About SMF

Thanks SMF. I didnt knew I can add FQDN as destination. To add that I had to create an object, thats where it gives the option of FQDN, and then added that object as destination. Now I am able to check the updates, however downloading the updates is being denied. I assume the IP of which is not covered under the update URL. Can you help in what subnet /URL should I include to get the download working as well. I have allowed SSL applicaion in the policy. Regards ... View more

I'd love to help figure this out (I like the challenge...) but I don't have an old school modem and POTS line to try connecting to a lab PA unfortunately. It "feels" like a pinout thing... like the modem's pinout and the PA's pinout aren't 'lining up right' for whatever reason, but it's really hard to narrow down why ... View more

There are some configuration-settings which can be configured from operational mode and therefore not resides in the configuration-file. For example you can configure "tcp-non-syn-check" in following two ways: 1. set session tcp-reject-non-syn <yes|no>  -> active but not in the config-file.... 2. config set deviceconfig setting session tcp-reject-non-syn < yes|no> commit  ->   active an in the config-file... As far as I know the only way to configure the bypass-exceed-oo-queue is the following: config set deviceconfig setting tcp bypass-exceed-oo-queue < yes|no> commit Though this setting should had definitely resided in the config-file....is the setting really not available under deviceconfig-stanza in the exported config-file..? If no indeed a very odd behaviour. Any statements from PAN-support yet? Regarding the gerneral PAN tcp handling the following document is maybe helpful for you: https://live.paloaltonetworks.com/docs/DOC-1731 CU ... View more

Its possible to put the management interface on the outside network or on the Internet. The usual considerations apply - expose only the minimum footprint- only allow the traffic that needs to see it. In this case don't set it to respond to ICMP, only use encrypted protocols (SSL, SSH, etc.), and if at all possible limit the addresses that can login via the permitted IP list. ... View more

Normally, this is an Outlook 2013 issue and is also present in Outlook 2010 to a (usually) lesser extent. If there is a policy (Active directory or Exchange) that prohibits the saving of passwords the password won't be saved despite the fact that the option is still selectable. Microsoft has indicated that its the behavior of the interface. When you change connections from the internal network to the external network Outlook sees that as a new connection (even if its to the same Exchange server from the same workstation with the same user ID) and will prompt you again for the password if that policy is set. ... View more

I had downloaded 4.0 already on both boxes but with not seeing your reason for pulling it I installed (my bad) and saw that the 4.0 box would not come online.  Talked to tech support and found the reason for the pull.  Dont install if you have already download it. ... View more

There is workaround - not SSL VPN, but IPsec to GP. It is possible to establish VPN IPsec to GP from Linux. We have used Ubuntu with vpnc (and additionaly GUI network-manager-vpnc). From Linux side you should use "Compatible with Cisco VPN" option. Form GP side (soft ver 4.1.6): GlobalProtect-> Gateway -> General Tunnel Mode -> Enable IPsec option on and Enable X-auth option on -> Group Name and password Skip Auth on IKE Rekey option on GlobalProtect - >Portal -> Client conf -> General Third party vpn client -> add cisco systems vpn adapter ... View more