About HULK

Hello Minow, You should enable sync-with peer option on the active firewall in order to push the downloaded database to the passive FW. Which model of PAN FW you are having and what is the running PAN OS version..? Could you please share CLI output FW>show system info   Thanks ... View more

Hello Mehar, ARP load sharing is only really effective with directly connected clients over L2. The basic recommendations are given below, a. HA cluster is not deployed in a layer 3 sandwich b. No layer 3 separation between the hosts in the LAN and HA cluster. Since the HASH of the MAC address in the ARP request is used to for load sharing, a layer3 device between the hosts and cluster will defeat this purpose, because the HA c. The cluster will only see the MAC address of the router. If your clients are connected through those sub-interfaces within the same L-2 networks, then as per my understanding it should work. But, I never tried this   . Thanks ... View more

Hello Sir, Please go through below mentioned knowledge base article, it might help you. Supported MIBs What MIBs supported on the PAN? What is the SNMP OID for monitoring internal temperature or CPU utilization? SNMP OID's Thanks ... View more

Hello, Minow, Do you have independent internet connectivity through both firewall's ( both HA node) management interface...? If so, then I would recommend to use download and install time slightly different on both nodes while "sync To Peer" is enabled. You can verify the same information under Monitor >> System logs and CLI command mentioned below PAN-FW> less mp-log paninstaller_content.log PAN-FW> less mp-log ms.log Thanks ... View more

Hello Shyams, Could you please let me know the other end device vendor ( other end of the tunnel). Also check PROXY-ID on both sides. Only Palo Alto and Juniper firewall take 0.0.0.0 /0 as a PROXY ID by default. If the other end is a different vendor BOX then you have to manually configure the PROXY-ID in order to pass traffic through tunnel. Details, Explanation about PROXY ID: The ID payload during IPsec phase-2 negotiation, contains the proxy identities on whose behalf the initiator does the negotiation. These are generally IP address subnets, but they can have more fields, such as port, too. In the case of a site-to-site IPsec set up with two gateways doing IPsec negotiations with each other, the proxy IDs are based on rules defined on the gateways that define what type of traffic is supposed to be encrypted by the peers ( specific source, destination, protocols). So, if you have multiple subnets to allow behind both VPN peers, there will be multiple SPI ( security parameter Index) to enhance the security and administrative control over the VPN tunnel. Thanks ... View more

Hello Gregoux, Threat signature match processing prior to the protocol decoder and the matching engine is used for content/ threat signature pattern matching, If signatures are changed during any transaction, we will mark the FPGA as unavailable, load the new signatures into the FPGA, then unmake it. The user or administrator is not having control on it, whether the traffic will be offloaded or not. It's depending on the traffic pattern only. Thanks ... View more

Hello Todd, Is there any related information pops up under Monitor > Threat logs...? Also please apply below mentioned command to stop suppressing repetitive logs on PAN FW. # set deviceconfig setting logging log-suppression no Thanks ... View more

Hello Sir, Could you please check if the destination is having a valid route to send back the traffic to PAN firewall..? 1. Is the destination is reachable from PAN firewall ( egress interface)...? Thanks ... View more

Hello Sean, I would request you to follow below mentioned 2 steps. Step-1: You can send a request to brightcloud to change the URL categorization for "ea.sendcpt.com". Please follow the below mentioned document for the same: How to Request a URL Category Change from BrightCloud Step-2: For the time being, you can create a custom URL category for "ea.sendcpt.com" to allow it through Brightcloud. How To Create Custom URL Categories Hope it will help you. Thnaks ... View more

Hello, I saw the session status is showing as =" INCOMPLETE". Incomplete means that either the three way TCP handshake did NOT complete or the three way TCP handshake did complete but there was no data after the handshake to identify the application. In other words that traffic you are seeing is not really an application. So to explain a little clearer, if a client sends a server a syn and the Palo Alto device creates a session for that syn, but the server never sends a SYN ACK in response back to the client, then that session would be seen as incomplete. If this is an urgent requirement, please open a ticket with PAN support and let me know the ticket number. Thanks ... View more

Hello, In case of site-to-site VPN, I would recommend you to configure Proxy-ID to more control over the traffic and prevent unauthorized access to your internal resources. The ID payload during IPsec phase-2 negotiation, contains the proxy identities on whose behalf the initiator does the negotiation. These are generally IP address subnets, but they can have more fields, such as port, too. In the case of a site-to-site IPsec set up with two gateways doing IPsec negotiations with each other, the proxy IDs are based on rules defined on the gateways that define what type of traffic is supposed to be encrypted by the peers ( specific source, destination, protocols). So, if you have multiple subnets to allow behind both VPN peers, there will be multiple SPI ( security parameter Index) to enhance the security and administrative control over the VPN tunnel. Hope this helps. Thanks ... View more