About hshah

I Agree ... ... View more

Hi Foobar,   You can create custom URL and allow internet traffic for those URL for a specific subnet.   Please refer the following doc. https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-Custom-URL-Categories/ta-p/54355   -- Hardik Shah     ... View more

How is East and West Azure connected?    Are they connected via IPsec? Is IPsec terminated on the firewall?   Is there an Express Route between East and West region? ... View more

Hi Choffr, You can not disable any encryption algorithm on PANW firewall. You can either disable on client or server. You can block it via custom application/signature, but its not going to help. Because client will keep on try to connect on those algorithms which will result in failure attempts. Regards, Hardik Shah ... View more

Hi Riverj, It worked for me in single-VR, I didnt find any reference where its configured in multi-vr environment. Regards, Hardik Shah ... View more

Hi Jharlow, Let me know if you come across any issue. Regards, Hardik Shah ... View more

Hi Dz3015, I just tried in LAB, it works just fine, I think original image might have error in pixel. I used ms-paint to adjust pixels. Let me know if that helps. Else provide me image what you are using, I will try out in LAB. Regards, Hardik Shah ... View more

Hello Dz3015, Please follow bellow instructions to find recommended dimension. Basically you need to click on preview button. Preview buttons are in RED Square.  Let me know if that helps. Regards, Hardik Shah ... View more

Hi Jharlow, It does passes IKE/IPsec packets, you dont have to worry about that. You are good to go for VPN traffic. Let me know if this helps. Regards, Hardik Shah ... View more

Hi Jahrlow, Vwire is very much similar to "Transparent mode" in Cisco, however Vwire doesnt mantain any ARP or MAC table unlike to transparent mode. Vwire takes packet from one interface and forwards it to second interface. For this forwarding mechanism, it doesnt not check ARP or MAC table. Your idea of implementation looks good to me. Make sure all provide are in Alert mode, and you are logging all kind of traffic. Which means you should have default "deny any any" rule at the end which does logging. Regards, Hardik Shah ... View more

Hi Fred, In Threat log direction should be "server-to-client", if yes. Than it means attacker is on internet. If you think its a false positive, than you might want to create exception for that. Let me know if you need any help with that. Regards, Hardik Shah ... View more

Hi Mel Li, OCSP is query/response protocol. Did you confirm firewall can reach OCSP server without issue. I would suggest to do packet capture to verify the same. Regards, Hardik Shah ... View more