About HULK

Hello, Could you please apply CLI command > tail follow yes mp-log ms.log >>>>>>>> while  downloading the Application-and-threat database from GUI. It would show the reason behind the failure. Thanks ... View more

Hello Mario, Ideally, the PAN firewall will automatically purge old logs while it will reach the 100% of it's allocated space on the HDD. Below mentioned doc will explain you about the functionality: What does alarm "Log Database Exceeds Alarm Threshold Value" mean? How to Determine How Much Disk Space is Allocated to Logs When are Logs Purged on the Palo Alto Networks Devices? If the PAN firewall's data-plane restarted it's own, then you can verify SYSTEM logs just before the incident happened. It might be not related to database purging. Else open a case with support to get an RCA. Hope this helps. Thanks ... View more

Hello Nelson A, What is the PAN OS version running on your firewall...? Have you seen any error/warning messages on SYSTEM logs..? Which Devices in an HA Pair Can Connect to the PAN-DB Cloud? The Active device will not regularly sync the cache over to the Passive. Since the Passive device is not getting any traffic, it will also not do any cloud lookups on its own for URLs. Every 8 hrs or so, the Active device will make a backup of its MP cache, and that will get synced to the Passive device. If you use the CLI command on the Passive device to download a seed database, it will do that as well. So, basically when the Passive becomes active and do a URL lookup it will then update its version too. Thanks ... View more

Hello Mobradovic, The message that you were receiving " SYSTEM ALERT : critical : "Disk usage exceeds the limit, 100 percent in use, cleaning filesystem" is normal as it is you would have set the alarms for the system logs. Everytime the logs reaches a certain threshold an alarm will be generated. The big tech-support file is not causing the issue here. Bythe way, a user can not delete a tech-support file from the firewall CLI and GUI. Palo Alto TAC engineer should have access to the root to delete the tech-support file from /tmp directory. FYI: Thanks ... View more

If the PAN FW is running on 6.0.X version. There is a new feature available to find any command with matching keyword from CLI. admin@DADA> find command keyword "routing" Thanks ... View more

Hello Numan, If it is in HA environment, i don't think the PAN FW will shift data, as Wooki described "April 24 ~ May 1 of data not visible. Today check the Network Monitor April 25 ~May 2 of data not visible." Thanks ... View more

Could you please verify the same on the ACC report. It shows the correct data..? Thanks ... View more

Hello Robert, Through CLI, by default  you will get the max session capacity of only DP-0 ( Data-plane-0).  If you change the target DP to DP-1 and  run the same command, it will give you: admin@eapafw01> set system setting target-dp dp1 Session target dp changed to dp1 admin@eapafw01> show session info -------------------------------------------------------------------------------- Number of sessions supported:                    786418  >>>>>>>>>>>>>>>>>>>>>>>>>>> Max capacity for DP-1 Number of active sessions:                       0 Number of active TCP sessions:                   0 Number of active UDP sessions:                   0 Number of active ICMP sessions:                  0 Number of active BCAST sessions:                 0 Number of active MCAST sessions:                 0 Number of active predict sessions:               0 Session table utilization:                       0% Number of sessions created since bootup:         76 Packet rate:                                     0/s Throughput:                                      0 kbps New connection establish rate:                   0 cps -------------------------------------------------------------------------------- As we know, PA-5020 is having 2 data-plane ( DP-0 and DP-1), then the total session capacity of the box would be ( 1048574+786411= ~ 1834992). Hope this helps. Thanks ... View more

Hello as-mg, There is a BUG open with engineering to fix this issue. I do agrre, this is not a permanent fix, only things, you need to re-apply the command if you reboot the FW. Thanks ... View more

Hello MMCiobanu, PAN OS version 6.0.x will workfor monitoring AGG and subinterfaces. Thanks ... View more

Hello MMCiobanu, Prior to PAN-OS 6.0.0, NetFlow data could not be exported on a per-subinterface basis. Starting in PAN-OS 6.0.0, NetFlow data can be exported on a per-subinterface basis. Bug 43280 - Exported Netflow Logs Aggregates Sub-interface Data Thanks ... View more

Hello MMCiobanu, Could you please let me know the type of Netflow you have configured here. With the exception of vendor specific variations of NetFlow, there are 2 different implementations of NetFlow: Standard Netflow: The standard NetFlow implementation will collect all IP traffic information. Sampled Netflow: Only 1 out of x packets is processed. For internet backbones is standard NetFlow to resource intensive, that's why they only collect samples instead of all the traffic. The Palo Alto Networks firewall supports the standard NetFlow implementation. Thanks ... View more

Hello as-mg, I would recommend you to set the pattern matching on software (> debug dataplane fpga set sw_aho yes) to avoid any future occurrence. Thanks ... View more

Hello Ericcapuano, So far, PAN threat database is not having any signature for the above mentioned CVE. I would request you to open a case with support, so that they will verify the coverage for this CVE. Thanks ... View more

Hello Efritz, Could you please modify the refresh time of the block list and try to commit again. Before applying the commit command, please follow the ms.logs to get some more information. CLI> tail follow yes mp-log ms.log Please find below few related docs, it might help you. Configuring Dynamic Block List (EBL) on a Palo Alto Networks Device dynamic block list Re: How to use dynamic block list? Dynamic Block List format clarification Thanks ... View more