About Hamid.Saffarzadeh

Hamid.Saffarzadeh · ‎11-08-2022

Hi team, Is it possible to change the way Palo Alto links a group on AD? From CN to SID?? Cheers,

Hamid.Saffarzadeh · ‎10-26-2022

Guys, What if we have two static IP addresses on the same interface? Is it possible to configure two different portals on the same network interface? Cheers,

Hamid.Saffarzadeh · ‎08-22-2022

Hi team, It seems adding a .crl or .crt at the end of the address should help. Also, when they are usually Microsoft certs adding the .crl doesn't work, however, we can test by getting the certificates from https://www.microsoft.com/pki/mscorp/cps/default.htm Cheers, Hamid

Hamid.Saffarzadeh · ‎08-22-2022

Hi team, I have just got a confirmation on the fix. It will be included in the PAN-OS 10.2.4. Cheers, Hamid

Hamid.Saffarzadeh · ‎08-11-2022

Hi BPry, Thank you for your reply. The three Spyware profiles are being used under many security rules and it is not possible to delete one of them. We also created a dummy Spyware profile to no avail. Warnings are still present.

Hamid.Saffarzadeh · ‎08-08-2022

Hi guys, Trust all is well. After the firewall upgrade to version 10.2.1/ 10.2.2, we are getting the following errors after each firewall. Changes/commits are executed successfully. And everything seems to be working without problems. Warning: spyware-profile AntiSpy-Alarm-Only(id: 251) is considered duplicate of AntiSpy-D(id: 258) Warning: spyware-profile AntiSpy-Block-IP(id: 252) is considered duplicate of AntiSpy-D(id: 258) Any idea? Thank you in advance.

Hamid.Saffarzadeh · ‎07-26-2022

Hi guys, I am checking the decryption logs, to repair the certificate chain as mentioned in the guide below: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs/repair-incomplete-certificate-chains The issue is some cannot provide the full URL of the missing root CA/Issuer, for instance: ( error eq 'Received fatal alert CertificateUnknown from client. CA Issuer URL (truncated):http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%2' ) I was wondering if there is any way to retrieve this address in full to proceed with certificate chain repair. Regards, Hamid Saffarzadeh

Hamid.Saffarzadeh · ‎07-07-2022

Thanks, it was brilliant.

Hamid.Saffarzadeh · ‎07-04-2022

Hi mates, I was wondering if there are any ways or tools to block the GlobalProtect connection when another type of VPN is up and running. The main goal of this is to get the right country of origin information on the GlobalProtect logs on the firewall which is not possible when another type of VPN is already running on the end-users machine. Thank you in advance. Hamid

Hamid.Saffarzadeh · ‎06-22-2022

Hi team, Hope all is well. We have an issue with the GP client app upgrade through GPO when users are working remotely. Users who work in the corporate have no issue with the GP upgrade, however, it seems remote users do not have access to the shared folders as it seems the GP gets disconnected during the upgrade. I thought the whole .msi would be downloaded from the remote servers to the local machine and then the upgrade would be carried out. The error is something like "\\...\GlobalProtect64-5.2.0.msi cannot be found. verify that you have access to this location..." Thank you in advance for your thoughts and ideas. Hamid Saffarzadeh

Hamid.Saffarzadeh · ‎05-12-2022

Thank you Pavel, One more question if you don't mind. Do you have any idea How long it takes for BGP to converge at the time of a manual firewall failover? Regards,

Hamid.Saffarzadeh · ‎05-10-2022

Hi Team, Trust all is well. IN the documents it is only mentioned that the "Auto" link-state makes the convergence faster but it is not mentioned how much faster, for example in the number of seconds. From the guide: Set the Passive link state to "Auto". Auto setting will bring the interfaces on the passive firewall to UP physical state, the interface will not pass any data traffic. This facilitates faster failover times. Does anyone have an idea how much faster it becomes by changing the link state from shutdown to auto? Many thanks in advance.

Hamid.Saffarzadeh · ‎04-07-2022

Hi guys, We have a firewall that shows the free SWAP memory 0. Is this normal? It is a new installation and Genindex process seems to be normal. Here is the output of "show system resources": admin@PA-450> show system resources top - 09:49:41 up 21 days, 20:55, 1 user, load average: 1.96, 2.03, 2.07 Tasks: 238 total, 1 running, 165 sleeping, 0 stopped, 1 zombie %Cpu(s): 11.9 us, 10.4 sy, 2.2 ni, 74.8 id, 0.0 wa, 0.7 hi, 0.0 si, 0.0 st KiB Mem : 16269716 total, 925460 free, 5240044 used, 10104212 buff/cache KiB Swap: 1020 total, 0 free, 1020 used. 6868148 avail Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 5937 20 0 1789300 385796 38960 S 25.0 2.4 118:03.32 configd 3564 0 -20 3848148 3.4g 3.3g S 18.8 21.7 93:13.92 masterd_ap+ 7148 20 0 131.6g 3.3g 3.3g S 18.8 21.4 4648:05 pan_task 24419 20 0 156148 20156 10672 S 18.8 0.1 0:00.09 masterd_ba+ 7150 20 0 131.6g 3.3g 3.3g S 12.5 21.4 1587:13 pan_task 3582 15 -5 173524 13904 7920 S 6.2 0.1 72:14.64 sysd 6235 20 0 716664 101468 32564 S 6.2 0.6 161:27.25 dnsproxyd 5162 20 0 1183668 36384 26768 S 0.0 0.2 4:35.71 sysdagent 5167 30 10 142456 22560 8628 S 0.0 0.1 1:51.01 core_gdb 5179 20 0 7144 1796 1648 S 0.0 0.0 0:00.00 mcelog 5318 20 0 630396 32664 25408 S 0.0 0.2 3:25.44 chasd 5323 20 0 602820 73484 30784 S 0.0 0.5 2:33.35 dagger 5327 30 10 335308 32284 11456 S 0.0 0.2 58:14.72 python 5331 20 0 545184 34644 27076 S 0.0 0.2 96:41.78 contentd 5358 20 0 328820 9468 8112 S 0.0 0.1 1:36.91 plugin_api+ 5449 10 -10 128.6g 14112 11328 S 0.0 0.1 235:50.39 brdagent 5774 20 0 97356 9036 7768 S 0.0 0.1 2:59.44 ehmon 5891 20 0 707300 39724 28892 S 0.0 0.2 2:53.88 cryptod 5915 20 0 38188 5196 4716 S 0.0 0.0 0:00.00 sshd 5930 20 0 1870336 553008 151900 S 0.0 3.4 63:22.54 devsrvr 5945 20 0 477692 68176 31132 S 0.0 0.4 125:47.07 distributo+ 5948 20 0 521600 89120 31316 S 0.0 0.5 28:26.67 iotd 5950 20 0 1045776 207192 35860 S 0.0 1.3 25:53.63 reportd 5952 20 0 741968 215668 145800 S 0.0 1.3 224:46.63 useridd 6024 20 0 602052 142424 31840 S 0.0 0.9 11:34.05 mgmtsrvr 6048 nobody 20 0 50280 4008 3020 S 0.0 0.0 27:15.12 redis-serv+ 6073 nobody 20 0 52840 4348 3148 S 0.0 0.0 100:16.26 redis-serv+ 6101 nobody 20 0 50280 4164 3076 S 0.0 0.0 26:05.48 redis-serv+ 6142 nobody 20 0 574108 50868 36036 S 0.0 0.3 2:21.95 httpd 6145 20 0 1175176 66648 8632 S 0.0 0.4 95:27.58 identitycl+ 6171 20 0 1001624 16620 5216 S 0.0 0.1 59:57.53 dsclient 6210 20 0 650968 41692 30364 S 0.0 0.3 3:23.76 ikemgr 6213 20 0 1697164 312584 49328 S 0.0 1.9 2155:52 logrcvr 6215 20 0 812372 37840 27892 S 0.0 0.2 2:39.18 rasmgr 6216 20 0 653392 36004 26632 S 0.0 0.2 3:11.46 keymgr 6218 20 0 278428 34340 26716 S 0.0 0.2 1:41.94 pan_ifmgr 6219 20 0 2711508 98396 32008 S 0.0 0.6 13:35.15 varrcvr 6223 17 -3 560940 35568 27396 S 0.0 0.2 10:59.88 l2ctrld 6224 17 -3 280116 34952 26472 S 0.0 0.2 2:36.77 ha_agent 6225 20 0 538356 49188 29860 S 0.0 0.3 4:28.46 satd 6231 20 0 1093900 43776 29972 S 0.0 0.3 3:33.18 sslmgr 6234 20 0 557208 34688 27012 S 0.0 0.2 2:51.82 pan_dhcpd 6238 20 0 488312 35340 26816 S 0.0 0.2 2:14.85 pppoed 6240 17 -3 979544 57424 30656 S 0.0 0.4 7:10.50 routed 6241 20 0 471164 56576 34884 S 0.0 0.3 20:56.38 authd 7143 20 0 131.5g 3.3g 3.3g S 0.0 21.4 6:57.56 sdwand 7144 20 0 131.4g 3.3g 3.3g S 0.0 21.4 38:53.51 pan_dha 7145 20 0 131.4g 3.3g 3.3g S 0.0 21.4 7:10.32 mprelay 7146 20 0 132.5g 3.5g 3.3g S 0.0 22.7 63:32.92 pan_comm 7147 20 0 131.5g 3.3g 3.3g S 0.0 21.4 21:59.79 tund 7152 20 0 263764 49484 5092 S 0.0 0.3 38:43.76 wifclient 7160 30 10 163000 26704 11144 S 0.0 0.2 11:47.02 python

Hamid.Saffarzadeh · ‎01-07-2022

Hi BPry, Thanks for your reply. Ports are not reserved and after I extended the allocated port range, the source ports of the applications fall within the allocated range, however, the same result. Moreover, the user didn't hit the maximum allocation port limit. I am not sure this is the issue but if the user allocation port range is from 20000 to 20199, those applications are using source ports like 44xxx. Is there any way we can force applications to use only the ports allocated to the users and not whatever port they want? Thank you in advance.

Hamid.Saffarzadeh · ‎01-06-2022

Hi guys, We faced an issue where users' traffic related to office applications from a system, on which Terminal Server is installed, gets dropped by the firewall due to the unknown source user. We are using Terminal Server Agent as the means of user identifications. Web browsing and traffic related to other applications pass through the firewall with no issue and of course, the source user is known for those traffics. At first, the source ports being used by those office applications were out of range of allocated ports on the TS, so we extended the range to the maximum value to no avail. Does anyone have an idea? Thank you in advance.

Member Since	‎01-03-2020 02:18 AM
Date Last Visited	‎11-16-2022 05:23 AM
Posts	18
Total Likes Received	10

Online Status	Offline
Date Last Visited	‎11-16-2022 05:23 AM

About Hamid.Saffarzadeh

Palo Alto - Active Directory SID

Re: Can you have 2 Global Protect Portals on the same interface on a VM series

Re: How to get the full CA Issuer URL when it is truncated in the decryption log

Re: Commit Warning for Antispyware

Re: Commit Warning for Antispyware

Commit Warning for Antispyware

How to get the full CA Issuer URL when it is truncated in the decryption log

Re: GlobalProtect and other VPN tools

GlobalProtect and other VPN tools

GlobalProtect upgrade through GPO

How to get the full CA Issuer URL when it is truncated in the decryption log

Re: How to get the full CA Issuer URL when it is truncated in the decryption log

Re: Commit Warning for Antispyware

Terminal Server doesn't work with Microsoft applications

Changing password over GlobalProtect

Re: GlobalProtect and other VPN tools

Panorama: why can't we edit Application settings in Device Groups?

Re: No Free SWAP Memory PA-450

Connect to GlobalProtect VPN from cmd.exe in Windows 10

Re: Changing password over GlobalProtect

Palo Alto - Active Directory SID

Re: Can you have 2 Global Protect Portals on the same interface on a VM series

Re: How to get the full CA Issuer URL when it is truncated in the decryption log

Re: Commit Warning for Antispyware

Re: Commit Warning for Antispyware

Commit Warning for Antispyware

How to get the full CA Issuer URL when it is truncated in the decryption log

Re: GlobalProtect and other VPN tools

GlobalProtect and other VPN tools

GlobalProtect upgrade through GPO

Re: High Availability - Passive Link State

High Availability - Passive Link State

No Free SWAP Memory PA-450

Re: Terminal Server doesn't work with Microsoft applications

Terminal Server doesn't work with Microsoft applications

Unlock your full community experience!

About Hamid.Saffarzadeh