About djr

Thanks Oliver, so by that, "Feature" release could be either the first or the second part of the version number: [major feature].[minor feature].[maintenance]-[hotfix] The reason I was asking is because in the upgrade documentation it says this: "When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release." So by that, you can go straight from 10.2.5 to 10.2.7-h3 but you can't go from 10.0.3 to 10.2.2 without installing the highest maintenance release of 10.1 on the way. ... View more

This is how I understand the version numbering system, but Palo documentation refers to the "Feature Release" number - is that what you refer to as the Major or the Minor? Thank you. ... View more

Thank you for pointing that out.  I find it odd that on one screen it says Benign, but if you click for details it says it is malicious.  The hash does match so it seems they do believe it's bad so blocking it is the right thing to do.    Thanks again ... View more

That is interesting.  I submitted the URL of the file to wildfire and that decided it was benign.  Do you know if that automatically reclassifies it, or is that just an assessment for information? ... View more

It has been raised with TAC via our support partner.  I am not getting sensible answers yet from either. ... View more

I have been seeing this since 17th March on downloads of utorrent installer which appear to be legitimate URL: llsw.download3.utorrent.com/3.6.0/utorrent.46738.installer.exe I have raised this with our support partner. ... View more

We hit this issue again after having it fixed, but following the H4 patch installation.  We are still working on the understanding that hit will be resolved in 10.2.4 ... View more

I'm afraid I can't help with this, I don't have experience of VM Palos in cloud environments, sorry. ... View more

I had this issue under the same circumstances and TAC were also able to resolve it by logging in as root and manually removing the old key, so it may be worth asking them to try for you. ... View more

Thanks Adrian, that is interesting and yes the documentation says that the yellow pencil indicates a custom application, but these are definitely not ones we have created.  However, they do have the option to disable app-id so that fits in with them being customisable, rather than custom applications.   We noticed these after we upgraded to v10 and as far as I can tell the red cog is shown on all applications in a group, but we have not changed anything on them.  From what I can see they don't have anything that can be modified. ... View more

Thanks @aleksandar.astardzhiev, I had already asked the company at other end to do the source NAT but they are saying they don't want to do it.  The more I look at it, the more I agree with you that it should be a very simple NAT policy for them to source NAT as the packet egresses on the tunnel interface.   I am surprised that the Palo looks to its standard routing after NAT for this, as it does mean it can't work without the route at my end, but I guess source NAT on arrival of a packet is unusual as it is usually done on egress.  It would have worked if PANOS used the session table to route, or if they routed first then NATted, but I guess they have their reasons.   Thanks for your help ... View more