This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences

About Joshan_Lakhani

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Joshan_Lakhani
‎12-26-2021
since ‎01-15-2020
L4 Transporter
User Activity
User Profile
Latest posts by Joshan_Lakhani
View All
My Liked Posts
View All
User Badges
Community Statistics
Member Since ‎01-15-2020 02:44 AM
Date Last Visited ‎12-26-2021 04:18 AM
Posts 167
Total Likes Received 5

Re: Global protect Notification

by in General Topics
‎02-28-2021 03:36 AM
1 Kudo
‎02-28-2021 03:36 AM
1 Kudo
Dear @Mick_Ball    When i run this command it's not working      Please advise   ... View more

Re: Global protect Notification

by in General Topics
‎02-28-2021 02:20 AM
‎02-28-2021 02:20 AM
@Mick_Ball    Thanks for you reply   As i  already upgrade the version from 5.1.7 to 5.2.5 version   ... View more

Global protect Notification

by in General Topics
‎02-27-2021 10:25 PM
‎02-27-2021 10:25 PM
Hi,   When I connect global protect Gateway. Once is connected I received this notification. I have check the internet connectivity it's working fine.   Can you please let me know how to avoid this notification      ... View more

Re: Blank Setup page after downgrade from 10.0 to 9.1

by in General Topics
‎02-11-2021 04:19 AM
‎02-11-2021 04:19 AM
@BPry    Iam also facing same issue  ... View more

Re: Dataplane goes restarted

by in General Topics
‎01-28-2021 05:19 AM
‎01-28-2021 05:19 AM
@VinceM   PAN-OS 10.0.2  and yes both SPF are compatible SFP Module FINISAR FTLF8519P3BNL & AvaGO AFBR-709SMZ     ... View more

Re: Dataplane goes restarted

by in General Topics
‎01-28-2021 01:33 AM
‎01-28-2021 01:33 AM
Dear @VinceM   Thanks for you reply   when we plug SFP in 1/19 or 1/20 all the other interface are goes down. As the data plane also restarts.After unplug the same sfp again dataplane goes down we have the system log we can also see that .  HA Group 10: Dataplane is down: brdagent exiting   27/01/2021 17:13   general   0 0 general critical Chassis Master Alarm: Cleared 27/01/2021 17:12   general   0 0 general critical WildFire update job failed  for user Auto update agent 27/01/2021 17:08   ha2-keep-alive   0 0 general critical HA Group 10: All HA2 keep-alives are down 27/01/2021 17:08   ha2-keep-alive   0 0 general critical HA Group 10: Peer HA2 keep-alive down 27/01/2021 17:08   general   0 0 general critical The dataplane is restarting. 27/01/2021 17:08   general   0 0 general critical all: Exited 1 times, must be manually recovered. 27/01/2021 17:08   general   0 0 general critical platform: Exited 1 times, must be manually recovered. 27/01/2021 17:08   general   0 0 general critical brdagent: Exited 1 times, must be manually recovered. 27/01/2021 17:06   ha2-link-change   0 0 general critical All HA2 links down 27/01/2021 17:06   ha2-link-change   0 0 general critical HA2 link down 27/01/2021 17:06   general   0 0 general critical Chassis Master Alarm: HA-event  27/01/2021 17:06   state-change   0 0 general critical HA Group 10: Moved from state Active to state Non-Functional 27/01/2021 17:06   dataplane-down   0 0 general critical HA Group 10: Dataplane is down: brdagent exiting 27/01/2021 16:37   general   0 0 general critical Chassis Master Alarm: Cleared 27/01/2021 16:33   general   0 0 general critical WildFire update job failed  for user Auto update agent 27/01/2021 16:32   general   0 0 general critical WildFire update job failed  for user Auto update agent 27/01/2021 16:32   ha2-keep-alive   0 0 general critical HA Group 10: All HA2 keep-alives are down 27/01/2021 16:32   ha2-keep-alive   0 0 general critical HA Group 10: Peer HA2 keep-alive down 27/01/2021 16:32   general   0 0 general critical The dataplane is restarting. 27/01/2021 16:32   general   0 0 general critical all: Exited 1 times, must be manually recovered. 27/01/2021 16:32   general   0 0 general critical platform: Exited 1 times, must be manually recovered. 27/01/2021 16:32   general   0 0 general critical brdagent: Exited 1 times, must be manually recovered. 27/01/2021 16:30   ha2-link-change   0 0 general critical All HA2 links down 27/01/2021 16:30   general   0 0 general critical Chassis Master Alarm: HA-event  27/01/2021 16:30   ha2-link-change   0 0 general critical HA2 link down 27/01/2021 16:30   state-change   0 0 general critical HA Group 10: Moved from state Active to state Non-Functional 27/01/2021 16:30   dataplane-down   0 0 general critical HA Group 10: Dataplane is down: brdagent exiting t ... View more

Dataplane goes restarted

by in General Topics
‎01-28-2021 12:00 AM
‎01-28-2021 12:00 AM
i  have a paloalto 3220 model After plug the new SPF all the interface port goes down as well as dataplane goes restart. Once i unplug the SFP again dataplane goes restarts All the interface are goes down HA Logs:   2021-01-27 16:28:07.512 +0500 debug: ha_sysd_general_vers_string(src/ha_sysd_version.c:1835): Got new Threat Content: 8369-6522; for peer value 2021-01-27 16:28:07.512 +0500 HA Group 10: Threat Content version now matches 2021-01-27 16:28:07.513 +0500 HA peer Anti-Virus set to Match 2021-01-27 16:28:07.513 +0500 HA peer Application Content set to Match 2021-01-27 16:28:07.513 +0500 HA peer Global Protect Client Software set to Match 2021-01-27 16:28:07.513 +0500 HA Group 10: IOT Content version mismatch due to device update 2021-01-27 16:28:07.513 +0500 HA peer Build Release set to Match 2021-01-27 16:28:07.513 +0500 HA peer Threat Content set to Match 2021-01-27 16:28:07.513 +0500 HA peer URL Database set to Mismatch 2021-01-27 16:28:07.513 +0500 HA peer URL Vendor set to Match 2021-01-27 16:28:07.513 +0500 HA peer VM License Type set to Mismatch 2021-01-27 16:28:07.513 +0500 HA peer VPN Client Software set to Match 2021-01-27 16:28:07.514 +0500 HA peer DLP set to Match 2021-01-27 16:28:07.514 +0500 debug: ha_sysd_general_vers_string(src/ha_sysd_version.c:1835): Got new IOT Content: 16-253; for peer value 2021-01-27 16:28:07.514 +0500 HA Group 10: IOT Content version now matches 2021-01-27 16:30:04.958 +0500 debug: ha_slot_sysd_dp_down_notify_cb(src/ha_slot.c:1061): Got initial dataplane down (slot 1; reason brdagent exiting) 2021-01-27 16:30:04.959 +0500 The dataplane is going down 2021-01-27 16:30:04.959 +0500 debug: ha_rts_dp_ready_update(src/ha_rts.c:1122): RTS slot 1 set to NOT ready 2021-01-27 16:30:04.959 +0500 debug: ha_rts_dp_ready(src/ha_rts.c:790): Update dp ready bitmask for slots ; changed slots 1 for local device 2021-01-27 16:30:04.959 +0500 debug: ha_peer_send_hello(src/ha_peer.c:5483): Group 10 (HA1-MAIN): Sending hello message Hello Msg --------- flags : 0x1 (preempt:) state : Active (5) priority : 100 cookie : 45077 num tlvs : 2 Printing out 2 tlvs TLV[1]: type 67 (DP_RTS_READY); len 4; value: 00000000 TLV[2]: type 11 (SYSD_PEER_DOWN); len 4; value: 00000000 2021-01-27 16:30:04.960 +0500 Warning: ha_event_log(src/ha_event.c:59): HA Group 10: Dataplane is down: brdagent exiting 2021-01-27 16:30:04.960 +0500 Going to non-functional for reason Dataplane down: brdagent exiting 2021-01-27 16:30:04.960 +0500 debug: ha_state_transition(src/ha_state.c:1430): Group 10: transition to state Non-Functional 2021-01-27 16:30:04.960 +0500 debug: ha_state_start_monitor_holdup(src/ha_state.c:2735): Skipping monitor holdup for group 10 2021-01-27 16:30:04.960 +0500 debug: ha_state_monitor_holdup_callback(src/ha_state.c:2833): Going to Non-Functional state state 2021-01-27 16:30:04.961 +0500 debug: ha_state_move(src/ha_state.c:1532): Group 10: moving from state Active to Non-Functional 2021-01-27 16:30:04.961 +0500 Warning: ha_event_log(src/ha_event.c:59): HA Group 10: Moved from state Active to state Non-Functional 2021-01-27 16:30:04.961 +0500 debug: ha_sysd_dev_state_update(src/ha_sysd.c:1549): Set dev state to Non-Functional 2021-01-27 16:30:04.961 +0500 debug: ha_state_move_action(src/ha_state.c:1335): No state transition script available on current platform 2021-01-27 16:30:04.961 +0500 debug: ha_sysd_dev_alarm_update(src/ha_sysd.c:1515): Set dev alarm to on     Masterd.logs:   2021-01-27 17:08:20.130 +0500 CRITICAL: brdagent: Exited 1 times, must be manually recovered. 2021-01-27 16:36:18.792 +0500 INFO: all: running 2021-01-27 17:06:05.280 +0500 INFO: brdagent: exited, Core: True, Exit signal: SIGBUS 2021-01-27 17:08:18.191 +0500 INFO: brdagent: saved core file brdagent_10.0.2_1.core 2021-01-27 17:08:20.130 +0500 CRITICAL: brdagent: Exited 1 times, must be manually recovered. 2021-01-27 17:08:20.144 +0500 INFO: platform: group exiting because child brdagent exited 2021-01-27 17:08:20.318 +0500 INFO: sysdagent: exited, Core: False, Exit code: 0 2021-01-27 17:08:20.476 +0500 INFO: ehmon: exited, Core: False, Exit code: 0 2021-01-27 17:08:20.663 +0500 INFO: platform: exited 2021-01-27 17:08:20.790 +0500 CRITICAL: platform: Exited 1 times, must be manually recovered. 2021-01-27 17:08:20.809 +0500 INFO: all: group exiting because child platform exited 2021-01-27 17:08:20.854 +0500 INFO: gdb: exited 2021-01-27 17:08:21.453 +0500 INFO: sdwand: exited, Core: False, Exit code: 0 2021-01-27 17:08:21.691 +0500 INFO: bfd: exited, Core: False, Exit code: 0 2021-01-27 17:08:21.840 +0500 INFO: dha: exited, Core: False, Exit code: 0 2021-01-27 17:08:22.022 +0500 INFO: mprelay: exited, Core: False, Exit code: 0 2021-01-27 17:08:22.168 +0500 INFO: tund: exited, Core: False, Exit code: 0 2021-01-27 17:08:22.543 +0500 INFO: pktlog_forwarding: exited, Core: False, Exit code: 0 2021-01-27 17:08:22.701 +0500 INFO: all_pktproc_3: exited, Core: False, Exit code: 0 2021-01-27 17:08:22.883 +0500 INFO: all_pktproc_5: exited, Core: False, Exit code: 0 2021-01-27 17:08:23.043 +0500 INFO: all_pktproc_4: exited, Core: False, Exit code: 0 2021-01-27 17:08:23.198 +0500 INFO: all_pktproc_7: exited, Core: False, Exit code: 0 2021-01-27 17:08:23.350 +0500 INFO: wifclient: exited, Core: False, Exit signal: SIGTERM 2021-01-27 17:08:23.533 +0500 INFO: monitor: exited, Core: False, Exit signal: SIGTERM 2021-01-27 17:08:23.687 +0500 INFO: all_pktproc_6: exited, Core: False, Exit code: 0 2021-01-27 17:08:23.880 +0500 INFO: all_pktproc_8: exited, Core: False, Exit code: 0 2021-01-27 17:08:24.028 +0500 INFO: flow_mgmt: exited, Core: False, Exit code: 0 2021-01-27 17:08:24.173 +0500 INFO: flow_ctrl: exited, Core: False, Exit code: 0 2021-01-27 17:08:24.392 +0500 INFO: tasks: exited 2021-01-27 17:08:24.435 +0500 INFO: comm: exited, Core: False, Exit code: 0 2021-01-27 17:08:25.315 +0500 INFO: dssd: exited, Core: False, Exit code: 0 2021-01-27 17:08:25.476 +0500 INFO: supervisor: exited 2021-01-27 17:08:25.506 +0500 INFO: all: exited   ... View more

Re: Palo Dual Action on Same Malicious Domain

by in General Topics
‎01-22-2021 12:09 PM
‎01-22-2021 12:09 PM
@reaper @BPry @MP    In our case, if the get the IP address of the malicious domain and it generates the “alert” on the firewall.         One the second time it will identify its malicious domain then the query will send to the sinkhole.         DNS sinkhole can be used to identify infected hosts on a network where there is an internal DNS Server in-route to the firewall that causes the reference of the original source IP address of the host that first originated the query to be lost (the query is received by the Internal DNS Server, and the internal DNS Server sources a new query if the name-to-IP resolution is not locally cached).     The things we have understood by your assistance but we could not found any document having the same use case or actual flow of DNS or its cache how they works. Can  you please suggest any document or use case. ... View more

antivirus not able to update

by in General Topics
‎01-19-2021 05:09 AM
‎01-19-2021 05:09 AM
we have recently renew our license of thread prevention . As application and threats are update but the antivirus is not update from Palo alto server. We  downloads the AV from support portal and manually install in FW  and run this command still antivirus is not able to update.   Please suggest.   2021-01-19 13:10:30.791 +0500 Error: pan_get_current_gp_datafile_version(pan_cfg_utils.c:5968): Failed to parse file /opt/pancfg/mgmt/global-protect/av-data/av_data_meta_file.dat 2021-01-19 13:10:30.831 +0500 update system boot: count = 130665, timestamp = 2021/01/19 13:10:30 2021-01-19 13:10:30.886 +0500 Error: pan_get_content_release_date_by_sysd(pan_ops_content.c:1406): Failed to fetch from sysd for GPclient 2021-01-19 13:10:30.887 +0500 Error: pan_get_content_release_date_by_sysd(pan_ops_content.c:1406): Failed to fetch from sysd for Antivirus 2021-01-19 13:10:30.968 +0500 Got HA info from sysd: Local_state: active, Peer_state: passive2021-01-19 13:10:31.082 +0500 template config file /opt/pancfg/mgmt/template/template-config.xml doesn't exist 2021-01-19 13:10:31.082 +0500 Could not find last pushed template, returning empty template config tree 2021-01-19 13:10:31.268 +0500 file /opt/pancfg/mgmt/template/pretrans-template-config.xml does not exist, not computing md5sum 2021-01-19 13:10:31.314 +0500 Error: pan_cfg_mgr_get_device_cert_details(pan_cfg_mgr.c:9806): Error getting dev cert validity status from sysd node 2021-01-19 13:10:44.223 +0500 [DNS_API] default to getaddrinfo()! 2021-01-19 13:10:56.426 +0500 Error: pan_ebl_set_curl_proxy_info(pan_cfg_ebl.c:5673): failed to get proxy info 2021-01-19 13:10:56.441 +0500 EDL entry(0x2d73000, 0x17da9000, 0x28f41200 vsys1/EDL-ISD, 1, 1 ip) calling edl_file_create.sh - tmpfile : /opt/pancfg/mgmt/devices/localhost.localdomain/vsys1_EDL-ISD.ebl.tmpxx, file : /opt/pancfg/mgmt/devices/localhost.localdomain/vsys1_EDL-ISD.ebl.tmp 2021-01-19 13:10:58.442 +0500 EDL entry(0x2d73000, 0x17da9000, 0x28f41200 vsys1/EDL-ISD, 1, 1 ip) Downloaded EDL file size(320) 2021-01-19 13:10:58.514 +0500 EDL entry(0x2d73000, 0x17da9000, 0x28f41200 vsys1/EDL-ISD, 1, 1 ip) No changes to list file 2021-01-19 13:10:58.514 +0500 EDL entry(0x2d73000, 0x17da9000, 0x28f41200 vsys1/EDL-ISD, 1, 1 ip) Remote fetch is done by worker thread 3 2021-01-19 13:10:58.514 +0500 EDL entry(0x2d73000, 0x17da9000, 0x28f41200 vsys1/EDL-ISD, 1, 1 ip) Valid entries(21) lines skipped(0) 2021-01-19 13:10:58.514 +0500 EDL entry(0x2d73000, 0x17da9000, 0x28f41200 vsys1/EDL-ISD, 1, 1 ip) Moving to Default Queue with 5min recurring time 2021-01-19 13:10:58.514 +0500 EDL entry(0x2d73000, 0x17da9000, 0x26879200 vsys1/EDL-ISD, 1, 1 ip) Five Minute schedule timer expires(Tue Jan 19 13:15:58 2021) 2021-01-19 13:10:58.514 +0500 EDL FREE EDL Refresh timer job (0xad54900, 2144)   ... View more

Re: Palo Dual Action on Same Malicious Domain

by in General Topics
‎01-18-2021 10:33 PM
‎01-18-2021 10:33 PM
@reaper we are not using Vsys moreover it's  hit on same policy. Furthermore when we check the other domains we are still see that some time paloalto it's show alert and 90% is sinkhole please suggest.  ... View more

Palo Dual Action on Same Malicious Domain

by in General Topics
‎01-18-2021 11:08 AM
‎01-18-2021 11:08 AM
We have found in the logs, Malicious DNS queries are being blocked but few of them are in Alert State. however the Domain is marked as a malicious in DNS signature at Threat Vault. Can you please elaborate why paloalto having dual action on same malicious domain.       ... View more

Re: Croxyproxy Block

by in General Topics
‎12-31-2020 01:31 AM
‎12-31-2020 01:31 AM
We are not able to block this proxy traffic as because the URL from the proxy keeps on changing and it is prefixing to the desired URL. Once the URL gets changed category is also gets changed so the traffic is passing through the firewall We seen that this application is running on random prefixed like(.com, .net ,.xyz , .space ,.rocks) So we create the URL Category and block their random prefixed. We also block some predefine category  where the traffic is passing through the there category such as (Unknown, Greyware, proxy avoidance, unknown, social network, streaming media, malware…) After applying the above methods we are not able to access the croxyproxy application ... View more

Re: Croxyproxy Block

by in General Topics
‎12-26-2020 09:58 PM
‎12-26-2020 09:58 PM
@OtakarKlier Yes I applied the forward decryption policy as well as block  the above catergory but still it's work please help to block this   ... View more

Techsupport file not generate

by in General Topics
‎12-22-2020 11:50 AM
‎12-22-2020 11:50 AM
when i generate the tech support file from GUI it's start after we min the loading process is remove and  failed to generate the tech support file and we cannot see on GUI    PAN-OS version : 8.1.9  Please advise ... View more

Re: Use URL filtering and Regional blocks

by in General Topics
‎11-08-2020 10:38 PM
‎11-08-2020 10:38 PM
you can block the URL by using FQDN. Create the address object and use give the URLs. ... View more
Register or Sign-in
Contact Me
Online Status
Offline
Date Last Visited
‎12-26-2021 04:18 AM
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2024 - Palo Alto Networks