General Topics

Custom System Event ID Severity

I would like to set the severity of the vpn tunnel-status-up event to critical so that it triggers an email without having to get emails for all informational notifications. Does anyone know if this is a possibilty as it currently sits?

Resolved! Aggregate two physical ports and share amongst multiple VSYS?

We have an old fashioned flat network layout. We are looking at a significant network redesign and part of that is doing a proper security architecture and separating our servers from our userbase and separating server tiers (e.g. web, application, database) from each other. We also are a government that has several different verticals (e.g. h...

Content Update 592 False Positive

I've noticed that since the 592 content update I've been recieving a large amount of Microsoft SMB Client Response Parsing Vulnerability alerts from Threat-ID 35427. I've checked the servers and the workstations and everything is up-to-date or not running an operating system that would have even included this particular CVE (2010-0476). Particul...

Resolved! PA-3020 L2/VW Config Help

Hello, I just recently purchased a pair of PA-3020’s and I am having some trouble with Layer 2 / Virtual Wire interfaces. I am trying to create a network with multiple segments for both servers and workstations. I will have several “standard” segments using layer 3 interfaces and virtual routers with private addressing and NAT but I also wanted ...

show interface logs status by date

Hello, How do I verify if an interface status changed by date and time? Example: I would like to know if Ethernet1/10 went down last week or 2 days ago at a 10:00 am. Thanks for any help.

Resolved! Palo Alto high latency on the external interface

Hi All, What could be the reason fro high latency on the Palo interface and why do l have the same hop multiple times, in fact, 4 times? C:\Users\admim>tracert 1x3.2x0.x5.x4 Tracing route to 1x3.2x0.x5.x4 over a maximum of 30 hops1 1 ms <1 ms <1 ms vpn_firewall [192.168.1.200]2 1 ms <1 ms <1 ms 1x5.11x.1x1.1x13 4 ms 4 ms 4 ms 1x4....

Resolved! Anyconnect to Palo VPN

I am beginning a Cisco Anyconnect to GlobalProtect migration. Has anyone tried to connect AnyConnect to Palo. I can't find any docs on it and have been able to find a good link on how it is done. It would help our migration if we could connect the Cisco client to our new Palo firewalls. Thanks

Resolved! Palo Alto PA-3050 100 % CPU

These were upgraded from 7.0.6 to 7.1.2 on 31 May. Since then we are suffering from the data plane very frequently using 100% CPU. For example: admin@PA-3050-5(active)> show running resource-monitor hour Resource monitoring sampling data (per hour): CPU load (%) during last 24 hours: core 0 1 2 3 4 5 ...

Logs from the CLI

We've had suspicions that there have been logins from an unknown source via the console. "User admin logged in via CLI from Console" None of the team have stated they logged in around 1am to the box, and the room is locked with a pin. Is there anyway, apart from comparing configurations, and seeing what admins have logged on (I only have one adm...

Resolved! Modified Vulnerability Signatures

Hello, On the last Threat and Content update on our Firewall, we suddenly started receiving alerts on our Firewall for a specific vulnerability (Threat ID 35427, CVE-2010-0476). Now this is an old CVE and upon checking the MS10-020 article, there was no update from Microsoft, but Palo Alto release notes suggested that this signature was modified...

Resolved! Choice of cert in SSL/TLS Service profile

I've imported a certificate into my Palo 3020 (7.0.2) successfully. However when i select the dropdown field for 'certificate' when creating an SSL/TLS service profile, my certificate is not listed. If i create a self signed cert from the Palo itself, that cert appears as a choice. Is there some format restriction on what kind of certificate c...

Resolved! Prevented third-party VPN

Hi As you write in https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os-release-notes/pan-os-7-1-2-addressed-issues for blocking third-party software, I still can't fix up this bug. I downgrade my FW as you told ( from 7.1.2 to 7.0.1) then upgrade again to 7.1.2, but I still can't connect with Androti VPN or. Cisco VPN Client to may ...

How to Upgrade - GlobalProtect Agent Upgrade Process

I am looking for the link that says that you cannot upgrade directly to anything past 7.01 without breaking certs.

Does anybody know where I can get a .ova file for setting up a virtual lab?

User-ID agent configs in multiple templates not stackable??

I'm only able to get User-ID agents pushed to the firewall that are in the top template in the stack. I was quite certain this worked when I installed it but have since done OS upgrades. Panorama is 7.1.2. I have the User-ID agents running on two servers there in my "Global" template and then on the device specific template I need to have my PA ...

Discussions

Custom System Event ID Severity

Resolved! Aggregate two physical ports and share amongst multiple VSYS?