The most effective method is to leverage App-ID by specifying ‘ssl’ (which identifies encrypted HTTPS traffic) instead of the broader ‘web-browsing’ application (which includes both HTTP and HTTPS). This ensures the firewall permits only the desired application behavior (encrypted traffic) at the application layer, which is the core principle of App-ID. Using a port-based service (TCP/443) is less secure as it doesn’t validate the application, and blocking HTTP with a deny rule or URL Filtering is less efficient and doesn’t positively define the allowed application.

For User-ID to work, the firewall must have a current mapping between the source IP address of the traffic and the user’s username. If the user’s device has a different IP (e.g., from DHCP), or if the mapping hasn’t been propagated (e.g., from an agent or captive portal session timeout), the traffic will not match a user/group-based policy. The user authenticating via captive portal creates a temporary mapping, but if that has expired or the IP changed, the mapping is lost. The other options are possible, but the direct mismatch between the traffic’s source IP and the user mapping is the most common and fundamental issue in this scenario.

The most effective and clear policy design is to explicitly allow the desired behavior (DNS to internal servers) and then explicitly deny the prohibited behavior (all other DNS traffic). This two-rule approach provides clear intent, ensures the deny rule logs all violation attempts, and prevents any unintended allows. Applying the DNS Security profile to the allow rule is sufficient, as it will inspect the allowed DNS traffic for malicious domains. A single rule cannot both allow to a specific destination and deny to others. Denying only a single IP like 8.8.8.8 is insufficient, as users could use many other public DNS resolvers.

The ‘reset-both’ action indicates the firewall actively terminated the TCP session in which the exploit traffic was detected. It did this by sending TCP reset (RST) packets to both the source and destination devices, effectively tearing down the connection. This is a more proactive response than just ‘drop’ (which silently discards the bad packet) and is used to disrupt the attacker’s ongoing session. It does not mean the packet was allowed through, nor does it involve host-based actions.

A Decryption rule requires standard policy matching criteria (source/destination zones/addresses) plus an application or service that indicates SSL/TLS traffic (like ‘ssl’ or ‘https’). The action must be set to ‘decrypt’. Using App-ID (‘ssl’) is preferred over service (HTTPS/tcp443) as it’s more specific. While URL Category can be used, it is not necessary if you have a specific Destination Address. The rule must have both source and destination criteria to properly match traffic.

The standard best practice for PAN-OS upgrades in an Active-Passive HA pair is: 1) Download the software to both firewalls. 2) Suspend High Availability on the Passive firewall (this prevents it from taking over during the upgrade). 3) Install the software on the Passive firewall and reboot it. 4) Once the Passive is up and running the new version, failover the HA pair (making the upgraded firewall Active). 5) Install the software on the new Passive (the former Active) firewall. This method ensures one firewall is always active and handling traffic, minimizing disruption.

The ‘Rule Hit Count’ feature, located directly within the Security Policy tab (Policies > Security), provides a straightforward view of the number of times each rule has been matched. It includes the time frame of the hit count data (e.g., ‘Since Last Cleared’). By clearing the hit counts and waiting a period (like 90 days), an administrator can easily identify rules with a count of zero, indicating they are unused. This is the most direct and purpose-built tool for this task, as opposed to searching through traffic logs or configuration logs.

GlobalProtect Clientless VPN provides secure, browser-based access to specific internal web applications without requiring a VPN client to be installed on the remote user’s device. This is ideal for third-party vendors or contractors who need access to a limited set of resources (like a web portal or application server) and where managing client software on their devices is impractical. The other modes require the GlobalProtect agent to be installed and managed on the endpoint.

The ‘intrazone-default’ rule is the firewall’s implicit default rule that allows traffic between interfaces in the same zone. The application ‘incomplete’ indicates that the firewall’s App-ID engine has not yet completed its classification of the traffic—this often happens for the first few packets of a new session or for short-lived sessions. This log shows that the traffic was permitted based on zones before its application was fully determined, which is the normal behavior for the default rule. It does not inherently indicate malicious activity.

The most effective method is to leverage App-ID by specifying ‘ssl’ (which identifies encrypted HTTPS traffic) instead of the broader ‘web-browsing’ application (which includes both HTTP and HTTPS). This ensures the firewall permits only the desired application behavior (encrypted traffic) at the application layer, which is the core principle of App-ID. Using a port-based service (TCP/443) is less secure as it doesn’t validate the application, and blocking HTTP with a deny rule or URL Filtering is less efficient and doesn’t positively define the allowed application.0