About minow

minow · ‎10-29-2013

Hey i would like to know how the commit process works when i push commit on pannoaram to HA device group. 1) does Panorama send the configuration to both of the device and then commit it? 2) does Panorama send it only to one device and it commits it to the other device? i have a situation of a PA HA cluster, and only one device was inserted to the Panorama and the result was that both of the device were synced but the policy was actually exists on one of the devices and on the other device there was no policy. from this i assume that panorama probably insert the serial number of the "to be deployed" PA device when it sends the policy to the device, i would like see the white papers of this process thank you dor

minow · ‎10-07-2013

That was the answer

minow · ‎09-29-2013

also i have seen that when i commit the template only on one device the the other peer turns into not functional but the runnig config is still shown as synchronized, and also when i do commit the template on both of the device the state of the non-functional device must be manually chaged throught the CLI and also when i commit the template on both of the device at once after the commit on both of them is finished on is becoming non-functional

minow · ‎09-29-2013

Hey i am trying to understand how to use Pannorama with PA cluster my view of panorama is: if you have pannorama you should never have to login to the PA itself for configuration. right now i have one PA cluster and one pannorama server (the PA have a customer configuration on it) i started playing and testing for what i will do so my steps where until now: Upgrade all the device software to the relevant software version Verify the cluster is working and synced Backup the two PA device Add the PA serial number to the Panorama Configure the PA device with the Panorama IP and commit configuration Verify the PA had connected to the panorama server Create a new template and add the two devices Check the Group HA Peers taking the users configur from the cluster and placing it inside the template throught the cli: set mgt-config users i played arround and verified that the templates are synced between the two PA and the pannorama changing stuf commiting and checking and everything is fine EXCEPT: i tried to change the password of one user and commit it only on one of the PA and what i have seen that the PA itself does not synchronizing the configuration to its peer, and that one is marked as synchronized and the other as out of sync what i am having hard to understand is: why on the template area at PA i cannot see the two PA device as one device (for example group HA Peers)? why the configuration is really sent only to one device and does not synced to the other device? after i overrite the configuration on the PA device with the template configuration i cannot see this configuration on the PA device previously where under: set mgt-config users

minow · ‎08-07-2013

yes i know this. but i tried to performe a backup using the API.... and the file i get has ***** in the "phash" attribute as shown in my post. do you have any suggestion how to enable PA to export the hashed password on the API exported file?

minow · ‎08-07-2013

how do you backup the passwords also? i have seen in the XML output that it shows this for a local user record: <entry name="admin"> <phash>********</phash> <permissions> <role-based> <superuser>yes</superuser> </role-based> </permissions> but if i export the runing config from the webui then i get the "phash" in the right way what do you suggests?

minow · ‎07-17-2013

do you use Machine certificate or client certificates? our domain computers all have machine certificate from our internal CA, and i wish to verify that only they can connec with global protect

minow · ‎07-15-2013

thank you. we upgraded to 5.0.6 and all certificates are back in the GUI

minow · ‎07-14-2013

this is happaning for a long period, righ tnow we are in 5.0.4, but i am upgrading to 5.0.6 right now this is HA environment PA-500

minow · ‎07-14-2013

we get the error: Warning: cannot find complete certficate chain for certificate **** we get this error since upgraded, i cannot see any certificate in the webui but everything (global protect and webui) is working. int the export xml i can see those ceritifcates

minow · ‎07-11-2013

after some time the machine was booted successfuly... still dont know what was the problem the only change i made was adding a new administrator what are the phases a commit have till it finish?

minow · ‎07-11-2013

well i alraedy try to reboot the machine and it doesnt go up

minow · ‎07-11-2013

unable to commit please help in troubleshooting PA version: 5.0.3 thanks admin@PA# commit force .......................... Management server failed to send phase 1 to client authd Commit failed [edit] admin@PA# run tail mp-log authd.log Jul 11 17:33:53 pan_authd_generate_system_log(pan_authd.c:914): CC Enabled=False Jul 11 17:33:53 pan_get_system_cmd_output(pan_cfg_utils.c:4275): executing: /usr/local/bin/sdb -n -r cfg.operational-mode Jul 11 17:35:28 cfgagent_flags_callback(pan_cfgagent.c:187): authd: cfg agent received flags from server Jul 11 17:35:29 cfgagent_flags_callback(pan_cfgagent.c:191): new flags=0x0 Jul 11 17:35:29 cfgagent_config_callback(pan_cfgagent.c:212): authd: cfg agent received configuration from server Jul 11 17:35:29 authd: cfg agent received configuration from server but previous config still in use Jul 11 17:40:37 cfgagent_flags_callback(pan_cfgagent.c:187): authd: cfg agent received flags from server Jul 11 17:40:37 cfgagent_flags_callback(pan_cfgagent.c:191): new flags=0x1000 Jul 11 17:40:37 cfgagent_config_callback(pan_cfgagent.c:212): authd: cfg agent received configuration from server Jul 11 17:40:37 authd: cfg agent received configuration from server but previous config still in use [edit] admin@PA# run show management-clients Client PRI State Progress ------------------------------------------------------------------------- routed 30 P1-abort 0 ha_agent 25 P1-abort 0 device 20 P1-abort 0 ikemgr 10 P1-abort 0 keymgr 10 init 0 (op cmds only) logrcvr 10 P1-abort 0 dhcpd 10 P1-abort 0 varrcvr 10 P1-abort 0 l3svc 10 P1-abort 0 sslvpn 10 P1-abort 0 rasmgr 10 P1-abort 0 useridd 10 P1-abort 0 satd 10 P1-abort 0 websrvr 10 P1-abort 0 sslmgr 10 P1-abort 0 authd 10 P1-abort 0 * pppoed 10 P1-abort 0 dnsproxyd 10 P1-abort 0 cryptod 10 P1-abort 0 dagger 10 init 0 (op cmds only) Overall status: P1-abort. Progress: 0 Warnings: Errors: authd: Management server failed to send phase 1 to client authd [edit] admin@PA#

minow · ‎07-11-2013

"debug user-id dump probing-stats" is only giving me statistics how can i view/export all the logs that are relevant to the user-id proccess so when a user tells me that he have been redirected to the captive portal. so i could take a look at the log in the time that a user complained, i will have is IP also and see WHY paloalto didnt have the mapping because he should had it thanks

minow · ‎07-07-2013

Hey so why does paloalto have the docx and pptx and xlsx in the file filtering profile? doesnt it mean that PA know how to recognize those files? how does the profile works? does the order have meaning? does it go by the most restrictive? i would like to know this please thank you

Member Since	‎04-05-2011 05:40 AM
Date Last Visited	‎04-10-2022 04:34 AM
Posts	164
Total Likes Received	9

Online Status	Offline
Date Last Visited	‎04-10-2022 04:34 AM

About minow

Re: Azure SAML Authentication with multiple PAs

Re: Azure SAML Authentication with multiple PAs

Azure SAML Authentication with multiple PAs

Re: Static IP for GP User

Panorama Plugins

Re: using Azure MFA with Global Protect

Static IP for GP User

Re: How to secure PA to Panorama communication channel

How to secure PA to Panorama communication channel

Re: Keep Username for Two-Factor-Authentication Global Protect

How to secure PA to Panorama communication channel

Re: using Azure MFA with Global Protect

Re: DAG is not working

Re: Commit Fail Phase1 sslvpn

Backup Using Powershell

Re: using Azure MFA with Global Protect

Re: Keep Username for Two-Factor-Authentication Global Protect

Re: How to Schedule Configuration Export without Panorama?

Pannorama and HA Cluster

Re: How to Schedule Configuration Export without Panorama?

Re: PA Cluster and Panorama Template

PA Cluster and Panorama Template

Re: How to Schedule Configuration Export without Panorama?

Re: How to Schedule Configuration Export without Panorama?

Re: Client certificate and LDAP authenticate on Global Protect

Re: no certificates in the webui but still everything is working

Re: no certificates in the webui but still everything is working

no certificates in the webui but still everything is working

Re: commit is failing

Re: commit is failing

commit is failing

Re: logged in user are sent to captive portal

Re: zip file blocking is also blocking docx files

Unlock your full community experience!

About minow