About Alex_Graser

Hi @kiwi, yesterday I set the interval to 15 minutes (instead of real-time) and tonight I got no errors! Thank you very much!   Greetings, Alex. ... View more

Hi Kiwi,   thank you for your explanation about WFRTSIG !!!   A 'show wildfire statistics' gives me the following output - but I don´t know how I should interpret it:   Packet based counters: Total msg rcvd: 34995 Total bytes rcvd: 28025084 Total msg read: 25585 Total bytes read: 19754852 Total msg lost by read: 9410 Total DROP_NO_MATCH_FILE 9410 DP Files upload initiated: 60 DP Files upload succeeded: 50 Counters for file cancellation: CANCEL_BY_DP 5 CANCEL_FILE_DUP 2 CANCEL_FILESIZE_LIMIT 3 Counters for file forwarding: file type: apk FWD_CNT_LOCAL_FILE_PUB 7 FWD_CNT_LOCAL_DUP_PUB 2 FWD_CNT_REMOTE_FILE_PUB 1 FWD_CNT_REMOTE_DUP_CLEAN_PUB 7 FWD_CNT_REMOTE_NO_SUPPORT_PUB 1 file type: pdf FWD_CNT_LOCAL_FILE_PUB 9 FWD_CNT_REMOTE_FILE_PUB 8 FWD_CNT_REMOTE_DUP_CLEAN_PUB 1 file type: email-link FWD_CNT_LOCAL_FILE_PUB 33 FWD_CNT_APPENDED_BATCH_PUB 33 file type: ms-office FWD_CNT_LOCAL_FILE_PUB 1 FWD_CNT_REMOTE_DUP_CLEAN_PUB 1 file type: pe file type: flash file type: jar file type: archive file type: MacOSX file type: linux file type: unknown file type: script file type: pdns Error counters: LOG_ERR_REPORT_CACHE_NOMATCH_PUB 3 Reset counters: DP receiver reset cnt: 1 File cache reset cnt: 1 Public Cloud: Service connection reset cnt: 1 Log cache reset cnt: 1 Report cache reset cnt: 1 Private Cloud: Resource meters: data_buf_meter 0% msg_buf_meter 0% ctrl_msg_buf_meter 0% wr_debug_log_buf_meter 0% File forwarding queues: priority: 1, size: 0 (PUB), 0 (PRIV) priority: 2, size: 0 (PUB), 0 (PRIV) priority: 3, size: 0 (PUB), 0 (PRIV) priority: 4, size: 0 (PUB), 0 (PRIV)   I will set the interval to 1 minute and will check if the error in the system log will still appear. I´ll post the result tomorrow! Thanks again, Kiwi!   Greetings, Alex ... View more

Thank you very much @reaper for your quick response and for correcting the guide!   Greetings, Alex. ... View more

I want to share my experience deleting a vsys, because i just did so this morning: My PAN-OS-Version is 7.1.12 and I deleted one of my three vsys. First, I followd the instruction mentioned in the above posts - just deleting the vsys. After deleting the vsys - there were no errors - I commited the changes. This commit failed because of configured Ipsec-Tunnels and GP-Gateways.   I had to revert to running-config, because the Information about GP-Gateways seemd to be lost. After revert to running-config - which restored the original config with the vsys deleted before - I first removed all IPSec-tunnels, GP-Gateways and Tunnel-Interfaces which were referenced by those IPsec-tunnels an GP-Gateways. After that I deleted the vsys, followed by a commit. this time the commit was compelted without any errors. After that I saw that the virtual-router-instance of the vsys I just deleted, was not deleted. So I removed it manually. Also, the Interfaces used in the vsys which I deleted, needed some manual intervention. I used some sub-interfaces, in this vsys, so I delted them. Physical Interfaces which were used in this vsys had IP-Address-Config, so I removed them also. After that everthing seems to be removed.   Maybe this information is useful for someone. Greetings, Alex. ... View more

Thanks VinceM, but as far as I know, you can't enable nor disable AV-Response page. At least there is no option for doing that. Application response page is enabled and as I mentioned in my original post, App and Url response pages or working correctly. The following command is set - required for SSL decrypt. set deviceconfig setting url dynamic-url yes the managment profile for the egress interface is set to enable response pages. I know for sure, that the AV response page worked when we first implemented the firewall 3 years ago and I think that was on PAN-OS 5.X I don't know when it stopped working 😞 Alex. ... View more

Thanks for all of your replies!   I didn´t open a case yet, because it looks like i´m not able to open one direct at PaloAlto. We have Premium Partner Support, so I think I would have to contact our Partner. Now, between Christmas and NewYear it´s a little bit tricky here!   Anyway, I tested again today, since we´re now an AV-Version 1731-2209 (12/27/15) and it looks like it is corrected now! Maybe anyone else contacted TAC 😉   Thanks to all!   Alex. ... View more

Thanks for your info, Brandon!   I did another test today (using this link: http://go.microsoft.com/fwlink/?LinkID=623682 ) , since were now on AV-Version 1726-2204, but again it is identified as Virus/Win32.slugin.ozi ID: 2044771 In our AV-Profile we set the action for http to block. Never had any issues before.   VirusTotal still states: Probably harmless! There are strong indicators suggesting that this file is safe to use.   Alex. ... View more

Thanks, Ramya! I´ve added update.microsoft.com and *.update.microsoft.com to our no-decrypt policy and it seems to work for me, too. Greetings, Alex. ... View more

Thank you bat, I think now it´s a littlebit more clear to me. So the exclusion of ms-update from SSL-Decryption does not work with Windows-Update. Does anyone know if the no-decrypt policy for URL update.microsoft.com and *.update.microsoft.com is working for all Windows Versions - ie Win7, Win8, Win8.1 and Win10-Beta? Alex. ... View more

Hi! reading this thread I´m getting a littlebit confused. Maybay someone can spread a light on this: Document "List of Applications Excluded from SSL Decryption" mentioned by hshah says: "These applications are added to an exclude list in each Content load so that the SSL engine will allow them to pass through, rather than trying to decrypt them." As far as I understand it, this means that ms-update (as it is listed) should be excluded from SSL-Decryption. So my question is: if we´re using SSL-Decryption without any custom excpetions, is access to ms-update possible or not? If it is not possible, what should be done to enable access to ms-update? Thanks in advice, Alex. ... View more

ThreatDatabase now reflects antivirus version 954 and threats version 358 But I still can´t find ID 4091550. Anyone has an idea? Thanks, Alex. ... View more