About Remo

Remo · ‎08-22-2017

Out of the box solution: none Custom solution: --> API --> parse the logquery and build this report with a few lines of code in the language you prefer

Remo · ‎08-21-2017

Hi @Rameshwar You could simply read the release notes here ( https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os-release-notes ) to check if you find something that matched your issue. But the advise was meant as precaution ( @BPry please correct me if I'm wrong). If the update is done and the issue is gone -> good. If not you can open a TAC case to have them analyze the issue, because in the TAC case you probably also get the recommendation to update. And also if it is an issue that gets fixed, you will have to install the update. But the situation could then be even worse (at least for your customer), because if the issue is already presesent in 7.1 or even 8.0, the fix will may be only be applied there and not to 7.0 as the EoL date is already in 4 months. But there still is the possibility that there is a totally different problem: are the connections that do not hit your custom category rule encrypted? If yes and you do not decrypt traffic, is the SNI attribute in the TLS handshake present? Did you test all the URLs in your category if you add all of them into seperate categories or does this sorkarouny only for some of the urls?

Remo · ‎08-21-2017

I do not work for paloalto, so this is ot an official statement, but I don't know if this community forum (even if there are people from palo here) is the right place to request something like that ...

Remo · ‎08-21-2017

Hi @Kashif_Noor Why don't you just try this to see if it works? Because I would be interested too 😉 But now something hopefully more helpful: As it is also possible with RADIUS, I assume that it will also work with SAML. But it's more a two way communication. One part is to have your firewall connecting to your LDAP directory to get the group mappings and also to be able to use LDAP groups in your policy or in your global protect gateway. If you there configured SAML as authentication, your IdP will tell the firewall which user just logged in and the firewall is able to check to what synchronized groups this user belongs to For pre-logon you can only use a certificate profile, because at that stage the certificate is the only thing which is available without user-interaction. But SAML can then be used afterwards for userlogin, as described somehow in point 1 to apply user/group based policies/configurations.

Remo · ‎08-21-2017

So you simply had to enable "dynamic URL filtering" in your URL profile?

Remo · ‎08-21-2017

Or another admin changed something? But I also think it's @BPrys possibility 2 (if you didn't create an EDL reachable over https, so that it requires a certificate profile; or a new log forwarding profile and you created the required serverprofile at the same time; and probably more possibilities ...)

Remo · ‎08-21-2017

Tried reinstall or revert the apps and threats update?

Remo · ‎08-21-2017

@MPI-AE In addition to @TranceforLife's question: if you log the traffic, do you have no logs for that rule or effectively for that connection (src and dst IP as filter)? Or is the printer may be not responding (or wrong/no default gateway?) And you have a rule above your any-any-allow rule with an application with default ports "tcp/udp/dynamic", so all connections never hit your test-rule?

Remo · ‎08-18-2017

Cannot confirm and/or explain this. I did exactly that now quite a few times and this never happened on our Panorama appliance. Maybe there was a missunderstanding between TAC and your customer, but that this should be "expected behaviour" makes absolutely no sense to me.

Remo · ‎08-17-2017

@Raido_Rattameister Thanks for your reply. Yes, this would actually be a pretty simple solution. But theres two little problems (besides the one that there are important information missing in my initial post) This "one" firewall unfortunately is a active/passive HA pair Its not only to view current data. We have to store logs for 180 days. And these logs need to be available

Remo · ‎08-17-2017

Hi all, I hope someone already did something like that to answer my question 😛 We have a virtual Panorama on PAN-OS 8 with a local log collector. On this panorama we manage differdnt firewalls and also store the logs of these firewalls. This panorama is in a secure zone where we ONLY allow acces for firewall administrators. So far so good. Now we have a customer who got a visit from PaloAlto itself, where he was shown PaloAlto products - including Panorama. Result of this visit was, the customer now asks me if he could have access to Panorama to view specially the ACC tab of the logs of ONE firewallcluster. And unfortunately not only current data. We are storing these logs for 180 days. So he'd likes to have access to this data, for reporting reasons. Our own policy now doed not allow to give the customer this access. But my idea now was the following: we build a second panorama only for this one firewall of this customer. This second panorama will not be used for managing this firewall because on the first panorama we forward some specific logs to the second panorama, where the customer can have access to view these logs. Is this even possible with PAN-OS 8 and the local log collectors? Any input or better ideas is appreciated 😉 Regards, Remo

Remo · ‎08-16-2017

Ok. On your screenshots the AE seems to be up (->green icon), but is the LACP channel also up? What LACP settings do you have on the PA? Is the spanning tree status "forwarding" on your switch in VLAN 180?

Remo · ‎08-16-2017

@jvalentine It is possible to configure the url profile without a license and apply it to a policy ... but did yoz really get url logs?

Remo · ‎08-16-2017

The device priority does not help you in split-brain situations. Split-brain is, as described by @TranceforLife, when the firewalls cannot communicate, so both peers assume the other one is down -> both change to active state. The device priority is primary needed if you have one firewall which should, in most cases, handle the traffic. So in combination with preemptive mode, this makes sure that after a problemsituation is solved, the firewall with the higher priority (lower value) will change back to active. If you don't care which firewall is active, there is actually no need to set different values (even if I recommend to do it anyway), because if both firewalls have the same value, the one with the lowest mac address will become the active clustermember. @jdprovine If you need to reboot the firewall after a split-brain to restore full functionality of the cluster, this sounds to me like a bug ... do you have PAN-OS 8.0.1 running?

Remo · ‎08-16-2017

As soon as you choose "All" under device groups in the monitor tab, the configuration log will show up on the left side (if your user has enough rights to view these logs)

Member Since	‎03-20-2013 04:23 AM
Date Last Visited	‎11-26-2025 01:29 PM
Posts	2,247
Total Likes Received	806

Online Status	Offline
Date Last Visited	‎11-26-2025 01:29 PM

About Remo

Re: Certificate Expired Warning in Deploy but all certificates are good

Re: How to request a URL filtering change to High-Risk?

Re: Template vs Device Group

Re: sorting question

Re: Panorama Disk

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Bad support from plaoalto

Re: Activate Firewall with Expired License / Unknown Auth Code

Re: Wait time

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Active-Passive pair takes long to show the status when one is rebooted.

Re: sorting question

Re: Deal Registration End Customer Details not Include

Re: Enable Qos on sub-interface

Firewallcrash because of Application cloud Engine (ACE)

Re: Admin console unreachable/cant remote in or ping - PA support wont let you submit a ticket without a TSF file - which you get via admin console

Re: How to request a URL filtering change to High-Risk?

Re: Log Container Page Only - impact?

Re: Stop wsc files

Re: Customer Support Portal error

Nominated Discussion - Sorting Question

Nominated Discussion: URL Filtering in TLS v1.3

How to Add Log Forwarding Profiles in All Security Policies

Re: PA System Alert Reports

Re: URL category not effecting to all traffic passing through security policy

Re: False-Positive on Comodo

Re: SAML ADFS for GlobalProtect

Re: custom report - "unknown" category

Re: Server error : Partial commit is not allowed. Full commit must be completed.

Re: Traffic seen as application "authentic8-silo"

Re: PA 3020 - new security rule isn't active.

Re: Altering Cloned Template Changes Original?

Re: Virtual Panorama for Log viewing only

Virtual Panorama for Log viewing only

Re: LACP Aggregate Group with Subinterface

Re: Custom URL Category in security rule - traffic log shows allowed with "any" in URL Cat

Re: sync issues

Re: Panorama configuration logs

Seattle Beta - GlobalProtect (ELK)

Unlock your full community experience!

About Remo