About Sethupathi

Hi,   I configured GP pre-logon method, But it’s only working in administrator mode even though the user is part of administrator group, it’ not working for normal users.   I followed below KB article, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEYCA0   In global protect client installed laptops, we are able to connect global protect,  add the machine to domain and user to local admin group remotely in the administrator mode. That means Global Protect is working fine. Post basic GP Pre-logon configuration, when we select switch user or reboot laptop and try to login with a normal user, it’s showing the error “Global Protect Disconnected”(Wi-Fi is connected ) because of this we are unable to use Global Protect client in the remote laptops(The system which are not in office).   Can anyone provide your suggestion, why the global protect client is not working (means pre-logon connectivity is not happening) in the laptops when we switch user or log-in as a admin privileged user. PFA for the error.   Please help us here to fix an issue.   Regards, Sethupathi M ... View more

Hi,   I configured GP pre-logon method, But it’s only working in administrator mode even though the user is part of administrator group, it’ not working for normal users.   I followed below KB article, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEYCA0   In global protect client installed laptops, we are able to connect global protect,  add the machine to domain and user to local admin group remotely in the administrator mode. That means Global Protect is working fine. Post basic GP Pre-logon configuration, when we select switch user or reboot laptop and try to login with a normal user, it’s showing the error “Global Protect Disconnected”(Wi-Fi is connected ) because of this we are unable to use Global Protect client in the remote laptops(The system which are not in office).   Can anyone provide your suggestion, why the global protect client is not working (means pre-logon connectivity is not happening) in the laptops when we switch user or log-in as a admin privileged user. PFA for the error.   Please help us here to fix an issue.   Regards, Sethupathi M ... View more

Hi Team,   I am just wondering on how to made Dual IPSec VPN Tunnel UP at the same time with redundant ISP link after mapping each ISP in different VR.     We have configured dual VR. In that, Primary ISP port is mapped in Primary VR and Secondary ISP port is mapped in Secondary VR.   Due to this above scenario, in order to made the Phase1 UP for the Secondary IPSec Tunnel is not happening because we have given Default route forwarding to the Primary ISP in the Primary VR.   So all the traffic is getting established via the Primary ISP. And then i have tried creating PBF policy for traffic sourcing from Trusted interface to Tunnel N/Ws to forward on the Secondary IPSec Tunnel Interface. However, still the Phase1 of the Secondary Tunnel is not coming UP.    Is there are any option to have this requirement accompolished. I am eagerly waiting for your inputs on the same. Thanks in advance !!   Best Regards, Sahul Hameed ... View more

Hi Team,   we have done multicast configuration and we are unable to receive multicast through firewall PA-3060. Also whenever we did add our LAN interface into multicast configuration “ other IP flood” critical threat gets started into that particular LAN as shown below. Kindly help me to resolved the same.   Scenario as below, Requirement as per diagram: PA-3060 WAN interface should receive multicast traffic via ae1.3013 interface and should forward the same to LAN subnet i.e.ae2.3 interface As per above scenario which interface should I add the RP typeae1.3013 or ae2.3 ..??   We have done following configuration.   Whenever we did configure ae2.3 in multicast configuration other IP flood started in OFT-LAN subnet and dataplane CPU spike up.   Should I increes the SYN alarm rate or disable the SYN in zone protection here? (IS THAT CORRECT?) NOTE: we have PA-3060 modal with PAN-OS 8.0.16   Could you please provide your valuable suggestion here to fix an issue.   Regards, Sethupathi M ... View more

Hi Team,   Can anyone provide your valuable suggestion here please. Below are the VAPT points shared by customer and solution provided :   PA Vulnerability points (For reference please find attached pdf) : 1) ssl/tls protocol initialization vector implementation information disclosure vulnerability (BEAST) - SSL/tls profile needs to be configure for firewall mgmt access. SSL/TLS version we can keep from TLS1.1 to TLS 1.2 2) ssl/tls protocol initialization vector implementation information disclosure vulnerability (BEAST) - SSL/tls profile needs to be configure for firewall mgmt access. SSL/TLS version we can keep from TLS1.1 to TLS 1.2 3) SSL self-signed certificate - Purchase a certificate 4) ssl certificate cannot be trusted - Purchase a certificate 5) ssl certificate cannot be trusted - Purchase a certificate 6) SSL medium strength cipher suites supported(sweet32) - ECDSA certificate configure in Firewall 7) SSL certificate siged using weak hashing algorithm - ECDSA certificate configure in Firewall 😎 SSH weak algorithm supported - enable only GCM and CTR ciphers , only applicable above 8.0 version 9) HSTS missing from HTTPS server - Need to check with tac 10) HSTS missing from HTTPS server - Need to check with tac 11) HTTP Methos allowed (per directory) - Need to check with tac 12) HTTP Methos allowed (per directory) - Need to check with tac 13) SSH server CBC mode ciphers enabled - enable only GCM and CTR ciphers , only applicable above 8.0 version 14) SSH weak mac algorithm enabled - we can disable ssh weak mac algorithm , only applicable above 8.0 version   Please correct if anything wrong.   Software Version 7.1.21 Model PA-500   Please help us here to provide solution of following questions if anyone knows,   9) HSTS missing from HTTPS server - ? 10) HSTS missing from HTTPS server - ? 11) HTTP Methos allowed (per directory) - ? 12) HTTP Methos allowed (per directory) - ?     Regards, Sethupathi M ... View more

Hi Team,   We've configured to schedule reports for email delivery on daily basis, It was working fine without any issues but last week we had restarted the Palo Alto firewall, Since from that day we're not getting custom report email.   When we check "send test email" on Email Sheduler its working fine. Verified all the configuration which is fine only, There is no configuration changes made.   When I analyse Tech Support File seen { Thread 1 (LWP 6169): logrcvr restarted unexpectedly however no known issue was identified. Please open a case if further assistance is required} <-- does it shows any bug of known issue..??   Seen following errors, Can anyone explain for what cause it showing this following error..??   paadmin@HO-LAN-PA500-PRI> tail follow yes lines 25 mp-log ms.log Error: pan_cfg_mgr_handle_local_request(pan_cfg_mgr.c:29763): The following request could not be handled: <request cmd="op" complete="/operations/tail/lines" cookie="6219025012107925" pobj="/config/devices/entry[@name='localhost.localdomain']"><follow>yes</follow></request> client dagger reported op command was SUCCESSFUL client dagger reported op command was SUCCESSFUL Error: pan_get_current_gp_datafile_release_date(pan_cfg_utils.c:5444): Failed to parse file /opt/pancfg/mgmt/global-protect/av-data/av_data_file.dat Error: pan_cfg_mgr_get_sp_disabled(pan_cfg_mgr.c:5509): failed to fetch: NO_MATCHES Error: pan_cfg_mgr_get_tpl_disabled(pan_cfg_mgr.c:5534): failed to fetch: NO_MATCHES Error: pan_get_current_gp_datafile_release_date(pan_cfg_utils.c:5444): Failed to parse file /opt/pancfg/mgmt/global-protect/av-data/av_data_file.dat NO_MATCHES client dagger reported op command was SUCCESSFUL client dagger reported op command was SUCCESSFUL Memory dump size: 0 client dagger reported op command was SUCCESSFUL 'cfg.corr.enabled': NO_MATCHES   Note: PAN-OS :8.0.4 PA-500 Can anyone provide your valuable suggestion here to fix an issue please!   Thanks And Regards, Sethupathi M   ... View more