General Topics

Multi site dual-isp with redundant VPN connections: PBF vs alternatives?

When we got out PanOS firewalls a few years back, we set them up with a single virtual router and PBF to handle our active/passive ISPs. Time went on, and to support fancier topologies, such as fully redundant VPN connections between us an AWS, we moved to dual VRs: one default that holds all our routes AND the standby ISP, and one that pretty m...

Computer wakes up

Hello,My laptop which is couple of months ol runs win 10 is constantly turning on when in sleep mode. Any advice and what causes this?

Resolved! Educator at Heart - Jobs for trainers PCNSE certified?

About to take the PCNSE in a few weeks. I don't mind being a consultant, but I like training the most. Are there many jobs out there for PCNSE certified individuals interested in training, and if so where are they needed most? Also, what is the salary that is fair in expectation if you may know? Thanks!

Resolved! PANOS 8.0.7 SSL inbound inspection affects SSLLabs scroe

Hi, When we do SSL inbound inspection for some of our web servers, SSLLabs test scores goes from A+ to B. I also tested with "openssl s_client -connect mailadmin.artvin.edu.tr:443 -showcerts" and it show the same problem. The problem is, when doing ssl inbound inspection, both SSLLabs test and openssl test shows "Secure Renegotiation IS NOT supp...

Resolved! How to export sample miner from minemeld app in autofocus

Hi experts, I have a customer who uses Autofocus with Minemeld and, uses splunk. This customer is using two minemeld. One of Minemeld is from Autofocus app and, another is Standalone Minemeld deployed on Splunk. but, I found out difference number of miner samples between Autofocus app and Standalone Minemeld. Below is number of samples wh...

After installing update 8.0.8 PA3020 in FIPS\CC mode inaccessible. Device stuck in boot loop.

After installing update 8.0.8 on a couple of our PA 3020s they became inaccessible using the web access and SSH. We had to do a factory reset on the devices. Every time we tried to put the devices back into FIPS\CC with 8.0.8 installed the devices would get stuck in a boot loop. We had to do a factory reset and reinstall version 8.0.7. Then w...

Destination NAT not working

Hello all, I am having issues with my NAT config. I have everything from this doc completed but not seeing any traffic hit my outside interface in the logs.https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-many-mapping I basically have a Synology NAS im trying ...

Resolved! Policies > Tunnel Inspection

Hello Does any one have example of how to configuring tunnel inspection in GUI under the policy tab. Thank you

Resolved! GlobalProtect and general Internet access?

Hey folks, Using PAN-OS 7.1.15 and Globalprotect client 4.0.1. Trying to confirm something. From what I can tell, when connected to VPN via GlobalProtect, my general internet access goes through the VPN tunnel route successfully (after security rule between the zones of course). That is the case, correct? Split tunnel is just not available or ...

List of Service Accounts

Does anyone have a running list of service accounts used/needed for best practices? User-ID (per domain or per domain trust)LDAP profile (per domain for Group Mappings) What else?

Resolved! GlobalProtect client can't authenticate anymore after upgrade to 4.1

We have upgraded our firewall to version 8.1 and the GlobalProtect agent to 4.1.We use a certificate to authenticate with our GlobalProtect Agent but after the upgrade (8.0.5 and 4.0.3) nobody can't authenticate anymore.In the logs I always see this:First'GlobalProtect portal user authentication succeeded. Login from: 10.1.2.10, Source region: 1...

Resolved! SNMP Paloalto

Hello ! I want to do snmp polling to a palo alto firewall, but not using any management "software" (like zabbix). I'm trying to do it via bash command snmpget, in which i pass the object OID 1.3.6.1.2.1.25.3.3.1.2.1 (CPU util on the management plane). Something like this: # snmpget -v 2c -c public 192.168.100.1 1.3.6.1.2.1.25.3.3.1.2.1 In which ...

Max session age?

Quick question here. If there is a perfect TCP or UDP session that is just sending stream data for example (say, an IP camera feed to a DVR server) and there are no app hiccups or dropped packets - is there a max session age for this condition? I can't seem to find anything in the docs, and I have a few sessions that are nearing 2 weeks old, s...

Resolved! PA inbound decryption

PA drop (decrypt-error, policy-deny) packet when client present a certificate (SMTP STARTTLS). PAN OS version: 8.1 Test cases 1) Client cert TRUSTED, TLS 1.2 with ECDHE-RSA-AES256-GCM-SHA384 Client send Certificate Verify TLS payload openssl s_client -starttls smtp -crlf -tls1_2 -cert trusted-cert.pem -key private.key -cipher 'ECDHE-RSA-AES256-G...

Dataplane increment from 07/03/2018

Hi, We realised that we have had an increment in dataplane from 07/03/2018. Before this day the normal value was 42% aprox. After that day the normal value is incremented to 58%. So we would like to know the reason for this increment.I check "resource monitor", sessions, cpus, etc.... and i dont see anything about what it could cause this increm...