About santonic

santonic · ‎08-05-2022

I have successfully on-boarded a FW to Panorama (both version 10.1.6-h3) using auth key. I've set a single use for key so now it disappeared as expected. Now I am trying to change Panorama settings (to disable auto recovery) and it won't allow me to click 'OK' button without auth key. Surely this is a bug? You don't have to re-authenticate FW to Panorama every time you want to change settings? How can you change Panorama settings of the already on-boarded firewall?

santonic · ‎07-07-2022

Found it! You just need to re-install the desired version it seems. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boLJCAY

santonic · ‎07-06-2022

I vaguely remember once having a similar issue and that I found KB article which provided solution. Of course I didn't write down the commands anywhere and now I can't find that KB article again 🙂 With 1st level support i would spend weeks before making any progress if at all.

santonic · ‎07-06-2022

Current status is: Partition State Version -------------------------------------------------------------------------------- sysroot0 PENDING-CHANGE 10.1.5-h1 sysroot1 RUNNING-ACTIVE 10.1.4 maint READY 10.1.5-h1 I want to cancel pending change to 10.1.5-h1 after reboot

santonic · ‎07-06-2022

In HA upgrade scenario we decided to stop the procedure and downgrade after the 1st FW was upgraded and had issue. But on the 2nd FW software install was already completed but we didn't reboot the FW so it stayed on old version. Does anyone know the CLI commands to show into which version the FW will boot? And how to select to boot to old version?

santonic · ‎05-25-2022

The certificates are marked as non exportable so they can't in a 'normal' way. I know there is a way with MimiKatz... 🙂

santonic · ‎05-23-2022

Thank you for info @Adrian_Jensen In our case it's fresh installations of Windows 11. First the access with GP works for a couple of days, weeks, months... and then it stops. After that the new client certificate has to be installed and the access starts working again.

santonic · ‎05-23-2022

Our customer is having issues with GP 5.2.10-6 on Windows 11. They are using client certificates for authentication and after a while a connection fails due to no client certificate present. If we check MMC the certificate is present, valid and has private key. But GP logs say: (P9292-T12792)Error(2290): 05/23/22 07:03:00:014 error = ERROR_WINHTTP_CLIENT_CERT_NO_ACCESS_PRIVATE_KEY (P9292-T12792)Debug(2377): 05/23/22 07:03:00:014 winhttpObj, got ERROR_WINHTTP_CLIENT_CERT_NO_ACCESS_PRIVATE_KEY, clean cert cache now (P9292-T12792)Debug(4578): 05/23/22 07:03:00:014 winhttpobj, cert do not has private key???? clean lastIssuerName now, data = 0000000000000000 There is a reddit post about it: https://www.reddit.com/r/sysadmin/comments/sd3m6v/windows_11_tpm_and_vpn_issue/ But nothing on PA forums or KB. How many ppl are having similar issues? Any more info from PA support about this?

santonic · ‎05-23-2022

I would say the only stable version is 9.1. Version 10.0 is also quite OK but for some reason it's going EOL. 10.1. is still buggy as hell. I only have 3 in production and I've been experiencing crashes and bugs on 10.1.4 and 10.1.5-h1

santonic · ‎04-25-2022

No, I didn't open a case (yet). Tbh there's so many bugs lately, especially with 10.1, so I'm only opening cases for the most critical ones. Not sure deleting license would help me in my case as I never had old URL license on this box.

santonic · ‎04-14-2022

It seems PAN-178194 wasn't resolved even in 10.1.5-h1? I have a new PA-440 (which never had old URL filtering license) with valid Advanced URL license yet the WebUI shows error when on URL filtering object and I can't edit ML settings there.

santonic · ‎04-11-2022

And they are announcing EOL for 10.0 and forcing everyone to 10.1....

santonic · ‎04-07-2022

I have one 10.1.4-h4 in production for a couple of months and I've encountered 2 bugs already so I can't agree it's stable. At the moment I am not recommending upgrade to 10.1 to any of our customers. And with 10.0 going EOL I guess they will have to stay on 9.1 for a while.

santonic · ‎04-06-2022

I had this issue in authentication policy where there are luckily not many rules. List the problematic authentication rule in CLI in set format and you will see a line which sets hip-profile to any. Unfortunately you can't just use delete command for hip setting as Pan-OS doesn't expect hip-profile here. So copy the whole existing rule to your favorite text editor, change the rule name to something else, and paste it back without the hip profile line. After checking the new identical rule is in place, delete the original rule and commit

santonic · ‎04-06-2022

So we need do downgrade all the (brave) customers from 10.0 to 9.1 which hasn't been marked for end-of-life yet? And when 10.1 eventually becomes stable we have to upgrade via then unsupported version 10.0?

Member Since	‎01-26-2011 05:56 AM
Date Last Visited	‎11-29-2024 07:11 AM
Posts	672
Total Likes Received	190

Online Status	Offline
Date Last Visited	‎11-29-2024 07:11 AM

About santonic

Re: Telemetry - Hostname/url is in illegal/bad format

Re: Config Audit Failure

Importing (Cisco) switch configuration to Expedition

Re: Config Audit Failure

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Expedition - re-assign zones after change in routing

Re: Expedition - re-assign zones after change in routing

Re: QoS configuration based on destination (sub)interface on 3400 series

QoS configuration based on destination (sub)interface on 3400 series

Re: Can't generate output files

Re: Browser not prompting/selecting client cert for GP portal

Re: Panorama management for Cloud NGFW

Re: App Identification and ALLOW rule - does this make any sense?

Re: What is PA equvalent to show Xlate to view NAT translations

Why is SMB traffic slow ?

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Why is SMB traffic slow ?

The World’s First ML-Powered NGFW

Panorama settings - auth key issue

Re: Select PAN-OS version after reboot

Re: Select PAN-OS version after reboot

Re: Select PAN-OS version after reboot

Select PAN-OS version after reboot

Re: GP on Windows 11 - client certificate issue

Re: GP on Windows 11 - client certificate issue

GP on Windows 11 - client certificate issue

Re: Prepare for End-of-Life PAN-OS and Migrate to Latest PAN-OS Version

Re: PAN DB vs Advanced

Re: PAN DB vs Advanced

Re: Commit Error After Upgrading to 10.0.9

Re: Prepare for End-of-Life PAN-OS and Migrate to Latest PAN-OS Version

Re: Commit Error After Upgrading to 10.0.9

Re: Prepare for End-of-Life PAN-OS and Migrate to Latest PAN-OS Version

Nebula Hardware Beta

Nebula Beta

Unlock your full community experience!

About santonic