About BobW

I have seen this when a users home page defaults to https.  Just a thought. Bob ... View more

Thanks for your reply.  I use the non-reoccurring schedule option a lot.  I tend to forget to go back and remove the rules and schedules figure it might be nice to automate their removal. Bob ... View more

Thank you for the reply.  I guess my point is if streaming media is using encryption for all traffic, soon everyone will. Maybe a better example is:  Someone logs onto Google.com, then goes to youtube via the google apps link.  Unless I am missing something, the PA is seeing this traffic as SSL as the call to google is already encrypted. Bob ... View more

"Bob, good band-aids" Agreed.  As I say it seems to work 100% with Firefox and Chrome.  I truly believe it is an apple issue given it works different depending on the revision. Please keep us updated if you find a solid fix! Bob ... View more

Thank you for the reply. In my case, we are looking at going from 100 Mbps to 200 Mbps.  We are a K-12 school with 100+ boarding students. We have 800+ devices with lots of media streaming after hours.  The PA-500 handles 100Mbps very well with it's QOS, but I am concerned about the possibility of it handling 200Mbps with all of the options enabled AND it is roughly three years old. There is also something to be said about having the VM run on box  which is more redundant than a PA-500 (raid and dual power supply for example) and being able to restore a VM in case of hardware failure.  Not to mention,  I have a dual Xeon 2.9, quad core with 24 GB sitting around collecting dust. Bob ... View more

I contacted a VAR we use and asked them the same.  Their response is as follows.  I am still a bit stumped as I can not fathom how the throughput would be an issue if it was put on a piece of hardware with two Intel CPUs with quad  cores (or whatever) but here's what they said: Palo Alto states that the VM firewalls are not recommended for edge use.  Can you explain why?  If it is the only VM on an ESXi box, I can’t imagine how that would be less secure than a physical box.: Architecturally its just not going to deliver what PAN advertises – DoS, throughput are the two largest areas of concern – because everything is just virtualized on a intel CPU – no FPGA or math processor to offload the thinking of the box. – Also security concerns but if it’s the only thing on the box as you said its less of an issue. Complexity in the configuration is also a concern with uptimes of firewalls normally 5 9’s Do you have any clients running a PA virtualized?  Are they happy with it? Yes but all in test/dev environments nothing in production like suggested here Bob ... View more

We battle this one quite often.  Here are a couple thoughts: The apple devices, when they attach a wireless, automatically call the "success" page (randomdomain/library/test/success.html) on the apple domain.  The idea is nice, because it should autoopen the captive portal page as it tries it's http "success" page call  To get there it chooses from multiple domains.  There is quite a large list, some are shown here:  ios - ios7 and captive portals-changes to apple request URL - Stack Overflow. Having said that, I have found that even minor changes in the OS act differently.  (example not necessarily correct) IOS 6.01 works, 6.02 doesn't, 6.03 works sometimes etc. As I recall, the primary issue is related to Safari.  I had a case with Palo Alto where we did packet captures, etc and Safari would try to get out but would never get any packets back.  As I recall, we never did figure out why. Firefox and Chrome work without a problem. So what I ended up doing is Creating a rule to allow unknown user access to the apple subnet and the success page.  Effectively disabling the captive portal auto prompt. Made it clear to my users that if they have an issue with IOS devices, try using a browser other than Safari and it will work every time and they will not get any email, or apps, functioning until the open a browser window. When they open safari or chrome, make sure to go to an http page.  Google, for example tends to default to https. I may not have the above 100% as it has been a while, but hopefully that will give you some starting points. Bob ... View more

Steven, Thanks for replying, but I am still confused how running it on ESXi makes it less secure.  Assuming it was setup correctly (no ability to manage it from the outside), the exposed side of the firewall will appear as any other firewall to an outsider.  Any ESXi exploits are not valid as you are not exposing ESXi, only the appliance.  I just don't get it.... Publish servers through it, as far as anyone knows they just went through a physical firewall.  If you are in a position where someone gets in and can pivot around you have a lot more trouble than a virtual firewall. Thanks for your patience, Bob ... View more

I am curious how a hypervisor can be compromised in a situation like this?  Basically your are exposing a virtual port on a virtual switch which is effectively the same as a physical switch.  The port is fully controlled by the VM itself which handles all of the traffic.  I can't fathom how this is more dangerous than a physical link to a physical Palo Alto.  Please feel free to correct me and/or explain. I am in a similar boat, where the PA-500 may not be able to handle the expansion of our pip to 200 Mbps with all of the options enabled and I am up for renewal.    We routinely hit and exceed 100 Mbps on our PA-500.  I have a spare server with multiple NICs and dual power supplies.  Throw in a couple SSDs in a raid and I am fully redundant. Thanks, Bob ... View more