About jay.martin

This article may also prove helpful - https://live.paloaltonetworks.com/docs/DOC-6948 ... View more

Hi - I'm assuming you are not using GlobalProtect agents - if you were you could create a HIP object for the XP OS and target your rule that way.  Without GP, if your DNS performs well you could create an address group and put the FQDN's of the XP machines in, then do a deny rule to the Internet.  Or more preferably to take potentially slow/inaccurate DNS resolution out of the picture, if the XP machines have static IP addresses, or effectively static by DHCP reservation, you could do the same using the IP addresses instead of the FQDN's.  Hope this gives you some possible options. ... View more

Support told me it affects all releases using BrightCloud (that's gotta be a lot of their customers!). ... View more

Thanks - I just opened a case as well - we have around 70 firewalls, and most, if not all look to have this issue.  Kinda hard to manually clear cache very quickly on 70 firewalls.  I sure hope they know what's going on and how to stop it!!! ... View more

Grrrr!!! - I wondered why our decryption was not working (it's based on URL category)!  Same issue here - 5.0.3 on 4060 - cleared cache and that resolved.  Did you open a case?  Interestingly (not sure if coincidence or not) our 4060's dataplane restarted this morning, within 30 seconds of the updated BrightCloud DB being installed (url-filtering-version: 4058).  I am seeing lots of "unknown" category being logged across our other platforms as well. ... View more

I agree so far (pretty early still to for me to call 5.0.3 all good, but...) it has useridd back to what I would call "normal" in terms of cpu utilization - I've put 5.0.3 on both 2000 and 4000 platforms with similar (good) results - let's just hope 5.0.3 doesn't introduce some new nasties!!! ... View more

Same here - 2020's and 2050's as well as 4060's - had to take 2000's back to 5.0.1 as commits and FQDN refreshes started failing.  4060's still running 5.0.2, but userid consuming LOTS of cpu constantly, but I suppose the beefier platform is handling it.  Already reported to PAN but yet to hear back on how they intend to fix. ... View more

I brought it to our SE who is making a case for this - he told me others have requested same.  One of the primary reasons they gave for having that way is for compulsory vpn connections to be able to still talk to captive portals in hotels, airports, etc.  I said, if that's the case, why not only allow the apps necessary to do captive portals and not wide open. Fingers crossed they'll make it at least a configurable option for their customers...  ... View more

Thanks for the reply - I agree - we must be able to cut the GP client off their LAN!  I'm also surprised there would be no permanent solution for this yet! ... View more

Hi rgreenspon - we have same exact issue/concern with both windows and mac clients - running latest 1.1.7 gp client - did you get a permanent solution? ... View more

bpappas - Please excuse me if I'm wrong, and David certainly correct me if I am, but I think David is asking how to guarantee bandwidth for his IPSec tunnel, not necessarily the traffic that flows over that tunnel.  Reason I say I think that's what he's after, is that is exactly what I'm after as well.  I want to be able to set QoS such that the IPSec tunnel will always have enough bandwidth to stay up, as we've seen circuits get so saturated that the entire tunnel will drop.  At least that's how I read David's question.  If I am wrong, please respond to my question as well.  Thanks - Jay ... View more

We've seen same thing you're describing on our 2050 running 4.1.1 - hoping 4.1.2 clears these things up!!!!!  10-15 minute commits are rediculous!!! ... View more

I get same - one int tagged for netflow, but 5 or 6 ints show up in ManageEngine Netflow - we're running 4.1.1, and same issue on several PAs (2020, 2050). ... View more