About ppatel

Try to have a look at the ikemgr log on the firewall. admin@PA> tail follow yes mp-log ikemgr.log The above log will be able to give detailed logging on the ike negotiation process that is done by the firewall Try to clear the vpn flow using the commands that were given before and run the tail command. Please open a support ticket with TAC to troubleshoot the issue if it is still not resolving. It would be great to have access to both the sides of the tunnel to debug/troubleshoot Ipsec. Regards Parth ... View more

Make sure the Crypto settings are same on both the sides and try initiating the tunnel traffic from the remote side. Also try configuring the ipsec-crypto to DH group to "no-pfs" on both the sides. Clear the VPN tunnels on the Palo Alto side. admin@PA> clear vpn ike-sa gateway   <value>  clear for given IKE gateway admin@PA> clear vpn ipsec-sa tunnel   <value>  clear for given VPN tunnel Try initiate the tunnel from the cisco side. Monitor the system logs on the firewall to see the IPSEC negotiation. Check to see if the tunnel comes up. Which version of software are you using on the firewall? There is an issue with software release 4.1.5 where after an upgrade or intermittently IPSec VPN tunnel would not come up when Palo Alto Networks firewall initiates a connection to a Cisco ASA device. [Bug # 39884] This issue was addressed in S/w 4.1.6. Let me know if this helps. Regards Parth ... View more

HI Srikanth, I forgot to add that there is NO WAY to enter into maintenance mode through the GUI. It is only possible through the CLI with a console access since we have to monitor the boot up sequence. Regards Parth ... View more

Hi Srikanth, Reboot device, monitor the boot sequence for the following message: Autboot to default partition in 3 seconds. Select m to boot to maintenance partition.  OR type "maint" to enter into maintenance mode. Once you execute that, you will be in maint mode . Additionally to factory default the device, From the maint partition select factory reset. At the password prompt, enter MA1NT. Allow the device to complete the boot sequence. After booting is completed, login using the default username password. Is this helpful Regards Parth ... View more

Srikanth, The following command will help you to see the disk space on the device. admin@Lab-59-PA-500> show system disk-space    [example output] Filesystem            Size  Used Avail Use% Mounted on /dev/sda2             3.8G  1.2G  2.5G  31% / /dev/sda5             7.6G  3.3G  3.9G  47% /opt/pancfg /dev/sda6             3.8G  2.5G  1.2G  69% /opt/panrepo tmpfs                 487M   37M  451M   8% /dev/shm /dev/sda8              51G  1.9G   47G   4% /opt/panlogs Log-Quota:- admin@Lab-59-PA-500> show system logdb-quota Quotas:              traffic: 32.00%, 14.643 GB               threat: 16.00%, 7.322 GB               system: 4.00%, 1.830 GB               config: 4.00%, 1.830 GB                alarm: 3.00%, 1.373 GB                trsum: 8.40%, 3.844 GB          hourlytrsum: 2.40%, 1.098 GB           dailytrsum: 0.60%, 0.275 GB          weeklytrsum: 0.60%, 0.275 GB                thsum: 2.80%, 1.281 GB          hourlythsum: 0.80%, 0.366 GB           dailythsum: 0.20%, 0.092 GB          weeklythsum: 0.20%, 0.092 GB              appstat: 9.60%, 4.393 GB               userid: 2.40%, 1.098 GB             hipmatch: 3.00%, 1.373 GB    application-pcaps: 1.00%, 0.458 GB         threat-pcaps: 1.00%, 0.458 GB   debug-filter-pcaps: 1.00%, 0.458 GB          hip-reports: 1.00%, 0.458 GB             dlp-logs: 1.00%, 0.458 GB Disk usage: traffic: Logs: 211M, Index: 54M threat: Logs: 53M, Index: 2.8M system: Logs: 954M, Index: 149M config: Logs: 97M, Index: 1.4M alarm: Logs: 16K, Index: 16K trsum: Logs: 138M, Index: 5.7M hourlytrsum: Logs: 2.4M, Index: 2.4M dailytrsum: Logs: 1.4M, Index: 2.2M weeklytrsum: Logs: 728K, Index: 468K thsum: Logs: 612K, Index: 772K hourlythsum: Logs: 600K, Index: 600K dailythsum: Logs: 560K, Index: 560K weeklythsum: Logs: 88K, Index: 88K appstatdb: Logs: 6.2M, Index: 5.7M userid: Logs: 12K, Index: 12K hipmatch: Logs: 16K, Index: 16K application-pcaps: 32M threat-pcaps: 60K debug-filter-pcaps: 26M dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K Let me know if this helps. Regards Parth ... View more

Hi Srikanth, Where do you see these ? Is it under Device > Setup > management ? Once you click edit under these settings, you will see the following:- This means that 45.76 GB of your total space is allocated to logging and reporting and the rest of it is free. If you add up the% quotas, it will be 95%. (As an example to the above screenshot) Please let me know if it is helpful. Regards Parth ... View more

Srikanth, Flow diagram for a packet when it ingress the firewall is explained beautifully in this document:- https://live.paloaltonetworks.com/docs/DOC-1628 Also here is the link to the redistribution of routes from one area to the other using the firewall. https://live.paloaltonetworks.com/docs/DOC-3377 https://live.paloaltonetworks.com/docs/DOC-1113 Document is also attached to the thread. Here is the sample config snapshot of the DNAT rule Make sure you also have a security rule to allow traffic from untrust to trust zone. Link to NAT document : https://live.paloaltonetworks.com/docs/DOC-1517 Advertising a default route via OSPF. Is this what you were looking for? https://live.paloaltonetworks.com/docs/DOC-3700 Let me know of it is helpful. Regards Parth ... View more

Hi Indra, As mentioned before the security policy are processed 2 times, one before the application inspection and one after the application inspection. So after we process the security rule for the first time it goes and check the application over-ride rule Same should be the case of DOS protection policies. For example, if you want to create an application over-ride rule from source zone :-Trust to Destination zone:-Untrust , you still have to create a security policy for the traffic and sessions from Trust to untrust zone. DOS rules also works the same way. Just make sure, Security policy is used to govern traffic within the security zones except the fact that PBF,regular routing table takes precedence . Let me know if that helps. Regards Parth ... View more

Hi Laurent, Here is the link to document that will have SNMP OIDs to monitor the firewall:- The document below has the OIDS for monitoring CPU on the management plane ,data plane, interfaces and session utilization. https://live.paloaltonetworks.com/docs/DOC-1744 Let me know if that helps Regards Parth ... View more

Hello, As mentioned by Gary, it is just similar to a linux box. This command is used to monitor processes running on the management plane. The Columns in the output mean the following:- PID is the process ID of the process %CPU is the management plane CPU usage %MEM is the physical Memory usage (RES) VIRT -- The total virtual memory usgae:  Virtual Image (kb) VIRT == SWAP + RES. TIME  is the CPU Time a task has used since it is started. TIME+ is the CPU Time reflecting more granularity. (hundredths of a second.) COMMAND will show all the deaomons running over the management plane and its memory/CPU utilization Regards Parth ... View more

Hello, As far as I know, there is a connection made to updates.paloaltonetworks.com everyday at 04:02am system time by the firewall. The check performed should include the  license check. This connection is outside the scheduled time for automatic updates for dynamic , AV or URL updates. Let me know if that helps. Regards Parth ... View more

Hi Manfred, If you donot have sufficient rights to open up a ticket on the web, do you happen to know your reseller from whom you purchased the device or Sales Engineer? If so you can contact them and they can open up a ticket on your behalf and submit all the required details. If you donot happen to know your Regional sales Engineer, please get in touch with our sales Team at the follwoing E-mail. Sales Inquiries US and North America: contact_sales@paloaltonetworks.com Regards, Parth ... View more

HI Mike, I forgot to add the attachement. Please find it in this thread Also a small correction in the CLI command:- >show system info Regards, Parth ... View more

Hi Mike, Here is the link to Palo Alto Networks Threat Database Center. You could search for the threat/vulnerability/spyware based on the CVE, name and the threat ID name.  Look for the attachement (vulnerability.PNG ) http://wwapps.paloaltonetworks.com/threatvault If you do not find it in our database, you can submit a brief description about the vulnerability, packet captures from the infected host, traffic logs from the firewall restriceted to the host and the output of the following commnad from the Command line of the PA device >show sytem info Let me know if that helps. Regards, Parth ... View more