About scottoliver

Hello all. I have had an issue with PANOS since 7.0 (Currently I am on 9.0.2-h2) where the application id feature is not reliable in security rules. I can add a rule and for example lets say I allow ssl to 10.1.1.1 from 10.2.1.1 no user restrictions and just add the ssl application and commit. Then I try to access https on 10.1.1.1 from 10.2.1.1 and the traffic will be allowed. Then an hour later I try again and this time it will drop. When I go into monitor. Below is legitimate traffic being dropped because the application is "not-applicable"   In order to resolve this what I have to do is clone the rule and place it below or above and remove the applications and set it to any then set service to select and choose 443. I have so many redundant rules because of this and I am sick of doing it. Does anyone else have this problem or is it just me?  ... View more

Hello everyone. I am having an issue setting up a VPN from my Palo to my AWS Palo and was hoping someone can help. I did look at other AWS VPN issue but all i saw was issues with aws. This is something else. I have the tunnel up and established but traffic is not working. I see traffic leaving my palo over the correct tunnel interface but it gets lost somewhere along the way. Since I cannot see the encrypted tunnel traffic I have no clue if the aws palo is getting it.    I followed the Palo alto instructions for doing this which isnt much different than setting up a normal ipsec tunnel. The palo guide says to use NAT Traveral option in the IKE gateway which I have tried with no luck. By all rights it should be wotking. Any suggestions? ... View more

What is the current recommended version of Global Protect? I am assuming its not 5.0 since they released 4.1.10 after they released 5.0.  ... View more

Hello. To start I had a DHCP server configured on one of the interfaces on our Palo 810 PanOS 8.1.2. The DHCP addresses being handed out were not being registered with our DNS server so I was tasked to make that happen. I figured I would just set up DHCP relay instead. Unfortunatly I cannot get DHCP relay to work because of some setting on the DHCP server (windows 2012 r12). I am not sure what the setting is , but what is goig on is the DHCP server is trying to hand out the wrong subnet ip. It should be getting a 10.0.1.0/24 IP but instead its handing out 10.0.0.0/24 IP. So the palo is dropping the traffic because its the wrong IP.    ANyone know what option needs to be set on the DHCP server for this to work properly? Altertativly if anyone knows how to have the palo run the DHCP server as before but update our DNS server with the records that would be great as well. Please let me know if anyone has any ideas this is driving me bonkers. ... View more

Is anyone using the URL filter in replace of a proxy? I made this attempt but ran across an issue with user I’d mapping not being mapped accurately or fast enough and it was causing issues with users being allowed internet access. I want to only allow a certain AD group internet access. Has anyone been successful with this? ... View more

Is or has anyone else had the problem with applications and services being ignored in rules? I have had an issue from all version from 7.0 to 8.1. I have stopped using applications in rules all together because it will not identify the application and instead mark it as "not-applicable". I have the problem with services as well. For example I will create a rule and everything is 100% correct and I will add the service UDP 137 to the rule instead of netbios and it will still drop the **bleep** traffic. What good is a firewall if it doesnt allow the services you tell it to? I cant allow any any any on rules. This is becomming very frustrating.  ... View more

Having a weird issue. I installed an 820. I have internet traffic being NAT'ed. My gateway is set to the Palo. My hops to the internet look like this    Windows Box ---> Palo 820 --> Cisco Pix --> Internet Provider   Pretty basic.. I have a rule in place to allow all internal to 0.0.0.0/0 443, 80..    I can get to anything google even your tube just fine. works fast no hesitation. If I go anywhere else ( MSN, Yahoo, CNN) I get nothing. Traffic drops.  I cant figure this out for the life of me.    I got a pcap going to google and going to red.com (52.73.0.154)   I can get to google but not red. I cant find a difference. Any ideas would be appreciated. ... View more

I am trying to create some data patterns for credit card numbers. I cannot get it to take any of my regex statements. below is one of them the error is saying its invalid. Does anyone have any good solid Credit Card Number and Social Security Number Data Patterns?   \b(?:3[47]\d|(?:4\d|5[1-5]|65)\d{2}|6011)\d{12}\b ... View more