About dwoolley

Hello, I've been asked to block certain countries... - All of Europe except Spain - All of Asia (except Japan, Australia, Korea, Singapore, Taiwan) - All of Africa I figured I could add those countries to a "Denied Countries" group to use in a security policy but I don't see the countries listed when I try to create my address group... they only exist in the Regions section.  Is there any way I can create an address group for the countries?  Is there an easier way to do what I'm trying to do without having to manually go through all of the countries and add individually?  Would be nice if there were predefined Region groups (i.e. Europe, Asia, Africa, etc). Thanks in advance for your help/advice! -Dave ... View more

Hello, Does anyone know if there's a way to have a notification e-mail sent when PBF kicks in?  We had a hiccup on our Internet circuit and PBF worked flawlessy... so well though that I wasn't really aware of the circuit issue until the next day when I was troubleshooting something else related to the hiccup.  There are probably a few different ways that I can monitor and alert but I was just wondering if having the PA firewall send a notification e-mail is one of them. Thanks in advance! -Dave ... View more

Hello, I've read through the documentation and forum posts, and tinkered with QOS config but still am not clear on whether what I'd like to do is possible.  Hopefully I can explain this clearly... here goes... I've got a PA-4020 HA running 3.1.5.  Interface 1 is our Internet connection which 20Mbps... Interfaces 2, 3, and 4 (1Gbps) are internal networks which all utilize the Interface 1 Internet connection and also pass traffic between each other. I can manage Internet upload usage for all of my internal networks by setting Maximum Egress to 20Mbps on the QOS Profile for Interface 1 and appying/configuring QOS policies for that interface. As for managing download usage, is there any way for me to configure so that each Interface (2, 3, and 4) has the ability to use the entire 20Mbps available but QOS will be performed when there is congestion?  I can't set QOS Profile - Maximum Egress below 1Gbps because I don't want to affect traffic flow between those networks.  So if the PA interfaces doesn't know about the 20Mbps limitation and the bottleneck actually doesn't occur on the PA-4020 but rather on our Internet router on the other side of Interface 1, how can I control/manage Internet download traffic? Thanks in advace for your help! -Dave ... View more

Hello, We have an Extranet server which sits on our DMZ... http and https are allowed through the firewall so that outside users can access the web app on that server.  My server admin asked me if I can block all inbound traffic from China and Taiwan as he gets a ton of hack attempts coming from those countries.  Our web app doesn't serve anybody in those countries so it makes sense to me.  Does anybody know a reason why I should not do that?  And does anybody know how I would go about blocking traffic from those sources? Thanks in advance for the help! -Dave ... View more

Hello, We recently transitioned from a Checkpoint NG to a Palo Alto 4020 and I'm in the process of learning the new interface and management capabilities of the PA.  When we were using the Checkpoint NG I frequently used Checkpoint Monitor to view the Top 10 Sessions when our Internet bandwidth was being gobbled up... it had a live line graph that updated every couple of seconds and showed who was currently using the most bandwidth and how much they were using.  I've looked through the PA GUI but haven't found anything that provides me with this type of real-time information... I also looked at the CLI but need something more visual.  Does anyone know if the PA GUI has what I'm looking for... and where it is? Thanks in advance for your help! -Dave ... View more