About S.Cantwell

Thanks @BPry !   I have tried many different iterations, changing service routes, around, etc. I even changed the default GW of the Mgmt interface, so that it bypasses the FW itself, and issue continues.   Strangeness in that we noticed an old VM firewall that was spun up (pretty much untouched) since Jan 12, and it cannot get updates as well. We also know that the updates.paloaltonetworks.com is also in GCP now, so maybe some intern-GCP routing issues.   We have tried staticupdates.paloaltonetworks.com and various public IPs, and it (for what seems to be) system wide, hence my email to all GCP spun up firewall ppl, to test... maybe it is our KVM, but yet, other traffic works fine.   Weird... just leaving this up for others to comment in.     ... View more

Hello   I do not think that we, as endusers, have access to see the files, the form you are looking at. We do not have access to the root/base system of the appliance (security appliance, right?  ;>)   Some of those log files can be seen by doing a "less mp-log ?" and listing out the 116 log entries and looking at whatever specific one you would require.   /dev/sda6             3.8G    2.7G    932M  75% /opt/panrepo Reports would be well, under the Monitor Tab...   /dev/sda5             7.6G    2.1G    5.1G  29% /opt/pancfg Your configurations would be on the hard drive (which you have access to)   /dev/sda8             125G   403M    118G   1% /opt/panlogs All logs (system, threats, traffic, user-id, etc) are under the Monitor Tab   Some like this....    Enjoy. ... View more

I truly believe, from a technological perspective, that Google is using proprietary encryption techniques that will cause PANW SSL Decryption to fail.    It simple terms... I am not sure you are you able to properly decrypt google related traffic.....   ... View more

Basically.. you are somewhat good.   Now the mgmt port itself (not /11 or /12) has about 20 services (NTP, Panorama, DNS, Wildfire, etc)   What public facing interface on the FW is going outbound to get updates, such as NTP, DNS, WF, etc, etc?)       ... View more

These are the supported SSH v2 ciphers. By configuring and allowing only these, then V1 will not work.   So there is no way to disable SSHv1 support, only configuring the FW to allow the stronger ones, if that makes sense.   According to research... when the scanner tested again, it passed without warning, which is what you are looking to do, I presume...get the warning to no longer show in a scan?   Steve ... View more

I did some research, and if you are on 8.0 and higher, you should be able to configure these   configure set deviceconfig system ssh ciphers mgmt aes128-cbc set deviceconfig system ssh ciphers mgmt aes192-cbc set deviceconfig system ssh ciphers mgmt aes256-cbc set deviceconfig system ssh ciphers mgmt aes128-ctr set deviceconfig system ssh ciphers mgmt aes192-ctr set deviceconfig system ssh ciphers mgmt aes256-ctr set deviceconfig system ssh ciphers mgmt aes128-gcm set deviceconfig system ssh ciphers mgmt aes256-gcm   Will these work for you? ... View more

Hello there!   This is very common on any SSH server that is attempting to perform reverse DNS lookup.   So if you are pointing to an internal DNS server, modify your resolv.conf file or similar to add a static entry in for your IP. Then, it should resolve faster.     ... View more

If you are authenticating to the Panorama, you should be logging in using admin/admin as user/password combo. You didn't say if you were attempting to do SSH public key authentication, so I am confused about this.   You would normally use public ssh key to connect to a virtualized linux or unix box, or similar. I work in GCP and I know there a "console" port available to always have connectivity to the Panorama. Perhaps you can provide more details, with a simple drawing of what you have, and how you are attempting to connect.   What other questions can we answer for you? ... View more

There were many changes in the 8.1 in terms of features sets and how Panorama is seen/used. In pre 8.1, the Panorama only came up in Legacy mode.  In 8.1, I believe there is now a mode call Panorama mode. When you look at your Dashboard on Panorama, what does it say?   Also, I think (strongly believe!!!) that you should be upgrading FWs to 8.1 or higher. Both 8.0 and 7.x are now considered out of support, so you may not be able to contact support for  resolving this.   What other questions can we answer for you?     ... View more

Hello again.   You and I just discussed this last week, regarding DHCP and the Mgmt interface. Have you configured and enabled an interface management profile on ether1/11?   I have a simple 2 port network, on a PA220 (well, technically 3, if you could count the mgmt interface)   My network is 172.17.13.0/24 with my management interface using IP of 172.17.13.253.   REGARDLESS of that piece of information.. My ethernet1/2 is the inside of my network, doing DHCP as well. The Ethernet1/2 IP is 172.17.13.253/24. It acts as my DHCP server as well.   Anything plugged into my downstream switch can/could SSH into 172.17.13.254, because I enabled an interface management profile that allows SSH.  This should 100% work.   So I do not understand why the RHEL server cannot simply SSH into your eth1/11.. why must it be connected to eth1/12? Maybe you can help me to understand that, and then we can move forward.   I know I do not want to make it more complicated for you.. but it really sounds like what you need a 2 port vlan, with a VLAN interface that is doing the DHCP and allowing access to mgmt functionality.   eth1/11  ====\                        |==> VLAN Interface, supporting DHCP, with interface mgmt profile allowing SSH. eth1/12 ====/   Or you can create 2 separate networks 192.168.0.0/28 and then a different network (192.168.1.0/28) and have the virtual router do the routing between them.     What does your security policy show.  Can you see traffic attempting to pass through the FW?   I am available for a phone call tomorrow (12/31) if you send me a message.  This should have been resolved last week.  😛 ... View more