About mderksen

mderksen · ‎04-30-2012

Hi Rob, Yes with version 4.1 you able to use the URL filter category as one of the criteria to setup QoS on those categories. You can use the predefined categories or create your own URL categories to address QoS. You can do this by setting up the QoS and include the categories you want and then assign a class to it. Marcel

mderksen · ‎12-13-2011

Hi Scot, Can you check the SNMP version you are using? SNMPv2 and SNMPv3 are supported from version 4.1 Marcle

mderksen · ‎09-20-2011

Hi, The CLI is a closed CLI. So that means there is no access to bash shell or anything like that. Marcel

mderksen · ‎08-29-2011

Sounds like you have to take a look at the traffic flow. Incomplete or insufficient data mostly means that you only see one part of the traffic. Can it be that you have two routes in and out of the network? Marcel

mderksen · ‎08-08-2011

Hi, If this happens to operational units I would suggest you open a case with support to have them investigate this issue. Marcel

mderksen · ‎07-14-2011

Hi Paul, we are not able to detect the User-agent string. What you can do is make a definition to search for specific user-agents. See this post: https://live.paloaltonetworks.com/docs/DOC-1503 Marcel

mderksen · ‎06-08-2011

Looks like it is using silverlight to do the filetransfer. I would suggest to create a case and see if we can inspect the silverlight file transfers. We might be able to detect the silverlight upload and create something for this. Marcel

mderksen · ‎06-08-2011

Most of the hotmail file downloads happen via SSL. You can check the application in the traffic log. If you want to inspect the hotmail part you need to enable ssl inspection. Also if hotmail is using a java enabled up and download this can keep the scanning from working. Marcel

mderksen · ‎05-19-2011

Hi, I have not seen this messenger in action but I suggest you submit a request to add this to our application recogniztion. Please use the link http://www.paloaltonetworks.com/researchcenter/submit-an-application/ to submit the request. The application team will then take a look at the application to investigate it. You might also get in contact with your local reseller or SE who might be able to help you in between. Marcel.

mderksen · ‎05-11-2011

Hi Marcus, It is not possible to get the unencrypted traffic out of the box. To be able to decrypt SSL you need the certificate to be able to do this. Since you want to look inside I assume that you have the certificate. What you can do is capture the SSL traffic and use this trace and wireshark to decrypt it. For more info I found this site: http://support.citrix.com/article/CTX116557 Marcel

mderksen · ‎04-21-2011

Hi, This is not possible with the webgui. The only way you can modify and import the configuration from the webgui is the export and import function in the device tab. What you might try is the CLI. Within the CLI set the output format to set (set cli config-output-format set) and then go into the configure mode. When you do an 'show rulebase' it will show you the rulebase in a readable format. Marcel

mderksen · ‎04-20-2011

Hi Justin, This is implemented in version 4.0. In the security rule you have the option to use the regions as an object and you are also able to create your own regions. Marcel

mderksen · ‎04-07-2011

From your text I would say the configuration should look like: NAT: Source Zone; Guestnetwork, Destination Zone; External, Destination; 89.248.148.200, trans dest; 172.16.0.10 Security: Source Zone; Guestnetwork, Destination Zone; Internal, Source IP; guest subnet, Dest IP; 89.248.148.200 But indeed a snapshot from what you configured could help. Marcel

mderksen · ‎04-06-2011

Hi, When you select the context of the unit in Panorama and click on the unused rule you will see which have not been hit since the moment you rebooted the unit. Marcel

mderksen · ‎04-05-2011

Hi, The options shows you the unused since the last restart of the system. So you need to have it pass traffic and execute rules before you can see which rules are used or not. Marcel

mderksen · ‎03-17-2011

You can look at the session table with the command from the CLI or (if you have) via the option in the monitor and use the session browser. From the CLI use the command 'show session all' and use the filter command to make it useful. Marcel

mderksen · ‎03-17-2011

Hi Matt, The way to configure this is to configure NAT rules in your policies tab. Just configure a rule per NAT that you stated and set the destination addressing. I assume that you have an interface in the specified subnet on your external interface. That should do the trick. Then make sure your security policies allow the incoming traffic. Marcel.

mderksen · ‎03-17-2011

Hi, Two remarks: - From the first picture you send it seems that you did not set the timers. This means that the default timers will apply. If you want to set your own timers please configure them in the application. If you want the session to not time out set the timeout to zero (0). - If you want to prove the Palo Alto Networks is not the problem then if the session is killed see if the session is still in the session table of the Palo Alto Networks. This might prove easily (before taking any captures) that the session is still active. Marcel

mderksen · ‎03-02-2011

That is correct. At this point when you export the custom report from the Webgui the ip-address is not resolved (since this is an action that is done in the webgui). You can schedule the report to run at a certain time. That report will include the resolved names. Marcel

mderksen · ‎03-02-2011

Have you seen this one: https://live.paloaltonetworks.com/docs/DOC-1166 Marcel

mderksen · ‎02-23-2011

Hi, The clone function can only be used with Custom Applications. If you want to clone oracle create a custom app with the criteria you want/have and give it a custom name. Marcel

mderksen · ‎02-10-2011

That is correct. You will put the trust and untrust zones in the policies and put any in the other field and allow the traffic. That way you will see all the applications. If you also want to have visibility on the threats etc you can create a vulnerabilty, antivirus, spyware and URL profile with the action on Alert and add those profiles to the policy rules. That way you can also see what happens on that part. Marcel

mderksen · ‎02-10-2011

The risk factor itself is not a hard figure in the sense that less or more than 4.0 is good or bad. The trend is more important. You can disable the logging of the rules but that will reduce your visibility. If you think the risk factor of the Bittorrent (and maybe other) application is to high you can also override the risk factor within the application definition under the object tab. That way it will influence the risk factor but you will keep your visibility. Marcel

mderksen · ‎02-01-2011

Hi, as stated in the earlier reply there is not a function to block file on size. There is on the other hand a document that descirbes how you can control download of movies based on size. This might lead you in the direction you want with the custom signatures. You can find the document at: https://live.paloaltonetworks.com/docs/DOC-1590 Marcel

mderksen · ‎01-31-2011

You can build different rules based on the destination address but limit the connections per src-ip. It would be a rule based configuration like you have at the moment for the security rules, nat rules etc.

mderksen · ‎01-31-2011

Hi, The policy will be based on the check on the number of connections per source IP. So you do not need to know the source IP but you can say each source IP cannot have more then x amount of connections. What you also can check is the sessions that are active. If you reach the limit of session you might want to decrease the timeout on DNS for example. This can lead to a fewer number of active connections. Marcel

mderksen · ‎01-17-2011

No, in virtual wire you do not have to enable this as virtual wire transport the data between the two physical ports. Marcel

mderksen · ‎12-20-2010

With the clear command you can wipe information from the system. Try the clear log command to clear the information in the ACC and log files. Marcel

mderksen · ‎12-15-2010

Hi Wasim, When looking at the Nymgo application and the configuration they use two domains to connect to. For the proxy they use stun.nymgo.com on port 80 and for SIP they use ata.nymgo.com on UDP/5060. When you are using the Palo Alto Networks firewall you will see the SIP traffic from nymgo being reported as SIP in the logging. There are a couple of ways to block this traffic: - Block outgoing traffic on the ip-addresses for stun.nymgo.com and ata.nymgo.com on TCP/80 and UDP/5060 (old fashion way, we still support that ). This requires to check the ip-addresses behind the two domain. This will be solved in the version 4.0 when we will support FQDN-objects. - Block SIP traffic to the ata.nymgo.com objects and see the logging for the type of traffic going to port 80 on stun.nymgo.com and block that as well - Define an application override for UDP/5060 and TCP/80 traffic going to the two domains and classify that as a new application nymgo. Then block this application in the security policy. Hope this helps to move forward. Marcel

mderksen · ‎11-26-2010

Hi, First question would be what version you are running. In older version (not sure by heart which ones) the PDF-reports were not deleted when performing an private-data-reset. If you run the latest version 3.1.x please report this to support. To remove the reports at this moment you can use the 'delete report' command on the CLI and select the report(s) you want to delete. Marcel

Date Registered	‎08-03-2009 07:45 PM
Date Last Visited	‎08-18-2015 09:06 AM
Total Messages Posted	91
Total Likes Received	15

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

Strata

Prisma

Cortex

About mderksen