About kbrazil

Hi Andre, Today the NAT policy is only local to the device and is not shared in Panorama.  Global objects can only be used in shared policies so you need to recreate the objects locally for now. It looks like this will be addressed in the next major PANOS release and NAT policies will become shared.  Then you will be able to use global objects in your shared NAT policy. Cheers, Kelly ... View more

Using multiple Agents is best practice for high availability for UserID. The use of agents helps to offload the userid to IP mapping from the control plane of the firewall.  In this way the agent processes the mapping information into a table which is sent to the firewall.  This both minimizes the work the firewall needs to do and also can reduce the amount of traffic the firewall is sending and receiving.  Another issue, especially for AD integration, is that an Agent running on a Windows member server allows the use of native Windows API's to access the user to IP mapping information.  This makes integration much more seamless since the authentication needed to query this data is provided by the service account configured on the Domain, which is a naive Windows function. Cheers, Kelly ... View more

Antivirus signatures were separated from the standard Threat signatures in 3.1.  Spyware download signatures are now contained within the Antivirus signature set and enabled with Antivirus Profiles.  Spyware phone-home detection is still handled in the Spyware Profiles. Cheers, Kelly ... View more

I wonder if you could create a port-based NAT rule to forward traffic destined to an arbitrary port translated to the loopback ip/port for management? Cheers, Kelly ... View more

I have to admit that I have limited experience on the PAN with AE interfaces, though I have done it a couple times.  I'm speaking from experience from other vendors since our implementation at PAN is nearly identical to how some other security devices implement link-agg. We do link aggregation but we do not fully implement 802.3ad, which means we only support a static configuration with no LACP.  Other than LACP, which is a control protocol over link aggregation, link agg configuration is local and should be interoperable with most any implementation.  For instance, there is no particular requirement on how load balancing is performed on either end. (one side can do per-session, the other can do per-packet and it should still "work") This is why I suggested using "passive" above so LACP would not try to negotiate and would force the agg group up.  It looks like doing the opposite has worked for someone else so now I'm confused. I don't remember whether the interface will turn green - I suspect it should.  You might check with Support to get a definitive answer here. Cheers, Kelly ... View more

Hi Andrew, I think your cisco config should look something like this: port-channel load-balance dst-ip interface Port-channel5 switchport access vlan 10 switchport mode access interface GigabitEthernet0/1 switchport access vlan 10 switchport mode access channel-group 5 mode passive interface GigabitEthernet0/2 switchport access vlan 10 switchport mode access channel-group 5 mode passive 12/21/2011 - I'm editing this post to attempt to reduce the confusion.  The above is incorrect and I have stricken it through. Below is correct as is confirmed by the other participants: port-channel load-balance dst-ip interface Port-channel5 switchport access vlan 10 switchport mode access interface GigabitEthernet0/1 switchport access vlan 10 switchport mode access channel-group 5 mode on interface GigabitEthernet0/2 switchport access vlan 10 switchport mode access channel-group 5 mode on This will keep LACP from attempting to negotiate. Cheers, Kelly Message was edited by: kbrazil ... View more

I don't have a 3.0 box handy to test, but I believe the export command should not include "debug-pcap" but "filter".  A debug-pcap is a special type of pcap for traffic terminating on the firewall (such as DHCP or routing protocol).  The "filter" pcap is for the traditional packet capture you are performing.  There are a couple of other types of pcaps including application and unknown-application. Cheers, Kelly ... View more

Hi Grant, This document will help you out if you are on PANOS 3.1: https://live.paloaltonetworks.com/docs/DOC-1506 Here is an excerpt: Traditional PCAP Set a filter to control what traffic is captured debug dataplane packet-diag set filter on debug dataplane packet-diag set filter match <criteria> Enable Packet Capture debug dataplane packet-diag set capture on debug dataplane packet-diag set capture stage firewall file foo.pcap View the Packet Capture view-pcap filter-pcap foo.pcap Export the Packet Capture in PCAP format (SCP or TFTP) scp export filter-pcap from foo.pcap to username@host:path tftp export filter-pcap from foo.pcap to <tftp host> These commands also exist in 3.0 and below but they are not under packet-diag.  I believe they are directly under "debug dataplane" Cheers, Kelly ... View more

If the usernames are showing up in the logs, then it seems it should be working.  First, try upgrading to 3.1.2.  Also try generating the report via IP address instead of username and see if that works.  If neither of those help, you may need to contact support. Cheers, Kelly ... View more

You might also change the config format to "set" and copy/paste the config from the command line: admin@pan> set cli config-output-format set admin@pan> configure Entering configuration mode [edit]                                                                           admin@pan# show [snip] set address-group LocalServers LocalServer1 set address-group LocalServers LocalServer2 set address-group LocalServers LocalServer3 set address-group LocalServers LocalServer4 set address LocalServer1 ip-netmask 10.154.194.3/32 set address LocalServer2 ip-netmask 10.154.194.20/32 set address LocalServer3 ip-netmask 10.154.194.24/32 set address LocalServer4 ip-netmask 10.154.173.15/32 set address LocalNetwork ip-netmask 10.154.0.0/16 set address EmailServer ip-netmask 10.0.0.1 Cheers, Kelly ... View more

Hi Grant, I noticed that when I copy and paste the username in through certain browsers a trailing space would be included.  Any extra spaces will keep the report from being properly generated.  A small thing but it has bitten me in the past. Also, I have heard of some minor PAN Agent issues with 3.0.9 PANOS but this was revolving around policy creation, not logging or reporting.  If the above suggestion doesn't work, I wonder if downgrading to 3.0.8 might help. Cheers, Kelly ... View more

Hi Grant, The QOS is applied for the aggregate of traffic that hits the profile, not per session. Cheers, Kelly ... View more

Looks like you can do a few things: Configure the management interface so it does not use a proxy Change the interface used for updates to the external transit interface (Service Route configuration under the Device/Setup area) Manually pull the latest 3.1 update from the Support site and upload to the box via Web GUI or CLI.  After upgrading the OS the updates should work fine through the proxy. Cheers, Kelly ... View more