About reaper

try restarting the config daemon: > debug software restart process configd If that doesn't work you'll want to see if debug logging on both configd and managemnt-server provide any type of clue as to what is going on. you'll want to get a tech support file and get TAC involved ... View more

the service route is only used by the management interface of the firewall, it is used when the physical mgmt interface is located in an oob network that has no internet access   if you have  any any open in all directions and you can only reach IP addresses, there must be something wrong with how DNS is resolved   can you check which DNS server is on your clients what if you replace that with 1.1.1.1   in case your clients do dns lookups on your AD, can you see those connections in the firewall sessions and is there packets sent AND received ? set up wireshark on client and AD to see if both see all packets   then, do the same with AD and it's upstream DNS: do you see dns queries leave and come back? what if you set the upstream ('Forwarders') to 1.1.1.1 ... View more

you're going to want to ask that over at https://www.syslog-ng.com/ , they'll know what to do ... View more

if the fileserver supports a web frontend then it can be done Clientless vpn is basically a webproxy with a bunch of clickable links ... View more

for malware that is absolutely right; as long as you're not ssl decrypting you wont be able to detect and block malware inside ssl encrypted traffic and many malware are starting to abuse that shortcoming and using ssl as transport   for url filtering, it depends: main categories you'll be able to filter as the certificate and SNI can be 'read' to ascertain the URL and apply a category, but any 'multi category' sites that split up once you dive deeper into the website won't trigger the appropriate subcategories without ssl decryption     ... View more

do you happen to have multiple vsys or could these 'alert' ones be hitting a different rule altogether ?   ... View more

Ah ha @wzahri ! With 3 interfaces things get a little more complex 🙂   You'll want the dhcp relay on the LAN interface pointing to the AD   Rules From lan to dmz "all AD services (dns, smb, netbios, ....)" Allow From dmz to untrust dns/ntp/ms-updates allow From lan to untrust "web apps" allow From lan+dmz to untrust block log From lan+dmz interzone block log   ... View more

the 8.8.8.8 you show in the screenshot is only used by the management interface of the firewall itself. you do have a security policy that would allow dns coming from your network to go out to the internet did you add dns servers to your dhcp options so clients are issued with dns servers (your AD)? (and if the AD is being assigned, did you verify the AD has access to the internet?)             ... View more

if there's still an active support contract on it, you can get an RMA unit (support runs till end 2024)   if it's bricked, and you have no support, you could try a few things you'd try on any broken computer: see if the RAM and harddisk are seated properly, get a multimeter and see if the PSU is outputting some voltage. last ditch you could check ebay for a used pa-3k as a 'new' lab unit or for replacement parts ... View more

any idea if it was ever put into FIPS mode? (that could explain the console) have you let it sit for a while? a pa3020 could take a while to boot up, but if after 30 mins no additional lights have come up, the unit is most likely bricked   if your console is connected while booting, does anything appear? there could be a small window of opportunity where you could try to get into maintenance mode and try finding issues, reverting the OS, FSCK'ing the disks etc       ... View more

as long as they're both part of the same group there wont be an impact on the existing one you could consider creating 2 'device log forwarding' configurations ince you are placing the new collector in a different location:   the 'top' collector in the device log forwardig' will be the primary collector for all the firewalls in the same group if you create 2 groups, each containing all the collectors, but switching the 2 collectors's priority, and then adding firewalls for each location, they will log to the 'nearest' collector preferrably and remote if the local one is down   ... View more

there is a distinct diffeentce between vulnerability logs and url logs   an url log will always be severity informational, the action will depend on what the category action is set to, so might be alert (url allowed), block-ur, continue, ...   as you can see in the example below, there are 3 logs ssociated to a single session and all have a different severity and action   the traffic log in green is a simple allow rule, no severity. this is because the session was allowed intitially by the security policy the url filtering log in red is informational and alert, because url logs are always informational, and the url category was allowed in the url filtering profile the vulnerability profile in purple is critical and reset-both, because a vulnerability was found once the http connection started going and payload was transferred that contained something bad   ... View more