About s.williams1

I am trying to design the edge firewall and core network currently and I have a core Layer not in a "stack" or " VSS " so they are  independent Core switches. They are doing the routing to the private WAN, and will be doing the routing to the Edge Firewalls.  ECMP requires a dynamic routing protocol which usually you wouldn't run on an edge firewall, you would just have the core set to default static route to the firewall. That being said not having a Stacked Core to operate as one, I would need each core switch connected to each firewall, so the paths are crossed. If I connect one core switch to one firewall and the other switch to the other firewall then a failure of the primary's firewall connected Core will fail the whole firewall pair over when they really didn't need to be. So I am interested in how others are designing their edge firewalls to the Internet?   Thoughts? Ideas? Caveats?  ... View more

I keep fighting this SSL Decypt issue with my PAs, its almost getting to the point where its not worth running the SSL decrypt function because it causes so many issues. I am currently having issues with people downloading a zip file from git hub.    github.com/Microsoft/vsts-agent/releases/download/v2.117.2/vsts-agent-win7-x64-2.117.2.zip   The error is very simple and I can't seem to get more info on it then just: The page is not secure   But it says valid certificate and secure resources in the developer tools within Chrome.   This is also when comes up when I try this link:   This page isn’t working github-production-release-asset-2e65be.s3.amazonaws.com   unexpectedly closed the connection. ERR_CONTENT_LENGTH_MISMATCH     Is github-base one of the applications that cannot work with ssl decrypt?   ... View more

I have this challenge where I need to allow google play for app downloads but I also know google play is the place for googles streaming services. Has anyone found a way to allow the app downloads but block the streaming of their music and video content? ... View more

How does Palo Alto classify the applications risk level? I am looking into general applications that are used everyday by lots of people that have Risk level 4 and the application research center gives me this:   eventbrite business-systems general-business browser-based   Reasons are:   1 SaaS 1 Transfers Files 1 Used by Malware 1 Vulnerabilities 1 Widely Used   I cannot find anything out there that talks about this application/URL being used for malware at anytime? So where does this come from? ... View more

I am having a hard time understanding what captive portal is and what the function is of this feature?   ... View more

Ok so I guess my logs dont even collect for 24 hours due to my log storage being about 7GB. Silly people who set this up I swear. So I am trying to figure out how much I do need.    I have a PA-500, PA-820, PA-3050 (x2, they are HA pair) and a PA-3020.   https://live.paloaltonetworks.com/t5/Management-Articles/Panorama-Sizing-and-Design-Guide/ta-p/72181     Now this article shows how many logs per second, but how do I determine what my log collection per day is? I assume its based on what logs I am collection and what sev level correct?     ... View more

So I made the mistake of creating static routes that specify an exit interface. So now I have traffic coming into the firewall and then going out a different interface to get to other networks, rather then having that traffic hairpin back down my AE interface. So I have kind of a loop going on. So my quesiton is: Can I remove the exit interface value from the static routes and shutdown the interface that the traffic is going out and it will automatically hairpin down my AE interface based on ARP for the next hop address? ... View more

I have enabled URL filtering to block web advertisements, but it looks really bad cosmetically on the users end when they get to a web site where the advertisement should be there is big texted block page. Anyway we can eliminate the block page for web advertisements or make this look "prettier"     ... View more

URL filtering I keep seeing lots of clients for this URL:   play.google.com/log?format=json&authuser=0   Anyone know what application can be causing this request from the client PC?   ... View more

I has been years since I have done anything with Microsoft CA so I am really struggling.    Here is the problem:   When enabling URL filtering and I am blocking a certain site that has HTTP and HTTPS, the HTTP page will present the block page, but the HTTPS does not.    I am not doing any SSL Decrypt, I want to in the future but that is requiring certs too. Need to work one thing at a time.   So here is the article I am trying to follow:   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Serve-a-URL-Response-Page-Over-an-HTTPS-Session-Without/ta-p/55998    A certificate to be used for Forward Trust on the Palo Alto Networks device. where it is one of the following: A self-signed/self-generated certificate with which the box for "Certificate Authority" has been checked  Note: if using a self-signed/sef-generated certificate it will be necessary to import this certificate into the client machine's certificate store to avoid unwanted browser certificate errors An intermediate CA certificate installed on the Palo Alto Networks device which was generated by an organization's internal CA.   The first option requires me to give my self signed cert to the Systems team and have deploy it out via GP to all clients, that could take a while. So I want the second option. My environment doesnt have an intermediate CA, just a Root CA, so I should be able to import that since all clients already have this cert.    What I can find is how to get the root CA cert on the palo alto. Do I need to do a CSR, I am unsure how to get the root cert with cert and key. I can export it out of my local domain machine, but there is not a key so its useless. So when working with Palo Alto in a MS CA enviroment are there more in depth articles on to perform some of these tasks?   ... View more