About Felixcao

the customer firewall pa3220,version :10.2.1, the mgt interface could not access internet,so that firewall could not upgrade the url database. but the system log dispaly some high log:url-cloud-connect-failure,the customer want don't see these log. first solution：delete the PAN_DB_URL_Filtering key Are  there any  good  other solutions？   ... View more

hello,  I have  a question ,  Can the GP solution solve the following scenarios The computer of terminal A has joined the domain (AD). one user  login to the terminal with domain account a, and then restricts the user to dial GP with account a instead of other accounts ? ... View more

Anybody know how to configure gre over ipsec ? from the 9.0,pa support gre tunnel and only one word describe about this feature. ( Optional ) Select   Add GRE Encapsulation   to enable GRE over IPSec. Add GRE encapsulation in cases where the remote endpoint requires traffic to be encapsulated within a GRE tunnel before IPSec encrypts the traffic. For example, some implementations require multicast traffic to be encapsulated before IPSec encrypts it. Add GRE Encapsulation when the GRE packet encapsulated in IPSec has the same source IP address and destination IP address as the encapsulating IPSec tunnel.   Has anyone done any specific this configuration? Can you give me a description of the configuration? Thank you ... View more

I read the relevant documents, but I don't quite understand them. I hope someone can confirm them for me. reference articale url :https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licenses/cortex-xdr-license-allocation.html. :After utilizing all available Pro licenses, Cortex XDR falls back to a Cortex XDR Prevent policy that protects the endpoint but does not include Pro-specific capabilities. When you exceed the permitted number of Pro agents, Cortex XDR displays a notification in the notification area. Cortex XDR permits a small grace over the permitted number but begins enforcing the number of agents after 14 days. If additional Pro agents are required, increase your Cortex XDR Pro per Endpoint license capacity.   If the customer purchases a pro license for 200 terminals, After the no:201 terminal is installed, it can be linked to the console, but only the prevent function. At the same time, after 14 days, if there is no add new license, the no:201 terminal will lose the link and lose the prevent function. Is this correct? ... View more

The customer has six devices, all of which have activated license. The customer wants to update the feature library through panorama, but finds that two of them do not see the license information on panorama. What do you suggest and how to troubleshoot? ... View more

I've had a computer recently that got flagged in the firewall with this virus. The virus name is :Win32.WGeneric.atarqw。 ,however when scanning the computer I can't find the virus. Virustotal also doesn't have anything on this virus when I search. Is this a false positive? Anyone else experience this in the firewall? i check it on threat vault on  pa threat db signature：Name: Virus/Win32.WGeneric.atarqw Unique Threat ID: 385182123 Create Time: 2020-11-11 01:44:29 (UTC) Hashes：d975571377349ae8b6184fe5c4fcfb908b9f9e0ceac8ccfce12b7678feaf54cd ... View more

 the customer want to test  pa wilfire  feature . my test step: 1: from http://wildfire.paloaltonetworks.com/publicapi/test/apk, download the sample malware.the traffice throught the pa 2: when we can find the  wildire log from firewall  and theck the log report ,know the  malware files sha256 ------------------------------------------------ log: 33, filename: wildfire-test-apk-file.apk processed 120151 seconds ago, action: upload success vsys_id: 1, session_id: 47055, transaction_id: 5 file_len: 1434514, flag: 0x801c, file type: apk threat id: 52108, user_id: 0, app_id: 109 from 192.168.5.31/50643 to 34.84.44.247/80 SHA256: 2751671b591b6969b09f8c032cd89e6ae83a5f3ec819c8b923c673a6286cbec3 ------------------------------------------------------------------------------------------------------------ 3:then wait 48 hours,we go to  threat db lookup the  sha256 value,but we don't find the sha256. so I think that  PA will not update malware signature to antiivirus  from sample malware files(http://wildfire.paloaltonetworks.com/publicapi/test/apk).is true  ?   ... View more