About minow

minow · ‎06-21-2017

thanks, i was able to solve it somehow. also the command i use for the cli was wrong , i needed the "registered ip" and not the "dynamic group"

minow · ‎06-19-2017

Hey i just noticed that on panroama 8.0.2 when you move multiple rules to other Device group than the rules are moved in other order than the original order. for example if you select the last rule and than select the first rule and move than to other device group they will apear in the reverse order

minow · ‎06-10-2017

Hey how can i see debugs of MineMeld such as API calls to the PA for DagPusher , HTTP requests for miners etc etc... thanks

minow · ‎06-10-2017

hey i have started playing arround with MineWeld. i am testing a solution for a customer to update DynamicObject / Block lists on the PA to be used by the SOC team. i have created a IPv4 List and connected it directly to a DagPusher node. but when i add an indicator to the miner i do not see it on the PA dynamic group. this is what i see on MineWeld This is the config , i assume here that the TAG is the TAG on the PA that the dynamic group should catch the objects, is it right ? this is the configured dynamyc group admin@PA-LAB> show object dynamic-address-group all Dynamic address groups in vsys vsys1: ---------------------------------------------------- ----------------defined in vsys -------------------- SOC-BlockIPs filter: 'SOC-BlockIPs' members: total 0 ----------------defined in shared------------------- O: address object; R: registered ip; 😧 dynamic group; S: static group Another question that i have is suppose the PA is not "alive" to get the updates , will MineWeld try to push the updates once ? or it will try again in a loop and wil update the device with the changes when it will be back ?

minow · ‎03-19-2017

hey hey we have some problem with old system that are beeign stuck after some tome it is working and on the logs we see the session end reason is "tcp-reuse" my questions are: 1) what should be happaning on the network flow for this end-reason log to apear 2) will the FW generate some traffic to the client and server to "close" their existing connection? thanks

minow · ‎02-20-2017

hey all i have a 2 sites and we have between them 2 VPN tunnels (different ISPs) and on top of the VPN i am running OSPF for some reason i see a lot of times that the IKE Gateway status is RED , but on the SSH i do see that i have an IKE-SA. what i notice is that after i run "test vpn ike-sa gateway Boston-HOT" on one PA the status goes to GREEN , after i run "clear vpn ike-sa gateway Boston-HOT" it goes to RED but i still have the IKE-SA between the PAs, also while "RED" te OSPF peer seems to still be availible using both of the tunnel interface is this make sense?

minow · ‎02-19-2017

does anyone have any idea on how to debug those kind of issue ? support ticket might not be availible as fast as knowing this when it is needed.

minow · ‎02-18-2017

the problem was with diskspace on the PA . figure it out after i tried to view local configuration and it failed. after clearing some core logs and old system logs i was able to commit locally and from panorama

minow · ‎02-18-2017

tried restarting device server web-server tried to roll back to configuration from the same day morning nothing helped. this is a remote site PA so i am not comfertable in restarting the device right now

minow · ‎02-16-2017

the wiered issue i cannot login to the webUI , show certificate warning but i get blank page

minow · ‎02-16-2017

show jobs id 4706 Enqueued ID Type Status Result Completed -------------------------------------------------------------------------- 2017/02/16 09:22:06 4706 Commit FIN FAIL 09:23:15 Warnings:Duplicate certificate subject found: /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 /OU=Domain Control Validated/CN=*.mydomain.com Details:Commit failed mplog los 2017-02-16 09:23:08.597 -0600 client satd reported Phase 1 was SUCCESSFUL 2017-02-16 09:23:09.665 -0600 client l2ctrld reported Phase 1 was SUCCESSFUL 2017-02-16 09:23:10.773 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client l2ctrld went down from 99 to 98 2017-02-16 09:23:14.391 -0600 Error: pan_mgmt_client_table_do_commit(pan_cfg_commit_jobs.c:3575): phase 1 failed 2017-02-16 09:23:14.396 -0600 client routed reported error: config commit phase 1 aborted(Module: routed) 2017-02-16 09:23:14.396 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.402 -0600 client device reported error: Config commit phase 1 aborted(Module: device) 2017-02-16 09:23:14.402 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.406 -0600 client ikemgr reported error: panike_daemon phase 1 aborted(Module: ikemgr) 2017-02-16 09:23:14.406 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.412 -0600 client dhcpd reported error: config commit phase 1 aborted(Module: dhcpd) 2017-02-16 09:23:14.412 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.415 -0600 client varrcvr reported error: config commit phase 1 aborted(Module: varrcvr) 2017-02-16 09:23:14.415 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.419 -0600 client l3svc reported error: modhttpd phase 1 aborted(Module: l3svc) 2017-02-16 09:23:14.419 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.422 -0600 client sslvpn reported error: modsslvpn phase 1 aborted(Module: sslvpn) 2017-02-16 09:23:14.422 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.426 -0600 client rasmgr reported error: rasmgr phase 1 aborted(Module: rasmgr) 2017-02-16 09:23:14.426 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.433 -0600 client satd reported error: satd phase 1 aborted(Module: satd) 2017-02-16 09:23:14.433 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.438 -0600 client websrvr reported error: modappweb phase 1 aborted(Module: websrvr) 2017-02-16 09:23:14.438 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.454 -0600 client pppoed reported error: config commit phase 1 aborted(Module: pppoed) 2017-02-16 09:23:14.454 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.457 -0600 client dnsproxyd reported error: config commit phase 1 aborted(Module: dnsproxyd) 2017-02-16 09:23:14.457 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.461 -0600 client cryptod reported error: config commit phase 1 aborted(Module: cryptod) 2017-02-16 09:23:14.461 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.462 -0600 EBL cfg(0x118799a0, 0) Reverting EBLs 2017-02-16 09:23:14.467 -0600 Error: pan_cfg_commit_to_local_device(pan_cfg_commit_handler.c:2042): Commit failed 2017-02-16 09:23:14.475 -0600 client l2ctrld reported error: config commit phase 1 aborted(Module: l2ctrld) 2017-02-16 09:23:14.475 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:14.804 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client routed went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client ha_agent went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client device went down from 5 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client ikemgr went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client logrcvr went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client dhcpd went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client varrcvr went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client l3svc went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client rasmgr went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client useridd went down from 70 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client satd went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client websrvr went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client sslmgr went down from 98 to 0 2017-02-16 09:23:14.805 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client authd went down from 98 to 0 2017-02-16 09:23:14.806 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client pppoed went down from 98 to 0 2017-02-16 09:23:14.806 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client dnsproxyd went down from 98 to 0 2017-02-16 09:23:14.806 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client cryptod went down from 98 to 0 2017-02-16 09:23:14.806 -0600 Error: pan_mgmt_client_table_get_current_progress(pan_cfg_commit_jobs.c:3973): commit progress for client l2ctrld went down from 98 to 0 2017-02-16 09:23:15.396 -0600 client useridd reported Phase 1 FAILED 2017-02-16 09:23:15.396 -0600 Error: pan_mgmt_client_p1done_callback(pan_cfg_commit_jobs.c:258): but there was no outstanding Phase 1. Ignoring 2017-02-16 09:23:15.403 -0600 client useridd reported error: Config commit phase 1 aborted(Module: useridd) 2017-02-16 09:23:15.403 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:17.380 -0600 Could not find url vendor, returning paloaltonetworks as default 2017-02-16 09:23:25.504 -0600 UNKNOWN TID: MODIFY 1954 [RSP,v1] (100/27) { 'flgs': 0x2, 'pfx': [ sw.cfgagent.device., ], 'spec': abortp1, 'ss': [ ], } obj: [ True, ] 2017-02-16 09:23:27.307 -0600 client device reported error: Error: Internal Error(Module: device) 2017-02-16 09:23:27.307 -0600 Error: pan_mgmt_client_err_callback(pan_cfg_commit_jobs.c:800): but there was no outstanding Phase 0/Phase 1/Phase 2. Ignoring - verify: 0 2017-02-16 09:23:27.309 -0600 client device reported Phase 1 FAILED 2017-02-16 09:23:27.309 -0600 Error: pan_mgmt_client_p1done_callback(pan_cfg_commit_jobs.c:258): but there was no outstanding Phase 1. Ignoring 2017-02-16 09:23:27.675 -0600 Error: pan_mgmt_get_sysd_string(pan_cfg_status_handler.c:367): failed to fetch cfg.gpdatafile-release-date debicelog logs 2017-02-16 09:22:59.094 -0600 [TDB] Loading tdb cache /opt/pancfg/mgmt/content//cache/70000//tdb.cache.ser-0 with wildfire 0/0 virus 0/0 2017-02-16 09:22:59.094 -0600 calc md5 2017-02-16 09:23:14.401 -0600 Config commit phase1 abort 2017-02-16 09:23:14.401 -0600 tdb compile flag is still up, abort thread wait 1 second 2017-02-16 09:23:14.405 -0600 Error: cfgagent_modify_callback(pan_cfgagent.c:83): Modify string (sw.mgmt.runtime.clients.device.err) error: USER (1) 2017-02-16 09:23:15.412 -0600 tdb compile flag is still up, abort thread wait 1 second 2017-02-16 09:23:16.421 -0600 tdb compile flag is still up, abort thread wait 1 second 2017-02-16 09:23:17.432 -0600 tdb compile flag is still up, abort thread wait 1 second 2017-02-16 09:23:18.433 -0600 End of parsing custom threat 2017-02-16 09:23:18.441 -0600 tdb compile flag is still up, abort thread wait 1 second 2017-02-16 09:23:19.451 -0600 tdb compile flag is still up, abort thread wait 1 second 2017-02-16 09:23:19.499 -0600 [Cache] Load /opt/pancfg/mgmt/content//cache/70000//tdb.cache.ser-0 success 2017-02-16 09:23:19.515 -0600 [TDB] stats virus pattern 813145 , 104826 2017-02-16 09:23:19.519 -0600 Warning: pan_ctrl_compile_tdb(pan_config_handler_sysd.c:487): config commit aborted 2017-02-16 09:23:19.519 -0600 TDB compilation done, return 0 2017-02-16 09:23:20.461 -0600 kill SIGUSR1 to pid 0 2017-02-16 09:23:24.812 -0600 Error: pan_com_sysd_send_msg(pan_com_sysd.c:239): sysd_modify_obj() failed: TIMEOUT 2017-02-16 09:23:26.749 -0600 Error: pan_com_send_msg_through_sysd(pan_com_mp.c:337): pan_com_reset_sysd_reply_msg() failed 2017-02-16 09:23:26.749 -0600 Error: pan_status_send_msg(pan_status_handler.c:1208): pan_com_send_msg failed 2017-02-16 09:23:26.749 -0600 Warning: pan_ctrl_save_config(pan_config_handler_sysd.c:1686): config commit aborted 2017-02-16 09:23:26.749 -0600 Error: pan_ctrl_compile_cfg(pan_config_handler_sysd.c:1891): pan_ctrl_save_config() failed 2017-02-16 09:23:26.749 -0600 Error: pan_config_handler_sysd(pan_config_handler_sysd.c:2174): pan_ctrl_compile_cfg() failed 2017-02-16 09:23:26.749 -0600 Error: pan_ctrl_parse_config(pan_controller_proc.c:375): pan_config_handler_sysd() failed 2017-02-16 09:23:25.503 -0600 UNKNOWN TID: MODIFY 1268 [RSP,v1,URG] (100/26) { 'flgs': 0x1022, 'pfx': [ sw.comm.s1.dp0., ], 'spec': runtime.com, 'ss': [ ], } obj: [ None, ] 2017-02-16 09:23:27.215 -0600 Error: pan_ctrl_config_phase1(pan_controller_proc.c:725): pan_ctrl_parse_config() failed 2017-02-16 09:23:27.215 -0600 Config commit phase1 failed 2017-02-16 09:23:27.308 -0600 Error: cfgagent_modify_callback(pan_cfgagent.c:83): Modify string (sw.mgmt.runtime.clients.device.err) error: USER (1) 2017-02-16 09:23:27.309 -0600 Error: bool_modify_callback(pan_cfgagent.c:101): Modify boolean (sw.mgmt.runtime.clients.device.p1done) error USER (1)

minow · ‎02-16-2017

hey i am gtting commit fail on phase1 abort, and it looks like the SSL VPN proccess how can i troubleshoot it ? show management-clients Client PRI State Progress ------------------------------------------------------------------------- routed 30 P1-abort 0 ha_agent 25 P1-abort 0 device 20 P1-abort 0 ikemgr 10 P1-abort 0 keymgr 10 init 0 (op cmds only) logrcvr 10 P1-abort 0 dhcpd 10 P1-abort 0 varrcvr 10 P1-abort 0 l3svc 10 P1-abort 0 sslvpn 10 P1-abort 0 * rasmgr 10 P1-abort 0 useridd 10 P1-abort 0 satd 10 P1-abort 0 websrvr 10 P1-abort 0 sslmgr 10 P1-abort 0 authd 10 P1-abort 0 pppoed 10 P1-abort 0 dnsproxyd 10 P1-abort 0 cryptod 10 P1-abort 0 dagger 10 init 0 (op cmds only) l2ctrld 10 P1-abort 0 Overall status: P1-abort. Progress: 0 Warnings: Errors:

minow · ‎01-01-2017

add-type @" using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy { public bool CheckValidationResult( ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem) { return true; } } "@ [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy $ErrorActionPreference = "SilentlyContinue" $BACKUP_DIR = "d:\work\temp\" function getConfiguration () { Param( [string]$IP, [string]$HOSTNAME, [string]$KEY ) $URL = "https://" + $IP + "/esp/restapi.esp?type=export&category=configuration&from=running-config.xml&key=" + $KEY $TIMESTAMP = Get-Date -format dd-MM-yyyy $PATH = $BACKUP_DIR + $TIMESTAMP + "_" + $HOSTNAME + "_" + $IP + ".xml" Invoke-WebRequest -Uri $URL -OutFile $PATH } getConfiguration "1.1.1.1" "Boston" "<API KEY>" getConfiguration "2.2.2.2" "Florida" "<API KEY>" <# Generate the API Key Using https://<PA IP>/esp/restapi.esp?type=keygen&user=<username case sensetive>&password=<url encoded password> #<

minow · ‎10-09-2016

Hey I have a situation that my main site has 2 ISPs i configured the remote PA to talk with panorama thought the External Interface in order to maintain connectivity even if i have problems with the internal network on the remote site. I would like to have Panorama available from both of the ISPs. i had an idea to configure NAT on my main site for 2 IPs one on each ISP, and on the remote PA configure on the Panorama Server IPs both of the ISP. in this configuration the remote PA will contact a Main and Backup Panorama servers but will be nated to the same Panorama server. do you have an idea if the PA and Panorama will handle this type of connectivity Thanks

minow · ‎10-23-2014

i also noticed that this Flag is match to a rule by its "name" so if you changed the rule name it will be marked with no hits

Member Since	‎04-05-2011 05:40 AM
Date Last Visited	‎04-10-2022 04:34 AM
Posts	164
Total Likes Received	9

Online Status	Offline
Date Last Visited	‎04-10-2022 04:34 AM

About minow

Re: Azure SAML Authentication with multiple PAs

Re: Azure SAML Authentication with multiple PAs

Azure SAML Authentication with multiple PAs

Re: Static IP for GP User

Panorama Plugins

Re: using Azure MFA with Global Protect

Static IP for GP User

Re: How to secure PA to Panorama communication channel

How to secure PA to Panorama communication channel

Re: Keep Username for Two-Factor-Authentication Global Protect

How to secure PA to Panorama communication channel

Re: using Azure MFA with Global Protect

Re: DAG is not working

Re: Commit Fail Phase1 sslvpn

Backup Using Powershell

Re: using Azure MFA with Global Protect

Re: Keep Username for Two-Factor-Authentication Global Protect

Re: How to Schedule Configuration Export without Panorama?

Re: DAG is not working

Move Rules to Device Group Order

Debuging

DAG is not working

what exactly is tcp-reuse and does it sends session closure traffic to the client and server?

VPN Status

Re: Commit Fail Phase1 sslvpn

Re: Commit Fail Phase1 sslvpn

Re: Commit Fail Phase1 sslvpn

Re: Commit Fail Phase1 sslvpn

Re: Commit Fail Phase1 sslvpn

Commit Fail Phase1 sslvpn

Backup Using Powershell

Panorama ISP redundancy

Re: How Does the "Highlight Unused Rules" Option Work on Panorama?

Unlock your full community experience!

About minow