About sylvia

List of trusted root CAs is updated with PANOS not with dynamic updates. ... View more

I dont know if im right on this but I can imagine that session owner is the statetable itself which even in A/A configurations actually is working like A/P. That is one of the boxes owns the session but mirror this to the other box (in case of failure). While session setup is the physical box which the packet actually arrived to (which we dont know which box it will be in A/A setup). That is if box1 is session owner (mirroring to box2) and a packet that arrives to box1 is then processed by the session owner (who happens to be at box1) and then forwarded if policy matches. If a packet arrives to box2 this box will forward this to box1 to notify the session owner (and setup a session) but then it will forward the packet on its own once the session is setup and it has a "cache" of it in its own memory. Or if its the other way around (session setup is the statetable while session owner is which physical box the packet arrived to) :smileysilly: Because of this session owner and session setup is two different processes? ... View more

Page 2 at http://media.paloaltonetworks.com/documents/App_ID_tech.pdf have a brief description on whats going on inside a PA device when a packet arrives. I have seen numbers of 14 and up to 20 packets being mentioned before final decision that a flow is unknown, but I dont know if these figures are true or not. However it can go faster to decide that a session is unknown. For example: CS: SYN SC: SYN+ACK CS: ACK CS: "a b c\n\n" SC: HTTP ERROR 400/Bad Request = unknown (if im not mistaken). In the above case there was only needed 2 packets (or 1 packet in each direction if we exclude the initial handshake) before the flow isnt recognised as any known application and because of that classified as unknown. There are other cases aswell. For example if you start a session like DNS but in the middle start to do other things then the DNS decoder will not recognise the traffic and because of that switch the flow out of the DNS decoder and identify it as unknown. When next packet arrives the PA unit can take a new decision what kind of traffic is passing through (so you in the log can see how a single session hops between identified applications). ... View more

Hi, I mean we cannot automatically assign bandwidth per src IP "automatically". Some QoS product can allocate bandwidth fairly to each source IP automatically as kind of subscriber management, which PA does not support. Yes you are right that we can allocate it explicitly in the policy and that is what I mean 🙂 Regards, Jones ... View more

Yes. This is a good workaround 🙂 If you are going to limit the total session that the firewall can handle, it is impossible. But you can create two Vsys (you need additional Vsys license unless you are using PA4000 or PA5000 series) and use resource allocation to limit how many sessions each Vsys can have in total. So creative! Jones ... View more