About HULK

There is no such limitation per tunnel basis, it would be the overall limit of the box. For an example, You can have aa tunnel and pass all traffic through it, the limit of the session count would be the max supported session for that hardware.  ... View more

Could you please explain this issue more in detail.  Are you saying if the VPN tunnel is getting terminated on PAN FW or as a passthrough IPSec ?  So that, we will assist you in a better way.    Thanks ... View more

Hello Amy,   Assuming this is for SSL forward proxy and not for inbound inspection. Please collect these informations. > show session all filter ssl-decrypt yes count yes > show session all filter state discard     If you know any specific machine (source IP from the logs) please collect below mentioned information for get the actual reason for failure. 1. Enable packet-diag (ctd, ssl, proxy). 2. Enable packet capture on firewall (recv, firewall, drop) with a specific filter ( i.e source IP and destination set to 0.0.0.0). 3. take global counter o/p 5 times with a 5 seconds interval. > show counter global filter packet-filter yes delta yes You may also check these 2 options. a. Double check the min TLS version on the firewall b. Disable Extended Master Secret on client   Thanks ... View more

Hello,   Here is few more informations regarding actions of URL license expiration or no license situation.    With BrightCloud: =============== If you are using the BrightCloud database, you can configure the action to take if the URL filtering license expires: • Block—Blocks access to all web sites. Upon license expiration, all URLs are blocked, not just the URL categories previously set to block. • Allow—Allows access to all web sites. Upon license expiration, all URLs are allowed, not just the URL categories set to allow. With PAN-DB: =========== If the license expires for PAN-DB, URL filtering is not enforced: • URL categories that are currently in the cache will be used to either block or allow content based on your configuration. Using cached results is a security risk because the categorization information might be stale. • URLs that are not in the cache will be categorized as not-resolved and will be allowed.   Hope this helps.   /Thanks ... View more

Hello,   Yes you are right. In order to initiate the tunnel in IKE-V2, we have to create the dynamic-gateway in AZURE side. On PAN FW we can change the IKE version based on requirement.    1) Regardig the throughput, if you take pcap on the PAN firewall, are you observing many re-trenasmission/fragmentation ...? That could lead towars the low throughput. Also, could you please choose low profile encription keys for the phase-2 negotiation i.e AES-128. This will reduce a small amount of encription/decryption overhead.    2) We need to take a look at the routing part. If you do a traceroute to a public IP i.e 4.2.2.2, where the packets are getting stuck...? ( Traceroute to an IP instead of domain-name will eleminate any issue with DNS )   Thanks HULK   ... View more

Hello Mike,   Just FYI few more related discussions:  https://live.paloaltonetworks.com/t5/General-Topics/blocking-media-streaming-and-chatting/m-p/42068/highlight/true#M30923   If you have specific list of URL's you may also considor this: Apply QoS for Youtube and streaming media https://live.paloaltonetworks.com/t5/Configuration-Articles/Apply-QoS-for-Youtube-and-streaming-media/ta-p/66036   Thanks HULK ... View more

Hello Luca,   I can give you a short overview of the processes. First of all, each PAN firewall will be having 2 planes, data-plane (DP) and management plane MP ( there could multiple data-planes and control planes in high end platform). Data-plane will participate in actual traffic flow throgh the PAN FW.   For an example, your FW is configured with OSPF. So the routing daemon will be running on MP to gather all routes (LSDB) and calculate the best route among all available entries ( SPF algorithm). That specific route will be pushed into the DP ( data-plane) and according to that route the traffic will flow through the PAN FW.    So, the MP could have multiple routes for a single destination, but the DP will be having the best route only.    If you have any specific query regarding the process flow, you may post here and i will try to address them.   Thanks HULK  ... View more

Hello ANorton,   If i understand your query correctly, you are trying to block linkedin-posting through PAN firewall.? In that case, if you specify application linkedin-posting ( dependent app linkedin base and web-browsing) and set the action as "deny", is it not getting blocked by PAN FW..?   Thanks ... View more

Just add to it, In case if you face any problem after the software upgrade. Need not to install the previous version again from GUI, you may follow below steps to easily revert the 6.1.x OS. For example: ( you have upgraded the PAN firewall from 6.1.5 to 7.0.1) =========== > debug swm status Partition State Version -------------------------------------------------------------------------------- sysroot0 REVERTABLE 6.1.5 sysroot1 RUNNING-ACTIVE 7.0.1 >>>>>>>>>>>>> currently installed maint READY 7.0.1   apply this single command to revert the PAN OS back to 6.1.5   > debug swm revert  <<<<<<<< wait for 1 minute >>>>>> >request restart system >>>>>>>>> restart the system. Upon reboot the device will come up withPAN OS 6.1.5.   Thanks ... View more

Just add to it, In case if you face any problem after the software upgrade. Need not to install the previous version again from GUI, you may follow below steps to easily revert the 6.1.x OS. For example: ( you have upgraded the PAN firewall from 6.1.5 to 7.0.1) =========== > debug swm status Partition State Version -------------------------------------------------------------------------------- sysroot0 REVERTABLE 6.1.5 >>>>>>>>> previously installed PAN OS sysroot1 RUNNING-ACTIVE 7.0.1 >>>>>>>>>>>>> currently install maint READY 7.0.1 admin@51-PA-5020> debug swm re > rebuild-content-db Rebuild content database > refresh revert back to last successfully installed content > revert revert back to last successfully installed software admin@51-PA-5020> debug swm revert >>>>>>>>>>>>>>>> apply this single command to revert the PAN OS back to 6.1.5 <<<<<<<< wait for 1 minute >>>>>> admin@51-PA-5020>>request restart system >>>>>>>>> restart the system. Upon reboot the device will come up withPAN OS 6.1.5. Thanks ... View more

FYI.. IPS Coverage for CVE-2015-2426 - MS15-078, Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution ... View more

Hello Putting an "*" in the BLOCK-list will not help you to allow those 5 websites. The order of precedence taken: Block list Allow list                           custom categories pre-defined categories Hence,i would request you to configure a new URL filtering profile for "corp\DelinquentUsers" AD group as mentioned below: Add this profile in your security policy for user group corp\DelinquentUsers. Hope this helps. Thanks HULK ... View more

Just FYI, If you are running PAN-OS 7.0.0 or PAN-OS 6.1.x, you will need to download PAN-OS 7.0.1 in order to get to any new PAN-OS 7.0.x image. For example, upgrading from PAN-OS 7.0.0 or PAN-OS 6.1.5 to PAN-OS 7.0.2 will not work unless PAN-OS 7.0.1 is downloaded first. This is the same as any base image. Thanks HULK ... View more

Hello COS, Did you try to implement QOS for limiting your internet traffic. reference DOC: QoS in PAN-OS 4.1 QoS traffic direction (egress interface) Thanks ... View more