About MarcoLeckel

Boot into Maintenace Mode and do a Factory Reset. This will delete much more than "request system private-data-reset" including old PanOS / App / Threat Version and possible big Log Files with unsuccessful Login attempts. Most of the time , this way will be the fastest to get the Device running. Else you can open a support Case and go to root shell to find the big Files. Regards Marco ... View more

If you don't care about the old Logs and old Firewall backups, you can just setup a new Panorama instance with bigger Harddrive and import your config Backup. Regards Marco ... View more

Hi, this Document will help you Configuring RAID and disk backup on PA-5000 series Upgrade procedure from 120 to 240 is included Regards Marco ... View more

Or Option C (like any other Firewall): Allow any Application on Port 80 PAN make the decision at the first TCP SYN Packet when Traffic comes on Port 80 and allow any Traffic on Port 80 😉 ..... yes i'm kidding sorry ... View more

Hi The new CNSE Version is just 3 days old, give it some time for a study guide. But i am pretty sure the the old Study guide will be good enough. Just take an additional look into the Release Notes for the new features and configure some setups with Pan OS 6.1. Regards Marco ... View more

Hi, just to correct the previous Statement from the other Threat: ### "For POP3/IMAP, the only action the firewall will ever take is “alert”. The device will never block or drop for these protocols, even if you configure an action of “block”." ### --> This is not correct. If you set "block" Action the PA will terminate (Reset) a Session is a Virus is found in Pop3/IMAP. Be aware that you will not be able to get any new Mail from this Server until you delete the Virus on Server Site. (Because everytime your Client requests new Mails your whole Session to the Server will be reset, not only the one with the Virus in it) Regards Marco ... View more

Hi, we don't need to imagine that. root Access is limited to Paloalto support. There is no need for a customer to switch to root. This is even not needed in most of the Support Cases. If you still believe that you need root , please contact your Paloalto Sales Engineer. Regards Marco ... View more

Hi, root Access is a one time Password through Challenge/response method. I am pretty sure that NO Customer will get the response generator. 😉 Even the Authorized Service Center don't get it. Regards Marco ... View more

Website Admin can select if User can save their Password. It is a common Feature for Security Website like financial Services. Although there is a very good reason NOT to save passwords for Security Products there is a workaround for Firefox & Chrome. Once the Password is saved in the Firefox Database , it will be used every time you visit the Website. All you have to do is to ignore the "do not save" flag 😉 The goal is to get the Password in the Firefox Database. -> Visit the Login Page, enter your credentials -> Do NOT press Login -> rightclick the Website and select "Search Element (Q)" (i don't know really what it is in english, in my German browser it is "Element untersuchen (Q)" -> find "autocomplete="off" and replace it with autocomplete="on" -> press login and you will get the normal Question if you would like to save your password. This works for all websites that won't let you save your password. This is NOT a Bug in Paloalto but a security Feature. Regards Marco ... View more

You can simulate a Packet with: > test nat-policy-match ......... Regards Marco ... View more

Suspend one HA Node. shutdown the Firewall Clone the Device -> and boot up the cloned Device this way your Eval License will get invalid and you are able to register it with your Auth code. Make the Device functional again. Trigger a failover (suspend the other Node) Do the same like above. This way you will have almost no interruptions. Keep in mind that the VM Firewalls only support HA Lite which means you have no session sync (HA2 Link) and all sessions must start new after a failover. Regards Marco ... View more

No Volume Quotas are not supported yet. You'll need to raise a Feature Request with your SE Regards Marco ... View more

As said before, User-Agent in HTTP Header is the only practical way to identify XP. Be aware that the User Agent may be faked. By the way: May be it is better to use Custom Vulnerability instead of Custom App. This way you can identify the "Threat" XP 😉 If you use Custom App you will overwrite the whole App-Engine which means all http Traffic will be identified as XP instead of facebook,google,youtube ...... Custom App and Custom Vulnerability work the same way when you define your own Signatures. Regards Marco (edit) There is already a sample in Dev Forum Custom vulnerability signature for identifying Windows XP clients ... View more

IE & Chrome use the Windows certificate store Firefox has its own You need to export your decryption root CA (the one you marked as Forward Trust Certificate) and import it to the Firefox Trusted Root CA Store. Regards Marco ... View more

we ran into the same Problem. A Bugfix is sheduled for 3.1.8 Regards Marco ... View more