About epeeler

Hi All,   I'm trying to determine if this is possible.   We are blocking abc.company.com via an entry in a custom url category which is applied to the internet policy via a URL filtering profile.   I need to allow abc.company.com/specificpath while still blocking all other paths.    Nothing I've tried works. We have a whitelist rule above the main internet rule that we can put URLs in but I cannot get the firewall to match on the domain/path. Only on the domain.  So when I put the domain/path into the override rule, it doesn't match and continues on down to the main internet rule where it gets blocked.  Likewise, I have tried putting the domain/path into the override tab of the URL filtering profile directly and that doesn't work either.   Can the firewall match against domain/path or does only match against the domain and subdomain?   Thanks for any insight anyone might have.         ... View more

Hi everyone,    I'm trying to setup a route based IPSEC tunnel between my PAN 3020 and Cisco 2900 router.  I'm getting a parameter mismatch on on the ipsec lifesize parameter and don't know how to fix it.   The Cisco peer appears to be wanting a lifesize setting of 4608000KB but the PAN won't let you set it that high. I've tried setting it with the equivalent MB setting on the PAN but I'm still getting the mismatch.  Does anyone know how to change this setting on the Cisco side?  I can't seem to find the right command.   This is what I see on the PAN. I am not the admin for the Cisco router.   Any ideas?   2021-09-10 16:36:10.645 -0500 [PNTF]: { 2: }: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <==== ====> Initiated SA: <redacted>[500]-<redacted>[500] message id:0x4B3D3BCC <==== 2021-09-10 16:36:10.646 -0500 [PNTF]: { 2: 11}: simultaneous phase-2 rekey request detected, peer is not PANOS. delay processing this new request(isakmp message-id 0x4B3D3BCC). 2021-09-10 16:36:10.646 -0500 [PERR]: { : 11}: lifesize 4608000 KB 2021-09-10 16:36:10.646 -0500 [PERR]: { : 11}: not matched 2021-09-10 16:36:10.646 -0500 [PERR]: { : 11}: no suitable policy found. 2021-09-10 16:36:10.646 -0500 [ERR ]: { : 11}: failed to pre-process packet. 2021-09-10 16:36:10.703 -0500 [INFO]: { 2: }: IKE ISAKMP KEY_DELETE recvd: cookie:490a0356f9c07229:aaa5e1482371a0a4. 98%     ... View more

Hello,   Quick question for a specific URL (cia.toh.info)  This URL is classified as malware in PAN-DB but doesn't show ip in the AV release notes as a malware site so it doesn't get sinkholed when we do a DNS lookup for that url.  We've noticed other URLs exhibiting the same behavior.   Has anyone else seen this?  Is there a disconnect between the PAN-DB classification and the AV (sinkhole) database?   Thanks. ... View more

I've been asked to investigate Zone Protection on one of our PAN firewalls.  I'm trying to determine what safe values would be for me to begin with for syn, icmp, udp and other ip protection types.   Since this is a production firewall, I need to be certain I'm not going to generate any issues when the profile is applied.  Is there a way for me to determine if the default thresholds are a safe starting point for my particular situation?  Using show session info I can see that for the entire firewall, the Packet rate/s is peaking around 20K/s and the New connection est rate is peaking around 2500 cps.  These numbers are of course for the whole firewall and I would only be applying to  a single zone.   Are these numbers indicative that I would be safe with the default thresholds as a starting point?  Are there some other counters I should be looking at?  I've read the documentation and the tech notes for Zone protection but am still a little unclear on how to determine a starting point for the thresholds.   Thanks! ... View more