About MSharma

HI Shannonturner, Yes it is possible . We can generate a report for this . If you are looking for Clients who got connected through Global protect. The only thing we want is a different zone for Global Protect users. If we have that , we can go to : Monitor  --> Manage Custom Reports-->Add In query builder, just create a query by selecting source zone  equal to the actual name of the zone as shown above. You can also specify the time frame like 24 hours and we have other options too. Once all the fields are selected just click on Run Now. Please try this and let us know if was helpful . ... View more

Hello Panlst, Enabling all options may drop legitimate traffic too. To check drop packets , you can run following command : > show zone-protection zone untrust This output will show all the options that have been enabled and the number of packets dropped by it. For best practices, please check following document too : https://live.paloaltonetworks.com/servlet/JiveServlet/previewBody/5078-102-5-14892/Understanding_DoS_Protection.pdf Threat Prevention Deployment Tech Note Please let us know if was helpful. Thanks ... View more

Hello Ryan, I am not sure if we can get proper information for that particular hour . But you can try one thing. You can create a report for this particular source and destination address. I hope this will give you some information . From the available column you can select source address, destination address, hour ,application , bytes sent,bytes received. In the query builder you can specify the specific source and destination address. So you will have to generate multiple reports with different time frames like 24 hours , one week . Test with different columns too. I am not sure if  we will be able to find out something specific for this time , but for future if you want to track something like this for the previous one hour or six hours, 12 hours ,we can do that . Let me know if it was helpful .. Thank you ... View more