Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About shawnhafen
About shawnhafen
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
yesterday
16Posts
3Likes
2Solutions
Jul 08, 2020Last Visited
User
Activity
User
Profile
Latest posts by shawnhafen
| Subject | Views | Posted |
|---|---|---|
| 85 | yesterday | |
| 205 | 2 weeks ago | |
| 382 | 2 weeks ago | |
| 211 | 2 weeks ago | |
| 138 | 2 weeks ago |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 2 weeks ago | |
| 1 | 05-29-2020 09:54 AM | |
| 1 | 05-24-2019 01:44 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 7 | |||
| 2 | |||
| 17 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 05-20-2018 12:57 PM |
| Date Last Visited | yesterday |
| Total Messages Posted | 47 |
| Total Likes Received | 3 |
yesterday
If this is only happening over the VPN then this is a known issue and is also a Microsoft issue that impacts any and all/other VPN clients. This is fixable with some GPO changes, we made these changes (did not require a reboot) and everything worked with the app store 100% of the time immediately. I do not have the original post link that I found the fix on but I *think* this is the same fix here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNL5CAO
... View more
2 weeks ago
Here to echo what @OtakarKlier said. We use the same shoretel/mitel phones and the zone they are in does not get decrypted. To take it a bit further you can use NAC to make sure only phones are on that vLAN too.
... View more
2 weeks ago
If you are using the app-id/layer 7 in the policy then recommend using "Application default" for the service. You should not have to specify ports unless they are non-standard for the application in question.
... View more
2 weeks ago
1 Kudo
Can you provide some details about the policy? Sounds like you have a special character or a space in a field that does not support them Example:
... View more
2 weeks ago
This is a known issue with the COMODO (now Sectigo) and some RSA certs Details and work-arounds can be found here: https://live.paloaltonetworks.com/t5/general-topics/sectigo-ca-chain-decryption-issues/td-p/330802 Also, I think this may be a "fix" in the latest PANOS: PAN-148068 PAN-148068 Fixed an issue where SSL connections were blocked if you enabled decryption with the option to block sessions that have expired certificates. This issue included servers that sent an expired AddTrust certificate authority (CA) in the certificate chain.
... View more
06-07-2020
11:26 AM
This solution seemed to do the trick for me on the 220, will try this on the 5050s as well. thanks!
... View more
05-29-2020
10:05 AM
Not sure what those look like as I am not experiencing low disk issues atm but if you cannot set up a filter on anything in the logs (like this) Then maybe you can set up an email alert in your SNMP monitoring solution (if you do not have one then you can get a free version of PRTG, or use LibreNMS which is free and supports PAN devices very well)
... View more
05-29-2020
09:57 AM
There is still no way to remove the file manually however as stated previously it will auto remove the file when you generate a new one. It will also auto delete if the disk space gets low, in fact I have seen (on 7.x) low disk space cause issues generating a new tech support file because it filled up the space before it was done and then deleted itself 😄 If you are concerned about disk space you can clear some pcaps and old logs/reports from the CLI, there are several support docs and posts with more details like https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS
... View more
05-29-2020
09:54 AM
1 Kudo
As @kiwi mentioned client-less is preferable but if you really want to cover all your bases you can also deploy the GP agent to each machine which will aid with user-id and can be configured to recognize it is on the enterprise LAN so it does not attempt a VPN connection when on the "Home/corp" network
... View more
05-29-2020
09:51 AM
You have a few options here: custom URL category for these URLs block FQDN objects in the destination Add very clear notes to the URL re-categorization request and hope whoever is working it reads them FWIW: I have always had great luck with re-categorization requests, sometimes you have to explain in the notes that there is something behind the login or there is a redirect etc
... View more
05-29-2020
09:48 AM
A while back I went down this same path, it is a very loose control and does require a lot of attention because something like a shopping season, COVID stimulus checks, or other events may cause spikes in traffic that you dont want to drop. Here are some places to look for evaluating your CPS over time: https://github.com/zepryspet/GoPAN https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense/take-baseline-cps-measurements-for-setting-flood-thresholds/how-to-measure-cps.html#id2f43d329-3860-4689-a2e4-b7d19ded7966 Good luck!
... View more
05-29-2020
09:42 AM
I will chime in and say I have not seen this issue on our 5050s, 3060s, 200s, or 220s SNMP is coming from PRTG and some from LibreNMS so far so good on 8.1.x and 9.1.x PANOS versions. Suggestions (you may have already done this): * check the mgmt interface settings to make sure the SNMP traffic is coming from an allowed source * check security policies * check community string
... View more
05-29-2020
09:37 AM
You can do that, however I would recommend scoping the policies down as much as you can. We also migrated from CP and ended up with some pretty silly policies that had to be tuned. each column in the policy is going to strengthen your security stance so the more the merrier I say! instead of using any any in the zones I would recommend putting each zone that needs that traffic in there, this will also prevent you from unintentionally allowing any zones that are added later you may not want to allow for said policies.
... View more
05-29-2020
09:33 AM
This can be done, there are limitations but for the most part you can tune and configure this using the following steps to start: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGjCAK
... View more
05-29-2020
09:31 AM
You can't really alter the logs so read-only is what enabling them would be. Keep in mind, depending on the logs being viewed and what you are doing for SSL inspection you may have to consider those that have this access and if you want them potentially seeing the decrypted information
... View more
05-24-2019
01:44 PM
1 Kudo
It sounds to me like you are manually installing a version of GP on the endpoint when an older version is marked as the active one on the firewall. Make sure your version that is makred as the active is the same one you want to install on the endpoints. You are likely also configured to update from the firewall so when the client connects it is checking the active version and wants to upgrade or downgrade to that version
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
Latest Tags
No tags yet
Latest Blogs
Copyright 2007 - 2020 - Palo Alto Networks
