We have a PSA-7000V but are hitting ACL limits.  The VM itself has plenty of excess memory and CPU power.  Is there no secret way to up the ACL limits?  Simplifying our ruleset is an obvious alternative of course. ... View more

Have any of you found a successful model for managing granular permissions for users at scale (1500+ users)? We use AD groups, but they've mostly sprawled out of control and it can be challenging to at-a-glance understand what Role/AD group leads to what layer 3 access. Introducing more discipline and oversight into the process might help, but I'm thinking others may have found a better, more scalable way. Have also considered offloading the access decisions to the firewall layer leaving the Pulse box mostly to handle tunnel termination and authentication. What have you found works? ... View more

I'm working on a script to audit roles & rules. I'm checking for rules which reference groups (AD based for us) which are no longer valid. I can also check for roles which have no rules which reference them. Am doing this by parsing the XML dumps of the rule/roles databases. I'd also like to be able to check for the last time a role was used. Currently it seems like I need to use the user connection log which contains a username and the roles that user had applied to them. Doable, but the log is very large (300MB for us for just a 48 hour period). Is there a more efficient way I should be tackling this? MAG-4610 appliances. I'll go search now and find out there's a RESTful API which has calls to the things I'm after and my XML and log parsing has been a waste of time. :-) ... View more