About User_333

User_333 · ‎03-09-2018

In vWire, packets will (according to documentation) always leave the same box which received the packet. If the other box is responsible for L7 processing the packet will be sent trough HA3 to the other box for L7 processing. After this, it is either blocked or sent back to the first box trough HA3 which will send it out the other side of the vWire. In no case (bugs excluded), a "vWire"-packet will leave the data interface on the other box. With this, it is guaranteed Paloalto wont generate a loop since it behaves like a cable. Sorry, currently no clue why this could be happened.

User_333 · ‎03-09-2018

ASA did no failover/split-brain during this change?

User_333 · ‎06-16-2017

Moving an Object (at least Address, Service, Region Objects) from a device Group to "Shared" is possible trough the GUI the follow way: - Navigate to Objects -> Address - Choose Device Group which contains Object - Select the Address (could also be more than one at the time) - Click on "move" at the bottom (next to add/del) - Popup will be there to choose the new Device Group or "shared" I never tested to move from "shared" to a device group, but i think it should work. Important: You will get an error if you move e.g. a device group to shared if not all objects within this device group are already shared. Works with Panorama 7.1

User_333 · ‎11-07-2013

Hello I made a CSR. Got my Cert and did the stuff mentioned in the "how to chained certificate", Copied the intermediate on top of my cert. but the PA-500 did not accept it. okey i tried it without the intermediate cert text - and it worked. Request is gone and now there is a valid cert. but now when i try to open the captivePortal Response page i get a Cert error. logicaly because of the missing intermediate part. is there a way to put the intermediate to the allready valid cert? or do i have to make a new request?

User_333 · ‎07-06-2012

If your side gets this "timeouts" log entries it would be interesting to see what the logs on the other side are (if its possible to get them).

User_333 · ‎07-02-2012

Seems the second last commit was failed and a NAT Rule from there was the issue. Changing the NAT IP pool from x.x.x.0/26 to x.x.x.1 solved the issue (on a new rule from the second last commit). Since i am using "dynamic-ip-and-port", having just one ip is no big deal. But i am still asking me, why I am not able to define a /24 network as IP Pool. I am even more confused if i am looking at other NAT rules which have a /26 network as IP Pool. So, this shouldn't be a problem. Is there somewhere a limit for IP Pool addresses?

User_333 · ‎07-02-2012

After updating Policy and Nat Rules, I got the follow commit errors: - Error: Error: Error updating NAT IP pools - Error: response from cfgpush.s1.dp1.comm.cfg-dp: Error updating NAT IP pools This error still occurs if i disable (or even delete) the newly added rules. Since i did a commit ~10min before, i am sure, i didn't changed anything else. So, i am looking for an advanced command which gives me more info (which object causes this error). Hope somebody can help me.

User_333 · ‎02-23-2012

Yes, it's definitely not needed to INSTALL 4.1.0 in front of a upgrade to 4.1.2. The only requirement is a downloaded 4.1.0 Firmware. This is described in the Admin Guide (Page 38) too: You must have a base image downloaded before you can install an update version. For example, you must have 4.1.0 downloaded (not installed) before you can upgrade your 3.1.9 device to 4.1.4.

User_333 · ‎02-14-2012

Looking at Wikipedia isn't always helpful. E.g. if you are looking for allowing icmp-echo-requests, the app don't contain icmp or echo, it's the ping app. So I am looking for TCP-9000. Wikipedia shows me three entries and the third one (SqueezeCenter) is the one I am looking for. Applipedia don't contains something with "Squeeze" which leads me to the question: Is this app supported or is their just a different name? It seems, without testing you will never find out.

User_333 · ‎02-14-2012

Hello Sometimes I just get the TCP ports for firewall configuration changes. Since the configuration on the Paloalto should based on the AppID's rather than TCP ports, is there a way to search for AppID's which are using a defines TCP Port (eg. tcp-9000)? Since every App has a "Standard Ports" Attribute, the Information are there, but it seems neither the Firewall GUI itself nor on the Applipedia (http://apps.paloaltonetworks.com/applipedia/) supports such a filtering possibility. Is there another way?

User_333 · ‎02-13-2012

As described, we have some VPN tunnels which allows any traffic (Proxy IDs 0.0.0.0/0). With this, we have a GRE-Like Encrypted tunnel. With VPN, there are always a lot of NAT configuration which could be wrong. Since the administrators on most of our remote sites aren't big companies, there usually don't have big knowledge in special NAT configurations. So, they are sometimes wrong and on a Zyxel (or similar) firewall, it is not easy to debug. Sometimes they even struggle on the routing part. An easy way to find configuration issues on the remote firewall (if you don't have access to it), is looking at the traffic which is coming from this VPN. Routing Issues -> No Traffic at all NAT issues -> Traffic with wrong source/destination IP If you can do a filter on outgoing interfaces, it's also an easy way to check if my NAT is correct. As described, I am looking for traffic which is not as expected. So, i am not able to filter it based on IP information. And for a setup like "each VPN has its own zone" (so I can filter based on Zone) the Paloalto doesn't support that much zones as we have tunnels.

User_333 · ‎02-09-2012

Hi I am looking for a way doing a packet capture (or Debug Flow) with a filter based on a defined VPN Connection. The only thing I found, was a filter like "debug dataplane packet-diag set filter match ingress-interface tunnel" but with this I am not able to filter just one VPN Connection (eg tunnel.100). It seems, this command doesn't support sub-interfaces. Filtering based on src-/dst-address is not possible since we sometimes use GRE like VPN's (both sides of Phase2 ProxyID's are 0.0.0.0/0) and I want to check if src-/dst-IP are the right ones. Also, filtering based on zone is not possible since all our vpn tunnels are in the same zone (firewall doesn't support that many zones as we have tunnel interfaces)

User_333 · ‎02-08-2012

Isn't it possible to upgrade directly to 4.1.2? Why is this intermediate step to 4.1.0 needed?

User_333 · ‎01-09-2012

I am trying to create some reports based on the "Threat Summary Log"-Database. Unfortunately, I am not able to create a report which shows me just the blocked threats. If I use the "Threat Log"-Database, the report works fine (but to short time period), so I think the action is not stored in the Summary-Database. Can I change this behavior and add the action to the Summary Log?

User_333 · ‎11-10-2011

Hi To block a webpage like Facebook, I have the follow two possibilities. 1) Block it by the Url Filter 2) Block it by the AppID Since the URL Filter just looks at the URL and no other content. Access to Facebook will only be blocked if I try to access it by "www.facebok.com". But access via "http://translate.googleusercontent.com/translate_c?hl=de&rurl=translate.google.ch&sl=de&tl=en&u=http://www.facebook.com/&usg=ALkJrhh_Iem_Ly3suOQ6H0aOBboI4hw4wg" will not recognize it as the Facebook URL --> no blocking If I use the AppID to block Facebook, I am expecting even blocking this Google translate URL since the content is still Facebook. But this isn't the case. I don't get any Facebook app in my traffic log. So, what is the exact difference between URL Filtering and AppID's (for "Website"-AppID's) and how can I block all this even if the user uses Google translate?

Member Since	‎02-10-2011 02:59 AM
Date Last Visited
Posts	23

About User_333

Re: A/A vWire Deployment Forwarding MAC Address on HA Links?

Re: A/A vWire Deployment Forwarding MAC Address on HA Links?

Re: Panorama shared objects

Problem with chained Cert

Re: IPSec VPN tunnel no longer working

Re: Commit issue - Error updating NAT IP pools

Commit issue - Error updating NAT IP pools

Re: Upgrading 4.07 to 4.1.2 in HA environment

Re: Looking for AppID's which uses a defined TCP Port

Looking for AppID's which uses a defined TCP Port

Re: Recommended stable release for PAN-OS 8.0.x

Re: Frustration with Panorama

Re: most stable panos 6?

Re: A/A vWire Deployment Forwarding MAC Address on HA Links?

Re: A/A vWire Deployment Forwarding MAC Address on HA Links?

Re: Panorama shared objects

Problem with chained Cert

Re: IPSec VPN tunnel no longer working

Re: Commit issue - Error updating NAT IP pools

Commit issue - Error updating NAT IP pools

Re: Upgrading 4.07 to 4.1.2 in HA environment

Re: Looking for AppID's which uses a defined TCP Port

Looking for AppID's which uses a defined TCP Port

Re: Packet Capture/Debug Flow based on an IPSec VPN

Packet Capture/Debug Flow based on an IPSec VPN

Re: Upgrading 4.07 to 4.1.2 in HA environment

Action in "Threat Summary Log"

Blocking by AppID don't work as expected

Unlock your full community experience!

About User_333