About HULK

Hello Renan, Did you verify your wildfire portal that, above mentioned serial number is "checked" for notification. Login with your credentials at: https://wildfire.paloaltonetworks.com/ Go to Settings > Configure Alerts and search for the firewall serial numbers desired to subscribe to for alerts, and whether the user wises to receive an alert for verdicts resulting as malware or benign. Once the appropriate check boxes are selected, click on 'Update Notification' to apply changes Thanks ... View more

Hello pred-martin, Ideally We'd expect that if the GP is set for ON Demand and SSO is disabled and that password is not saved, that the GP would not automatically connect when the laptop is awakened from sleep/hibernate. Hence, would it be possible for you to check with a newer version of agent to compare this behavior. Thanks ... View more

Hello pred-martin, Please let me know the GP agent version running in your environment. There are 2 similar discussion thread for your reference: GlobalProtect Re: global protect and OTP Thanks ... View more

Hello Tigran, The root access is restricted to only TAC resources. :smileylaugh: Thanks ... View more

It was my mistake to understand it wrongly. Yes, you  have to prepend the path, if you want to force the neighbour BGP peer to select the alternative path. It's a very common and supported feature (in BGP) with PAN OS also. Thanks ... View more

Hello Oskare_o, From the back trace it looks like the firewall was unable to read filesystem from the HDD drive during that time. It is showing the  ATA link error and to recover from this situation it got rebooted automatically. 3>ata1.00: failed command: READ DMA >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ATA link error <3>ata1.00: cmd c8/00:08:f1:44:25/00:00:00:00:00/ec tag 0 dma 4096 in <3>         res 40/00:00:01:4f:c2/00:00:00:00:00/00 Emask 0x56 (ATA bus error) <3>ata1.00: status: { DRDY } <6>ata1: hard resetting link <3>ata1: failed to resume link (SControl FFFFFFFF) <6>ata1: SATA link down (SStatus FFFFFFFF SControl FFFFFFFF)  >>>>>>>>>>>>>>>>>>>>>> link to the HDD was down <6>ata1: hard resetting link <3>ata1: failed to resume link (SControl FFFFFFFF) <6>ata1: SATA link down (SStatus FFFFFFFF SControl FFFFFFFF) <6>ata1: hard resetting link <3>ata1: failed to resume link (SControl FFFFFFFF) <6>ata1: SATA link down (SStatus FFFFFFFF SControl FFFFFFFF) <4>ata1.00: disabled <6>sd 0:0:0:0: [sda] Result: hostbyte=0x00 driverbyte=0x08 <6>sd 0:0:0:0: [sda] Sense Key : 0xb [current] [descriptor] <4>Descriptor sense data with sense descriptors (in hex): <6>        72 0b 00 00 00 00 00 0c 00 0a 80 00 00 00 00 00 <6>        00 00 00 00 <6>sd 0:0:0:0: [sda] ASC=0x0 ASCQ=0x0 <6>sd 0:0:0:0: [sda] CDB: cdb[0]=0x28: 28 00 0c 25 44 f1 00 00 08 00 <3>end_request: I/O error, dev sda, sector 203769073 <6>ata1: EH complete <6>ata1.00: detaching (SCSI 0:0:0:0) <1>Read-error on swap-device (8:0:44701239) <1>Read-error on swap-device (8:0:44841087) <1>Read-error on swap-device (8:0:44841103) <1>Read-error on swap-device (8:0:44841111) <1>Read-error on swap-device (8:0:44841119) <1>Read-error on swap-device (8:0:44241407) <1>Read-error on swap-device (8:0:44241415) <1>Read-error on swap-device (8:0:44241423) <1>Read-error on swap-device (8:0:44241431) <1>Read-error on swap-device (8:0:44241447) <1>Read-error on swap-device (8:0:44241455) <1>Read-error on swap-device (8:0:44241463) <1>Read-error on swap-device (8:0:44193367) <1>Read-error on swap-device (8:0:44193375) <1>Read-error on swap-device (8:0:44193383) <1>Read-error on swap-device (8:0:44193399) I would suggest you to contact PAN support and you may need to replace the HDD on this FW.. Hope this helps. Thanks ... View more

Few related DOC for your reference: GlobalProtect Global_Protect_PAN_OS5.pdf How to Configure Internal GlobalProtect Only How Often does GlobalProtect Client Try to Connect to the Gateway for Internal-Only GlobalProtect? Thanks ... View more

Thanks for your update. It looks like, there is no relevant SYSTEM logs during the incident. It would be better to contact support and let them analyze the tech-support file for root cause. Thanks ... View more

Hello Oskare_o, I hope you have attached PAN SYSTEM logs here. Is there any log entries just before the incident happened. (11:59) ? Thanks ... View more

Yes. Dileep is correct. Just to add to it, in an FTP connection, there will be only one control connection, but may have multiple data-connectiones for each transaction. For an example, after successful login, if you apply  LS (directory listing)/PUT/GET, every time it will create different data connections. Thanks ... View more

Few more related discussion threads for your reference: Skype Re: Skype &amp; unknown traffic Skype-probe rule catching other traffic tcp Hope this helps. Thanks ... View more

Hello TigranGevorgyan , Insufficient data means that there was not enough data to identify the application. So for example, if the 3-way TCP handshake completed and there was one data packet after the handshake, but that one data packet was not enough to match any of our signatures, then you would see insufficient data in the application field of the traffic log. If you open the traffic logs and analyze it in details, you will see the number of packets in each direction (server to client and client to server) will be very less. Secondly, the skype-probe is an application for controlling the probing behaviour of Skype. It is working on a UPD protocol with dynamic port. Reference DOC Controlling Skype Incomplete, Insufficient data and Not-applicable in the application field Hope this helps. Thanks ... View more

Most of the customers will not have a default allow rule in their production network, which will allow all unwanted traffic through the firewall. Hence, we should suggest some resolution which will be valid and secure for a production network. Thanks ... View more

Even if you will configure the service route ( through through Ethernet 1/5-Untrust interface), I hope you have to configure a "Untrust-to Untrust" security rule to allow traffic for management. Which will potentially allow anyone from internet to initiate an attack ( not recommended). There should be some valid logic, why ADMIN guide suggested to have a L3-Trust interface for service route. Try to understand the fact, instead of "extra over had" Thanks ... View more

You mat try this DOC: Export a List of Address Objects or Security Policies and Import into a Spreadsheet Thanks ... View more