About mahmoodm

Hi BPry, Apologies for jumping into this thread. Please could help me in understanding whether do we need any rule for web-browsing or https in order to allow the above applications. What I understand is that they should work without the http and https rule. ... View more

Hi Reaper, Please could you help me in understanding the difference for below. 1)What is security policy pre-check and what it's use. 2)How will the firewall allow the tcp handshake while we have not  defined any rules allowing on destination ports, Imagine all the rules are defined using application. Thanks ... View more

yes the devices are configured in the correct device group ... View more

The firewall fetches the verdict from WF, it is not sent to the firewall ... View more

Hi reaper,   Thanks for the response,it clears the things now.   Actually i didnt find this info documented anywhere.   Thanks ... View more

Thanks for the feedback, I notice however the release date is not shown so you cannot easily see what is outdated. Also, I don't see an export option. Is there another way to export this type of information? ... View more

Hi there,    Nice article below on file blocking.    https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/set-up-file-blocking https://live.paloaltonetworks.com/t5/Configuration-Articles/FileType-list-with-the-Threat-ID-number/ta-p/56119   Explains the basics if using PAN-OS 8.0.x.      Cheers,    Rob  ... View more

Hi Raido, Thanks for the response and now it makes more sense. one more question with regards to the action,how the action is derived for the AV and WF database,please clarify.   Thanks ... View more

Security policies are evaluated top to down.  First policy that matches traffic will be used to either allow or deny traffic. If traffic is denied/dropped then no other policy is checked.   Security profiles are checked only if security policy permitted traffic. So yes you need to add all profiles to all security policies with "Allow" action.   AppID can change during single session (incomplete > web-browsing > sharepoint-base > sharepoint-admin etc) so single session can match to different security policies but only one policy at the time. ... View more

Hi,   Configuring it on the active device should be OK as this will be replicated to the standby device.   Thanks ... View more

@hamza_ineosi managed to resolve the issue , the issue which i was facing i.e . connection timeout on server monitoring  i found out that customer installed symantec antivirus on DC and once we removed it , rebooted the server then it started to connect . before this i did a pcap from bot the fw to check if there is any drop. if no drop that means fw is not in issue . hope this will help you to resolve your problem . you may ask the system admin to uninstall any antivirus installed on DC and turn off the FW of server . RPC port 135 is used in agent less config to get the logs from PA FW ... View more

A default gateway is a "catch all" for your device if it doesnt know how to get to a specific subnet. The gb client instructs all traffic to go via the vpn so a gateway for this is not required. You will still have a default gateway for other nic, this will be used for normal access not via the vpn. (Split tunnelling).    As far as i know this tunneling or tunnel is required for routing to your internal network and a must for external gateways. You of course dont need it to access the portal but i only use "portal only" (not a setting, just my terminology) for client downloads. Could someone advise further as im sure you can do something clever with loopback but for access to internal networks a tunnel is required.   Internal gateways can be used without a tunnel interface but never used one.. ... View more

@mahmoodm, I'm sorry if this has already been brought up, but a quick glance tells me it doens't look like it. To get a better understanding of how the packet flow looks like in PAN-OS in general there is a really good writeup here that goes through every single process of packet flow in depth. This would likely be a big help to further understand how Palo Alto does things.  ... View more