About BatD

@ehartcoghlin You are correct that the URL filtering will only work on client to server web traffic. It can only control users accessing particular domains, but not traffic initiated from those domain. The reason is that the firewall can only see the source IP in incoming traffic and URL filtering looks at the actual URL in the http headers.  Surely you can filter particular emails at the email server level or if you have the feed of IPs of NRDs, then you can import it as an dynamic IP list in the firewall and block SMTP traffic based on that list.  ... View more

@wahxwah URL is the url user is trying to access as taken from the HTTP header, or as in your case of encrypted traffic, from the SSL Certificate.  Destination is the actual destination IP of the session. I am not sure why you are getting the output in the below, but there will be more information if you can share the detailed log. I wonder if you have selected the "Resolve hostname" checkbox at the bottom of the screen and the firewall is trying to do reverse lookup for the IP.  ... View more

@blwavg The users need to be identified somehow at policy level, and the other option is to use Authentication Policy (preciously known as Captive Portal)  to grant access to the firewall management. This will allow you to configure very granular control of which use can manage the firewall from particular subnet.  ... View more

@blwavg You answered the question in your description, this can easily be achieved by using Global Protect and you shlould never really be exposing unprotected admin access to internet.   If you are using UserID and dynamic admin authentication, you can potentially create granular access policies for the internal network as you described. However you cannot do it from internet, as the firewall will need to know the user to ip mapping for the specific admin and the Internet admin can have any IP.  ... View more

@Taraka You can see details of supported platforms below. Looks like 3000 series will be supported , but 5000 ar not.  https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates ... View more

@Aashish74  Although in general this may work, there are a few points in the workflow that are not quite a best practice and can be misleading. Bi-directional is generally not recommended as you don’t have full control of the return traffic. Packets will be translated correctly from LAN to WAN, but in the opposite direction, they will match any zone to WAN , which could complicate things if you have multiple zones. I would always recommend having specific inbound destination NAT rule to your servers and a generic source NAT outbound if your servers need to connect to Internet. The second point is that you suggest adding a service to the bidirectional NAT rule, which means that the rule will match only this service port for both the  inbound and outbound translation. This kind of defeats the purpose of bi-direction, as you presumably want to configure it for outbound internet traffic for your server. Next, your security rule will match the inbound packets to the server, but not outbound from the server. Finally it is not a good practice to configure the same multiple zones in source and destination. ... View more

@rohit3120 You can run it it on endpoint, which has https connectivity to the firewall you need.  You can either use curl, or just paste the url in a browser.  ... View more

@AlexandroDelAngel All of your assumptions seem correct... ... View more

@Carracido Looks like the matrix may be out of date, becaue teh admin guide says support for 6.7. One thing to note is if you deployed 8.1.0 ova the VM hardware was  vmx-09, while in 9 it is vmx-10. I am not sure if this is really the rason for not working and  t could be  a fault condition or a  bug with 9 and you can escalate it with support.    " VMware ESXi with vSphere 5.5, 6.0, 6.5, and 6.7" https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-a-vm-series-firewall-on-an-esxi-server/vm-series-on-esxi-system-requirements-and-limitations/vm-series-on-esxi-system-requirements.html ... View more

@devd_25 The licencing is quite well explained in the admin docs and  user licenes based on number of users over 90 days.    "The service does track the number of unique users over the last 90 days to ensure that you have purchased the proper license tier for your user base, and stricter policing of user count may be enforced if continued overages occur."   https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-cloud-managed-admin/get-started-with-prisma-access/license-and-activate-prisma-access.html   There is not really much of topology for cloud managed user access model. You set up connection from prisma cloud to to office location and all your remote users connect to the Prisma Cloud Gateways. Again explained in the admin docs:  https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-cloud-managed-admin/get-started-with-prisma-access/prisma-access.html   You should really contact your local Palo Alto support team to clarify details about the support SLAs and product trials.    ... View more

@MandarKulkarni You can see routing related logs below:   > show log system direction equal backward subtype equal routing > less mp-log routed.log   You can also view the packet exchange by enabling debug capture:   > debug routing pcap bgp ....   ... View more

@rmikalauskas The point I was trying to make is that this is expected behaviour and not a fault. I agree it is misleading and is maybe you should raise it with you Palo Alto SE or Account manager.   ... View more

@rmikalauskas I also had the same issue and here is a detailed article explaining the reason for the discrepancies:    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5aCAC ... View more

@sbprietoc It is because you are using the "threat summary" for base of the reports. Panorama tries to aggregate the data at 15 min intervals and  you get unpredicatble results. If you use the actual "Threat" database then the "run now" should be identical to the scheduled.    "The firewall aggregates the detailed logs at 15-minute intervals. To enable faster response time when generating reports, the firewall condenses the data" https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/view-and-manage-reports/custom-reports.html         ... View more

@MP18 I think that this means that firewall was not able to decrypt the session, for example if unsupported cypher. It is configurable, but by default the traffic will be passed normally and the users will not have any issues, it will just bypass the decryption policy.  ... View more

@FarzanaMustafaAre you using SSL Decrytpion. I think that safe search will only work if you are decrypting the traffic.  ... View more