About ssharma

A quick check on brightcloud reveals the site to be less than a month old. And since spyware is picking up the url, that means this url might possibly be involved in malicious activity. You need to find why source 192.168.0.1 is trying to resolve the url. Was that done on purpose or some application are trying to resolve it. Most the sites that are relatively new would be up for short time and then vanish after the purpose is fulfilled. That host in question might be compromised as well. Hope this helps.   ... View more

Hi, Selective deletion is not possible as of yet. You have to either clear all logs. Or logs will automatically purge old logs once the capacity of the storage is reached. Hope this helps. Thank you. ... View more

Authd process is handled by management server. Could you restart the management-server on the device, this will not affect the dataplane traffic. If restarting still does not help, then I will suggest opening a case with palo alto. >debug software restart management-server Let me know if that helps. Thank you. ... View more

You can expect to see following pcap during the negotiation : VPN peers will negotiate between configured proposal and match on what is configured on both sides. This is done for both phase 1 and phase 2 respectively. Once you capture the packet, you can expand ISAKMP packets to view each parameters. To view which specific packets are exchanged you can google ipsec phase 1 and phase 2 packets there should be enough information for you. Hope this helps. Thank you. ... View more

Hi Ken, Create a test user name test, enable the user commit the changes. Then go to security policy and under user, search for test. Please attach the snap shot like I have done. Thank you. ... View more

Hi Ken, On the drop down list for the source user, you should also be able to see local users. If that is not populating make sure you have committed the configuration and also try to search for the local user in question. Thank you. Hope this helps. ... View more

Hi COS, Following document might help you. Custom Response Pages Support for Non-ANSI Character Languages Thank you. ... View more

Hi KP, Yes you can do that using both API and as a syslog receiver if cloudware is capable of doing that. Following document might help you : How to Add User-IP Mapping to Firewall using API on PAN-OS 5.0 How to Configure a Custom Syslog Sender and Test User Mappings Hope this helps. Thank you. ... View more

If issue occurred after upgrading to 6.0 then I would definitely check the common name of the certificate used for global protect (see if that is ip or fqdn) and the configuration under Portal's Client config. It must match what we have on certificate. If certificate has a common name abc.company.com then under external gateway setting we should configure abc.company.com (and not its public ip say 1.1.1.1). Hope this helps. Thank you. ... View more

Hi, Other interface is like an secondary interface that you can make use of if you are using 6.1.0 and above. This is used to send other syslog messages if you are forwarding them from Panorama. This is useful in a situation where there are significant load for the single management interface. This is an optional configuration. It is combination of both. Primary and Secondary describes the priority and Active-Passive defines there current role. To make any changes to firewall from Panorama, Panorama in question needs to be active mode. Unlike regular active passive, you will see prompt admin@M-100 (primary-active)> Hope this helps. Thank you. ... View more

For 3rd Party CA, it will allow you to do that. That option would be greyed out. For self sign CA, you will need to follow following steps : Under Device -> Certificate Management -> Certificates click Generate Certificate, give it appropriate Name and common Name then click on Certificate Authority Click OK. Once the certificate is created, you should see both CA and Key option checked. Verify that is the case. Then click on certificate, you should have Both Forward Trust and Forward Untrust option to check. Hope this helps. Thank you. ... View more

HI awarsame , You will need ssl decryption on the device to allow or deny specific child application of parent application (facebook in this case). Hope this helps. Thank you. ... View more

Hi Satish, I don't think that is possible with current design. Unless you can verify if the URL you navigate to for both personal and official are unique. If that is the case the case then you can configure ssl decryption on device and allow or deny specific URLs. Which I think is highly unlikely. Hope this helps. Thank you. ... View more

That alone should not be alarming. Devices can use of memory and release them when not in use. You will have to look into other factors such as free, %wa, swap memory usage and also other process such as mgmtsrve, devsrvr etc. top - 07:42:33 up 30 days, 19:01,  1 user,  load average: 0.18, 0.18, 0.11 Tasks: 113 total,   2 running, 111 sleeping,   0 stopped,   0 zombie Cpu(s):  2.0%us,  4.8%sy,  0.7%ni, 91.2%id,  0.1%wa,  0.0%hi,  1.1%si,  0.0%st Mem:   4057060k total,  3882756k used,   174304k free,    38372k buffers Swap:  2008084k total,     4888k used,  2003196k free,  2598764k cached ... View more

Hi Diego, There can be number of reason why the failover occurred. System logs around the time of failover from both device would be a good place to start. To look for memory consumption you can look for "> less mp-log mp-monitor.log" and navigate through --top output, there you will see difference processes with different levels of cpu and memory consumption. But these kind of issues, I will suggest you opening a support case. Hope this helps. Thank you. ... View more