About ChanceMaggard

Thank You! ... View more

Hello, Perhaps you can get a temporary acceptation and disable the password history requirement while you sync the passwords? Another way would be to use ldap or radius auth? Or choose a super strong passwword and apply that to the different firewalls? I'm a fan of having different admin account passwords for each firewall, then I use radius and use a domain account for everyday use.   Regards, ... View more

So reaper in that case if SSL Decryption is enabled which is identifying web-browsing over 443, I have to  allow this behaviour in security policy & I don't think it is a best solution.    For e.g. I am allowing & decrypting a sports category  website which is showing decrypted  but sesion allowed over port 443 for web-browsing due to loose policy allowing any app over port 80/443. This in not ideal solution with Decryption tured ON.    ... View more

the default IO priority for class4 is medium   ... View more

Rumours says (at least the ones I have heard :P) that PANOS 5.0 will somewhat address this dependency jungle out there so you wont need to open up more than necessary. For example where you today must open web-browsing + facebook (which would allow basically any HTTP surfing which doesnt have its own appid) in a single rule you then will only need to open for just facebook. The PA would then allow a couple of web-browsing packets, enough to identify facebook and if its still not identified after a couple of packets it would deny the session. However if this is true or not or even involves the skype detection I dont know, hopefully someone from PAN can answer this? Otherwise I totally agree with you. One of (many) good things with using a PA box is the ability to block unknown traffic. But this will be spoiled if you are forced to allow unknown just to make detection of (for example) skype (among others) to work. But this whole appid stuff (no matter if its the one PAN uses or from some other vendor) is a bit sketchy - thats why you should NEVER allow "service:any" even if you use appid but set at least "service:application-default" or even better manually define which ports should be allowed. A simple test you can do on your own is if you allow web-browsing to any port for a server. Your "http-like" request can be "a b c" (that is a[space]b[space]c) followed with two enter strokes. This packet will bypass your PA and hit your server. Not until the server replies with "Error 400, Bad Request" the PA will know that "oh this was supposed to be web-browsing but doesnt look anything like it" and block the response from the server to reach the client (and at the same time drop the whole session). ... View more

lifenethealth wrote: I'm using a PA4020 and although this is the first PA device I've ever used, on 4.0.1, I've also noticed that it's almost painful to manage.  Even doing a commit, I walked to the restroom, got a cup of coffee, and when  I came back, it took a few more moments before it completed. I realize, at least I've been told, that the management sluggishness is not related to the actual traffic and processing of security rules.  That's a umm, good thing, because it it wasn't, we would have definately returned these boxes immediately.  Thankfully my immediate manager doesn't have to deal with the sluggish behavior or I wouldn't be using them now... I find not a whole lot of difference between a commit on a PA2050 and my old Checkpoint cluster. It depends how many changes you make at once - the more changes, the longer it takes - but remember, the PAN is pre-processing the commit to confirm it complies and doesn;t break anything, *and* keeping the dataplane running while it activates the changes. Having said all that, they're definitely not as fast as, say, a PIX or ASA o save a config - but then again, the PA devices work a whole lot better. 🙂 ... View more

You can upgrade directly from 3.1.x to any other 3.1.x software release. This means that an upgrade from 3.1.3 to 3.1.7 is valid. Upgrades are full between any two minor versions on the 3.x.x software families. You can safely delete the old software versions at your discretion. The caveat being that you would have to re-download the software if you ever needed to rollback to a version that you delete. ... View more

Sync-to-peer is intended for use when the HA secondary has no path to the internet from the management interface. In this scenario the secondary will need to have the primary push the dynamic updates to it. (remember that your secondary may have no active interfaces on the dataplane in the passive mode). If both units have the ability to access the PA update servers from their management interface we suggest that you stagger the download and install times and not use the sync-to-peer feature. This way you have the opportunity to failover to the passive unit if there is a problem on the primary during the update or as a result of a problem that arises after the update. When you stagger the download-and-install times we suggest that you leave at least 30 minutes between HA pair members to allow the update to download and install before the process begins on the peer. -Benjamin ... View more