About karthikeyanB

Hi Team We are facing issue with Proxy ID, we have configured before 114 proxyID in IPSec Tunnel and its working fine but recently we have added 4 more proxy ID in the same IPSec Tunnel. While we are not able to see the proxy IDs configured via GUI. Proxy id not seen in ssh session . but able to see in GUI.   Let me know if there is any Proxy ID Limitation is there ???   Additional Info: Show IPSec tunnel config: Total 138 tunnels found. Show IPSec SA: Total 138 tunnels found. 55 ipsec sa found.   Model No: PA-3250 PAN OS: 9.1.4   Please anyone help to resolve this issue   Regards Karthikeyan Balamurugan ... View more

Dear Team,   Please help us to below points... For 9.1.3 what should be the VM Sizing for the Panorama We are migrating from 8.1.10 to 9.1.3 whether the logging format will change There is default behaviour Changes can you give a heads up Regards Karthikeyan Balamurugan ... View more

Dear Support Team,   Please do us favour to update Security appliance Palo Alto with latest signature which help to prevent from latest vulnerability Authentication Bypass in SAML Authentication.   Patch requirement for CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication   Regards Karthikeyan Balamurugan ... View more

Dear Team ,   One of our customer had vapt points of ssh weak ciphers vulnerabilty we had run the below commands     set deviceconfig system ssh ciphers mgmt aes256-ctr   set deviceconfig system ssh mac mgmt hmac-sha2-256  set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256 set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 2   so the customer had run vapt again, they are getting arcfour weak ciphers error. https://live.paloaltonetworks.com/t5/general-topics/how-to-disable-ssh-weak-algorithm-supported/td-p/204407   Note: Threat License expired   Regards Karthikeyan Balamurugan ... View more

Dear Team,   We are facing an issue in VPN where in Authentication of users is removed frequently at a random time.   IMPACT :   We have created Source User base policy - Hence once a user session is timed out, browsing of the user is impacted. User needs to relogin and then can access Internet Traffic. However Tunnel is always active and only "User Authentication" gets removed.   1) Browsing error - When the auth of the user is removed, user web browsing traffic gets blocked. 2) Session Browser - We Seen Traffic Details 3) System Logs - we got session timeout notification 4) Traffic Logs - Showing traffic hitting deny rule. 5) URL Logs - Showing Source Users mapped to ip gets removed (Zoom Webex is ip base policy and hence traffic gets routed through that Security Policy)   PAN  OS Version : 9.0.7   Please help to resolve the issue ASAP   Regards Karthikeyan Balamurugan ... View more

Dear Team,   As per the customer requirement we want to perform Port spanning or port mirroring on the firewall interface so we need confirmation whether it is recommended from Palo Alto and if we perform this will there be any impact on the firewall as firewall is in production at data center or is there any alternate method for this.   Request your immediate help on this.   Regards Karthikeyan Balamurugan ... View more

Dear Team,   We are not getting proper report for Last calendar month using query builder i.e (zone.src eq VPN) and destination is any and report has generated from 17 April to 23rd April. When use  query builder i.e (zone.src eq VPN) and  (zone.dst eq LAN) it is showing whole month report i.e starting from 1st April to 30th April.   Regards Karthikeyan Balamurgan ... View more

Team,              Below Advisory mentioned that openssh 7.9 is affected with few vulnerabilities  and on upgrade to 8.1.13 will resolve it. https://security.paloaltonetworks.com/PAN-SA-2020-0002   but below pan os open source listing mentioned as openssh version is 6.4 is used.  So can you please confirm whether update is required and whether update to 8.1.13 will resolve the issue???   https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-8-1-open-source-software-oss-listing.html Or whether Openssh version identification method is incorrect??   Warm Regards, Karthikeyan Balamurugan ... View more

Hello Team,   The below things are need to clarify,,,   How to know calculate SSL VPN interfaces bandwidth Individual VPN user bandwidth consumption Which VPN interface the highest bandwidth user is connected to All active connected VPN users Time duration of the connected VPN user if we enabled Split tunnel, SSL VPN Bandwidth should be increase?? Regards Karthikeyan Balamurugan ... View more

Hi,   We are facing issue with DNS Application, it uses more DP CPU Utilization 60 to 70%. We have done DNS Application override but no luck.   Please find the DNS Session details below.   Mem-Pool-Type MaxSz(KB) Threshold MinSz(KB) CurSz(B) Cur.Alloc Total-Alloc Fail-Thresh Fail-Nomem Local-Reuse(cache) dns 2048 80023 1024 830152 10012 279410 0 0 23472 (5)   Cache-Type MAX-Entries Cur-Entries Cur.SZ(B) Insert-Failure Mem-Pool-Type dns 7936 0 0 0 proxy dns_v4 10000 10000 829576 0 dns dns_v6 10000 0 0 0 dns dns_id 1024 12 576 0 dns   show running application statistics =================================== App (report-as) sessions packets bytes app changed threats dns 617738743 2661297868 269003342139 0 0 dns-over-https 144 3304 928999 145 0 DNS_Custom 914095 3979943 370509720 0 0 google_Custom 11823 1441034 876588498 0 0 google_Custom-1 105603 953550 198205705 105725 0 google_Custom-2 169 1735 380693 482 0 google_Custom-3 1 10 2237 6 0 google_Custom-4 15447 142899 31053748 15573 0 alipay 213 8487 3887252 214 0   How to reduce the DNS session count or any other alternative way to overcome this issue?   Any help here would be appreciated.   Regards Karthikeyan Balamurugan ... View more