Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
About DonohoeRobert
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About DonohoeRobert
06-26-2018
77Posts
28Likes
7Solutions
Jun 26, 2018Last Visited
User
Activity
User
Profile
Latest posts by DonohoeRobert
| Subject | Views | Posted |
|---|---|---|
| 11416 | 06-25-2018 02:43 PM | |
| 2766 | 02-03-2018 12:39 AM | |
| 2245 | 02-02-2018 04:52 PM | |
| 1505 | 01-29-2018 01:51 PM | |
| 389 | 01-24-2018 08:04 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 3 Likes | 11-16-2016 01:45 PM | |
| 1 Like | 02-03-2018 12:39 AM | |
| 1 Like | 01-20-2018 01:03 PM | |
| 1 Like | 01-19-2018 08:59 AM | |
| 2 Likes | 12-08-2017 09:16 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 09-01-2014 02:15 PM |
| Date Last Visited | 06-26-2018 01:27 PM |
| Posts | 77 |
| Total Likes Received | 28 |
06-25-2018
02:43 PM
Hi Mate, No worries at all.. Ye need to create a tunnel interface here 100%. Gateway and portal on loopback interface is grand, but would enable tunnel mode as per normal as well. Let us know how it goes, article a little old but can mock up in the lab again if needed. best regards Rob
... View more
02-03-2018
12:39 AM
1 Kudo
HI Mate, They are IP address's not URL's/FQDN's If creating rules and ever not sure what category a urll or address is from the cli do a test cmd. Below is a test cmd for google.com >test url google.com . https://live.paloaltonetworks.com/t5/Management-Articles/Complete-List-of-PAN-DB-URL-Filtering-Categories/ta-p/129799 best regards, Rob
... View more
02-02-2018
04:52 PM
Hi Mate, Would aggree with all of the above. Can differ from network to network, what locations to block.Running a custom report off a deny rule, currently blocking threats or inbound traffic could help you make your mind up in respect of the risk of traffic to or from certain countries aswell. Best regards, Rob
... View more
01-29-2018
01:51 PM
Hi Guys, Interesting one, tested again on 8.0.7 , no joy for android 6. IOS devices connect fine with the xauth. Client works best always anyways if the licence. Have ye tried cert authentication for the androids on 6.0. Will check tomorrow, but with the cert based auth/client certs can have sha 256 if androids need that. Might be a workaround to get ye out of the woods. The gp client connects fine anyways, no licence needed for the gp client on version 8 on windows or macbooks. and IOS devices connecting fine using xauth from a quick check.. best regards, Rob
... View more
01-24-2018
08:04 AM
Hi Team, I hope ye are well. Just posting an undocumented limitation on the community. There is a limitation of 30,000 lines of difference on the config preview option before we send a commit through on the firewalls. After this limit, it advises 'too many lines difference, please export the config to see the differences' best regards, Rob
... View more
- Tags:
- config preview
01-20-2018
01:03 PM
1 Kudo
Hi Mate, As it happens was an easier way. The few screenshots above show a qos policy for on peak and off peak. Only difference is it changes youtube to classification 7 off peak and classification 8 on peak. The QoS config has different max for each classification. Tested this an works pretty good. Cheers, Rob
... View more
01-20-2018
12:26 PM
Hi Mate, Using Macs with gp - 10.13.2 and gp clients 4.0.5-8. Have no issue connecting through GP and reaching remote servers when working from home. Connect to multiple different gp networks regularly from mac, and servers over rdp of https type connections. Out of interest, if ye block udp4051 connections, so the tunnels established as ssl, do ye have the same issue ? As always if causing a production impact open a case with your support partner. cheers Rob
... View more
01-19-2018
08:59 AM
1 Kudo
Hi Mate, I think the only way ye could do this is with a pbf rule and have two tunnels instead of one. You can assign schedules to pbf rules, send the traffic over one tunnel then according to yer schedule, and the other as needed. Then chuck the QoS settings needed on the different tunnels. Stand corrected if an easier way 🙂 best regards Rob
... View more
01-14-2018
04:02 PM
Hi mate, possible in the one rule if creative with the order of precedence for url filtering. check out the order of precednce below.. block yer blocks in the block list not custom category and allow yer allows in the allow list or custom categories whitelist. https://live.paloaltonetworks.com/t5/Management-Articles/URL-Filtering-Order/ta-p/59334 https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-Custom-URL-Categories/ta-p/54355 cheers Rob
... View more
12-19-2017
07:43 AM
Hi Mate, There is a link showing what ports [tcp/udp] are needed for the echo. https://www.amazon.com/gp/help/customer/display.html?nodeId=201973870 ye can create services for these and apply to a service group, then use that service group instead of a 'any' in the services. Monitor the traffic going through it for a day after ye test it, and from the ACC tab, filter by sorce IP and look at the applications the echo used. Can add them to the rule then. best regards, Rob
... View more
12-07-2017
08:34 AM
Hi Mate, Apart from the user id, zones and security rules. Ye can go one step further with hip checks to look at the devices connecting. Can use the hip profiles in conjunction with the user id, zones etc, to make sure the devices connecting are above board and not just the user's credentials 🙂 https://www.paloaltonetworks.com/documentation/71/globalprotect/globalprotect-admin-guide/use-host-information-in-policy-enforcement/configure-hip-based-policy-enforcement https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-HIP-checks-for-missing-patches-for-multiple-vendors-on-one/ta-p/73814 details of what can be checked with the hip checks are below. hope this helps, Rob
... View more
12-07-2017
08:26 AM
Hi Mate, Looks like the gateway and mgt ip are the same 🙂 whatever the correct gateway is use that and use something different for the mgt ip. cheers rob
... View more
11-29-2017
03:43 PM
Hi Team, Has the update server changed for dynamic updates ? updates.paloaltonetworks.com showing generic communication errors. A ping to updates.paloaltonetworks.com resolves to the address in the title, when ye change it in the config [device>setup>services>update server] connects again fine.. admin@TAC-HomeLab> ping source 10.10.20.1 host updates.paloaltonetworks.com PING updates.uswest2.gslb.paloaltonetworks.com (52.37.195.67) from 10.10.20.1 : 56(84) bytes of data. know about the article below, when the update server config is updates.paloaltonetworks.com won't connect, allow all from that IP, no sec profiles. https://live.paloaltonetworks.com/t5/Management-Articles/Unable-to-Perform-Dynamic-Updates-with-quot-updates/ta-p/56998 changing it to the one in the title connects again fine, only when ye unselect the checkbox to verify update server... new one Cheers Rob
... View more
11-24-2017
04:42 PM
hi mate, there is a link below with a tech doc on this. https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Configuring-route-based-IPSec-with-overlapping-networks/ta-p/53337 cheers, Rob
... View more
11-23-2017
04:20 PM
Hi Mate, Always another way to skin a cat. Can block all http posts, which is what phishing sites rely on. Can obviously allow for some as per requirments. But a block of http posts on unknown sites with a custom signature could save you alot of time. is an old doc below; https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Block-All-HTTP-POST-Requests/ta-p/53704 hope it helps, rob
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-26-2018
01:27 PM
|
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
