About AnalysisMan

AnalysisMan · ‎06-06-2019

Same issue on PA-3220 with PAN-OS 8.1.8.

AnalysisMan · ‎10-12-2018

You should be able to download the WildFire DB on the Customer Support Portal -> Updates -> Dynamic Updates. And then you import the package on the firewall: Device -> Dynamic Updates. Hope this helps!

AnalysisMan · ‎10-11-2018

FYI - PAN-OS 8.1.4 is released today and available, but I don't see any addressed issues with ARP. https://www.paloaltonetworks.com/documentation/81/pan-os/pan-os-release-notes/pan-os-8-1-addressed-issues/pan-os-8-1-4-addressed-issues

AnalysisMan · ‎10-11-2018

Use the globalprotect show --error command to view errors reported by the app. user@linuxhost:~$ globalprotect show --error And make sure if your system is reachable to the VPN portal and gateways by running 'ping gp.yourcompanydomain.com' (ICMP could be blocked), or 'telnet gp.yourcompanydomain.com 443'. Also, UDP/4501 is used for IPSec tunnel connections between the GlobalProtect agents and Gateways.

AnalysisMan · ‎10-11-2018

The VPN portal should be an external IP address or FQDN since the users are located outside, and they use external DNS servers like 8.8.8.8, and TCP/443 is used for communication between GlobalProtect agents and Portals, or GlobalProtect agents and Gateways. Also, UDP/4501 is used for IPSec tunnel connections between the GlobalProtect agents and Gateways.

AnalysisMan · ‎10-11-2018

Try this: uncheck 'Verify Update Server Identity' on the Device -> Setup -> Services tab, commit and check if it works.

AnalysisMan · ‎10-11-2018

The TAC didn't recommend PAN-OS 8.1.2 and 8.1.3. Your issue might be related to the following defect. I will go with 8.1.1 this weekend. Hope this helps! # Here is the defect PAN-101604. Please verify if it is applicable in your scenario OR not. [8.1.2 PA-3220] Firewall sends ARP broadcast request with wrong Sender/Target IPs , with "pan_plfm_fe_cp_arp_delete(src/fe/cp/pan_platform_fe_cp.c:1544): Cannot find such an entry" 1) FW sends ARP request broadcast for its own interface, with neighbor's IP as sender's IP address, triggered by neighbor's OSPF update message. 2) "show arp all" shows entries for FW's own interfaces. These entries are marked as "incomplete." Workarounds: Disable OSPF if possible OR downgrade to 8.1.1.

AnalysisMan · ‎10-11-2018

It looks like here: https://live.paloaltonetworks.com/t5/Customer-Advisories/tkb-p/SupportAnnouncements

AnalysisMan · ‎10-11-2018

I've got an update from the TAC as below. # The reason for the Microsoft issues is that an Office365 host was incorrectly categorized as 'Phishing' in an earlier PAN-DB update. This has since been flipped back to the correct category of 'computer-and-internet-info' in a subsequent update. The issue is still being analyzed as we speak. We would be posting an update to the Customer Advisory board once we have more details surrounding the incident and an RCA is determined.

AnalysisMan · ‎10-11-2018

There was a massive outage on Microsoft sites. It has been resolved now, but I was wondering if this something related to Palo Alto Dynamic updates. https://www.reddit.com/r/sysadmin/comments/9nc9oj/microsoft_authentication_issues_with_akamai_ips/ We just got nailed this morning with issues caused by Palo Alto Firewalls adding an Akamai IP/IP-range to it's blocked IP definitions in it's regular definition updates sometime in the past 12 hours. This caused a blank page for redirection to o365 authentication prior to ADFS for owa/onedrive/sharepoint/etc so users couldn't connect to these services. Just a heads up for anyone else that might be bumping into this, I hear of a number of other local orgs bumping up against this so I'm guessing it's reasonably widespread.

AnalysisMan · ‎09-26-2018

I submitted RMAs twice and got a good firewall. I couldn't believe that three firewalls were bad. That was a once-in-a-lifetime experience!

AnalysisMan · ‎09-07-2018

You won't be able to see the deny logs for the implicitly denied rule, unless you set to log it with a specific rule. You may try two options. 1) Add two Services Objects with TCP/20 and 21, and allow it on the Security Policies. 2) Do a packet capture while you are testing an FTP connection.

AnalysisMan · ‎09-07-2018

There is an option with "Allow with prompt", which shows the prompt for the upgrade. However, please keep in mind that many people do not click on the upgrade prompt. We were using this option a long time ago, and many people never upgraded their GP client. When a bug hit on GlobalProtect by Dynamic Updates, it impacted on the GP client users with lower versions. And they couldn't connect to the VPN. Therefore, I've changed the option to "Transparent" for mandatory update. Hope this helps!

AnalysisMan · ‎09-06-2018

I've got two new PA-3220s in HA (active/passive). Active firewall's HSCI port does not light up green LED, whereas passive light up green. I used an SFP+ and MM cable (tried Twinax as well). I have a replaced firewall for active firewall, but it still doesn't up. However, all HA state looks fine on the Dashboard/High Availability. Is this something expected behavior? Active firewall - no HSCI LED Passive firewall - HSCI ok

AnalysisMan · ‎12-06-2017

I'm working on the 8.0.6 upgrade as well. Last Friday, I upgraded 3 set of PA-500s in HA from 7.1.x to 8.0.6, and it seems okay, no complaints yet. However, there are always bugs in there, and it triggers in different situations. So the final decision is yours.

Member Since	‎03-11-2013 08:22 PM
Date Last Visited	‎04-11-2024 05:07 PM
Posts	56
Total Likes Received	30

Online Status	Offline
Date Last Visited	‎04-11-2024 05:07 PM

About AnalysisMan

Re: Global Protect Not working MacOs Ventura

Re: Browser behavior when using SAML authentication with GlobalProtect

Re: Global Protect Not working MacOs Ventura

Re: Global protect licence

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

Re: User-ID with Azure AD

Re: User-ID with Azure AD

Re: Cannot connect to Globalprotect

Re: cannot commit - failure parsing config response module dhcpd

Re: GP Issue Gateway Fake

Re: User-ID with Azure AD

Re: Global Protect Not working MacOs Ventura

Re: Global Protect Not working MacOs Ventura

Panorama Read Only mode?

Re: cannot commit - failure parsing config response module dhcpd

Re: After Upgrading our PA-820 to 11.0.2, we're seeing lots of data on dns-base application.

Re: PAN-OS 10.2 on PA-220

Re: Assigning a static IP to a Global Protect user

Re: Active Directory Users & Computers Latency with GlobalProtect

Re: Active Directory Users & Computers Latency with GlobalProtect

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Re: Wildfire appliance on a darknet

Re: Major issue PanOS 8.1.3: Network intefaces go down

Re: Connection issues with globalprotect VPN

Re: VPN portal inside or external address

Re: Unable to contact updates.paloaltonetworks.com or staticupdates.paloaltonetworks.com

Re: Major issue PanOS 8.1.3: Network intefaces go down

Re: Microsoft authentication issues with Akamai IPs blocked by Palo Alto (?)

Re: Microsoft authentication issues with Akamai IPs blocked by Palo Alto (?)

Microsoft authentication issues with Akamai IPs blocked by Palo Alto (?)

Re: PA-3220 HSCI port's LED is not light up

Re: FTPS connections are not working

Re: Notify message of upgrade in GlobalProtect

PA-3220 HSCI port's LED is not light up

Re: Any issues not documented on version 8.0.6?

Unlock your full community experience!

About AnalysisMan