About Sanssj

In an event of failure of this stand alone deployed Panorama box (log collection and device management) from where will the firewall gets the the templates(Networ & device settings) information since I dont see this information in the local Firewall device config file. is it ideal to manage the devices settings (HA, Admin roles, Authenction profiles,server profiles etc) via Panorama in a stand alone deployment or is it ideal to have them configured locally on the device. In the same scenario as mentioned above how do we remove the override cog wheel on the local FW device if you decide to manage everthing from Panorama. one way i could think of is " force the template values" (only when there are like to like values on the Template and on the local device) is there any other way.  ... View more

I had created a custom URL category (for specific tiny url let say *.tinyurl.com/) & in the url filtering profile I had opted for option to continue for this custom url category to make user acknowledge the action & log the event. but the caveat here is I see the user being going to the palo alto continue page but sometimes he can seamlessly go to the website without the pan conitue page. Also i see sometime see a chrome/firefox page saying i had even enabled ssl decrytption to for the user so that user gets conitnue page even if its http/https.(is this step needed?) but having the same issue. ... View more

What is the level of toughness that we have in real exam than what we see in practice test on a scale of 1-5. Is there any good pcnse practice tests that match the level of real exam. The only source of my prep is just the pcnse study guide is there any book that is recommended. Thx. ... View more

    We are using  windows user-id agent for parsing the user and user group mapping info. often i see in the logs that the user is being not recognized and hitting the deny rule.  after couple of minutes it starts recognizing the user and allows the traffic i am skeptical what could be the reason for this disparity.  why would any user info and user group mapping info go stale.  on a different note given the limitation of 10000 user group limitation on PAN what would be best go to approach to overcome this shortage. Thanks      ... View more

Is there any specific counter  to tell if traffic is being dropped during high-dataplane utilization ~100%. The show counter interface <interface> specifies dropped packets & packets dropped due to flow state checks. but will there be any slighest chance that we are dropping traffic because the chip buffers are under severe load. ... View more

I see a lot of non- syn-tcp from from few specific zone. I am sure that there is no asymmetric routing. If that has to be the case how to determine exact causing factor. Thanks ... View more

Hi guys, How can we creat a prototype miner in the MInemeld hosted by autofocus, is there any tech document with regards to how to customize/config a prototype for Miner. Thanks  ... View more

Hi, I would like to know the way it operates in the backend how palo alto does the SSL decryption in Vwire mode . As in a L3 deployment the connection will terminate on the firewall and firewall acts like a MITM and does the SSL Proxying. How is the case in Vwire Deployment. Thanks ... View more

Can any one confirm that when we configured log collector group with two managed log collector (both active and passive Panorama's) and if see the logging status on the firewalls does it show only the Active Log collector or both Active and Passive log collector. thanks ... View more

While moving from a service based to application based policy approach how to tackle the dependent applications for the specific application. for instance consider a app "webex-base" which is dependent on apps" rtcp, rtp-base, ssl, stun, web-browsing ". "Webex-base" has a standard-port  tcp/443,80,1270, udp/8070,8090,9000. when i see the logs it shows that when the session is occuring only these applications are being seen webex-base(on 443 (one of the stadard ports no confilt) ),stun-9000( which is one of the standard ports of the webex base and stun uses tcp/3478, udp/3478 as standard ports) so does that implies that depedent applications use standard -port range of the webex-base application? so, application field =webex-base, services filed =application-default in the rule for webex-traffic. now how do we address dependent applications so that we can keep track of these non-conventional apps? do we need to provide additional rules to provision it for the app to work properly without break?  Thanks, ... View more

Is it recommended to configure Panoram HA passive (m-series appliance) device as a managed collector (default log collector) on the Panorama active device. My perception is by doing so we eliminate the time to sync the logs between the HA devices when we switched their roles. I know this does reduce the logging rate and put extra burden on the Management plane. Is there anything else that needs to be taken into consideration in this case. Thanks, ... View more

Can we send decrypt traffic to more than one decrypt mirror port.whats the limitaions of using a mirror port. Does it functionality is limited if the fw is in vwire mode. Also is there a way that in decryption broker deployment model the fw doesn't have to wait for the local 3rd party security appliance to give their verdict. So that the fw can reencrypt the traffic without latency. Thx ... View more