping? Regards, ... View more

I've noticed in PAN OS 5.x that the application block page is not enabled by default. Obviously it can be manually enabled.. but w as this done for a specific reason to address some common problems experienced by customers? I could surmise that perhaps displaying the application block page might chew up limited sessions/resources on the PAN firewall as opposed to just issuing a RST by default? Perhaps compounded by the amount non-browser based applications which repeatedly try to connect out using http/https as their primary communication protocol.. Has anybody experienced specific problems when the application block page was enabled? ... View more

Whats the maximum latency allowed for HA peering links (e.g HA1 control and HA2 keep-alive) between devices setup in active/passive HA pair? i.e based on the latency can determine the approximate distance that HA pairs can be physically separated.. 1Km .. 100Km? etc. whilst connected via dark fibre. ... View more

I'm currently having problems on PAN OS 5.0.1 replicating a standard Screenos MIP configuration. Whereby static nat and interzone/intrazone u-turn nat are all active at the same time. We have multiple zones (5) all of the hosts inside each need to be able to access DMZ servers by their NATd public ip address (multiple dmz zones). Also unfortunately hosts inside the DMZ's sometimes want to talk back to themselves using their public ip address instead of their private.. Terrible I know.. Also when the DMZ servers talk to the internet they need to appear as their static natd public address.. when they talk to the internal (inside) network they appear as their standard private address.. Attached is a screenshot of the NAT configuration for 1 DMZ server.. The intrazone and interzone u-turn nating only work when the SNAT (static source translation) is not enabled.. Any thoughts? I know we could be using split-dns.. and also this current design is begging for a re-architecture.. but we currently need to maintain status quo functionality for this firewall transition.. ... View more