About santonic

santonic · ‎06-18-2014

Thank you for the answer. I've checked the document but didn't find any info about Cisco parts. I guess that means they aren't officially supported. I'll contact my SE anyway just in case.

santonic · ‎06-17-2014

Hello. Has anyone tried connecting Cisco SFP+ Twinax Copper Cables (sfp-h10gb-cu1m) to PA-5050 device? I've tried to find some info about it on PA KB but wasn't successful. Is there any document issued by PA listing all the supported 3rd party devices? Best regards, Simon

santonic · ‎06-09-2014

Thank you for your response. Yep, action in rule is on 'block'. I just wasn't 'lucky' enough to find an event triggered by this signature in logs to verify how it works. Still a way to check current response for certain signature would be useful.

santonic · ‎06-09-2014

I'd definitely recommend using an IP address which is a part of encryption domain (proxy ID) so you don't have to worry about adding extra routes.

santonic · ‎06-09-2014

Hello. I have a general IPS profile with a rule (named block-crit,high) which includes all signatures with severity 'critical' and 'high'. Action for the rule is set to 'block'. I have automatic updates on for IPS signatures. Yesterday a new signature (OpenSSL SSL/TLS MITM vulnerability) was released with severity critical. When I checked my IPS profile today i noticed that signature was correctly included in above rule (block-crit,high) but the action for this signature was set to 'default (alert)' despite the action for rule being 'block'. Is this expected behaviour? Are all new signatures set to default action? Can you set new signatures to block? Best regards, Simon Antonic

santonic · ‎04-14-2014

Yep, we started with dedicated user with only required permissions according to PA guide. However customer has 2003 AD and 'event reader' groups is not present there. So instead of going through specific procedure for 2003 AD permissions (also described in one of the PA guides), the customer decided to give domain admin rights to the user.

santonic · ‎04-11-2014

I've just realised, that CET is actually CEST at the moment because we're on summer time. So it's not 3 letter right now.

santonic · ‎04-10-2014

Hello. I deleted the servers, discovered them again, re-entered the credentials and didn't get the same error again. Customer has also been changing rights on user account so I'm not sure what solved the issue. However it would be good to get some explanation about what that error message actually means and how to solve it if it happens again. Right now I am encountering situation, where PA is able to connect to one of 2 AD servers and is getting 'access denied' for the other. The user has domain admin rights, both servers are in same domain and in the same network. So i can only assume that their AD cluster has some issues. Has anyone encountered similar situation? Best regards, Simon

santonic · ‎04-10-2014

Hello. I've changed timezone to CET (which has 3 chars and is exactly my zone), commited policy and it didn't help. I still have errors for Antivirus and Applications and threats. Best regards, Simon

santonic · ‎04-07-2014

Yep, i can resolve both names and ping them both. I already checked Service Route Configuration and everything is on default.

santonic · ‎04-07-2014

Hello. When debugging clientless User-ID I've noticed a strange entry in useridd.log log file. I'm trying to connect to 2 AD servers. It says: 2014-04-07 10:44:09.875 +0200 Error: pan_user_id_win_log_query(pan_user_id_win.c:1319): log query for server1.xyz.aa failed: [lib/socket/interface.c:212:load_in terfaces()] ERROR: Could not determine network interfaces, you must use a interfaces config line I can't find any info about this entry. Any ideas what does it mean? For 2nd server I'm getting more usual error message: 2014-04-07 10:51:54.723 +0200 Error: pan_user_id_win_log_query(pan_user_id_win.c:1319): log query for server2.xyz.aa failed: [wmi/wmic.c:200:main()] ERROR: Log in to remote object. Both are of course listed as 'access denied'. Both servers are reachable and in same network. I'm pretty certain 2nd error means insufficient rights on user credentials. But 1st error looks strange and I can't find any info about it. Any ideas?

santonic · ‎03-10-2014

Yeah, I was thinking the same. But wanted to check to be sure. Thanx for the answers. I have a following scenario for which I haven't found a solution yet: I only want a route directing traffic into IPsec tunnel to be distributed if the IPsec tunnel is up. However static route remains active in routing table even if IPsec tunnel is down and I can't use PBF as it doesn't affect routing table. Any other ideas?

santonic · ‎03-07-2014

Hello. Is the above possible? Can a PBF route be further distributed over a dynamic routing protocol like OSPF? Best regards, Simon

santonic · ‎01-13-2014

I agree; some official post about this would be great. We're also having a potential customer trying to block Stonesoft Evader techniques. Seems the only IPS system which successfully blocks Stonesoft Evader is McAfee IPS. However how relevant is this now that McAfee owns Stonesoft?

santonic · ‎11-21-2013

Quote:"To allow such traffic you will need to allow applications 'pptp' and 'gre'. If you have NAT inbetween, then you will need to use static NAT to your PPTP server since there is no port to translate for GRE traffic. " To resurrect old thread; has this issue been resolved in newer PAN-OS releases or is static NAT still required for outgoing GRE connections? As far as I know you can track some parameters in GRE packet to send it to the correct host and in this way GRE should be possible with dynamic NAT as well. Can someone please confirm this?

Member Since	‎01-26-2011 05:56 AM
Date Last Visited	‎01-07-2025 03:06 AM
Posts	672
Total Likes Received	191

Online Status	Offline
Date Last Visited	‎01-07-2025 03:06 AM

About santonic

Re: Telemetry - Hostname/url is in illegal/bad format

Re: Config Audit Failure

Importing (Cisco) switch configuration to Expedition

Re: Config Audit Failure

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Expedition - re-assign zones after change in routing

Re: Expedition - re-assign zones after change in routing

Re: QoS configuration based on destination (sub)interface on 3400 series

QoS configuration based on destination (sub)interface on 3400 series

Re: Can't generate output files

Re: Browser not prompting/selecting client cert for GP portal

Re: Panorama management for Cloud NGFW

Re: App Identification and ALLOW rule - does this make any sense?

Re: What is PA equvalent to show Xlate to view NAT translations

Why is SMB traffic slow ?

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Why is SMB traffic slow ?

The World’s First ML-Powered NGFW

Re: Cisco SFP+ Twinax Copper Cables to PA-5050

Cisco SFP+ Twinax Copper Cables to PA-5050

Re: IPS - new signature's action set to default instead of the action specified in rule

Re: VPN Tunnel Monitoring

IPS - new signature's action set to default instead of the action specified in rule

Re: Clientless User-ID problem

Re: Antivirus and apps - Error in retreiving data - PAN OS 6.0.1

Re: Clientless User-ID problem

Re: Antivirus and apps - Error in retreiving data - PAN OS 6.0.1

Re: Clientless User-ID problem

Clientless User-ID problem

Re: PBF route distributed over dynamic routing protocol

PBF route distributed over dynamic routing protocol

Re: AET & PAN

Re: VPN problem with pptp and gre

Nebula Hardware Beta

Nebula Beta

Unlock your full community experience!

About santonic