About Remo

Remo · ‎08-03-2018

@murphyca What you actually asking for is - as already mentionned - not possible. But depending on the configurarion of your network and these computers there are some ways for this: DHCP Reservations so that these computers always get rhe same IPs and you then could create addressobjects for Seperate VLAN for these computers as written by @OtakarKlier (probably a good idea anyway to seperate these computers from the rest of your network) Configure a default user that is logged in automatically, so you will be able to write user-based rules (as mentionned by @gwesson) Parse the DHCP logs to create dynamic addressgroups which you can use as source in your policy (as proposed by @BPry) Use FQDN addressobjects which the firewall will update according to the TTL of the DNS entry Configure the computers browsers to use custom user agent strings and create a custom application that matches on this user agent string

Remo · ‎08-01-2018

Hello, I have a problem with my minemeld server. Some days ago I reached 128 nodes (sum of miners, processors and outputs). If I do a commit with 128 nodes or more the minemeld process seems to keep restarting over and over. As soon as I reduce to 127 nodes or less it works again. In the logs I did not find a lot ... 2018-07-24T16:18:32 (7301)queryprocessor.__init__ INFO: Query 322ca06b-e087-43db-8970-c52bf86efecc - 2018-07-24T16:18:32 (7301)queryprocessor._core_run INFO: Query 322ca06b-e087-43db-8970-c52bf86efecc finished - 100 2018-07-24T16:18:32 (7301)storage.remove_reference WARNING: Attempt to remove non existing reference: 322ca06b-e087-43db-8970-c52bf86efecc - 000000005b4be000 2018-07-24T16:18:32 (7301)storage.remove_reference WARNING: Attempt to remove non existing reference: 322ca06b-e087-43db-8970-c52bf86efecc - 000000005b551a80 2018-07-24T16:18:32 (7301)storage.remove_reference WARNING: Attempt to remove non existing reference: 322ca06b-e087-43db-8970-c52bf86efecc - 000000005b4d3180 2018-07-24T16:18:32 (7301)storage.remove_reference WARNING: Attempt to remove non existing reference: 322ca06b-e087-43db-8970-c52bf86efecc - 000000005b4fd480 Traceback (most recent call last): File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/hub.py", line 140, in handle self.handler(*self.args, **self.kwargs) File "/opt/minemeld/engine/core/minemeld/traced/main.py", line 75, in _sigterm_handler raise KeyboardInterrupt('Ctrl-C from _sigterm_handler') KeyboardInterrupt: Ctrl-C from _sigterm_handler 2018-07-24T16:21:01 (7301)writer.stop INFO: Writer - stop called 2018-07-24T16:21:01 (7301)queryprocessor.stop INFO: QueryProcessor - stop called 2018-07-24T16:21:01 (7301)storage.stop INFO: Store - stop called 2018-07-24T16:27:43 (962)main.main INFO: Starting mm-traced version 0.9.44.post1 2018-07-24T16:27:43 (962)main.main INFO: mm-traced arguments: Namespace(config='/opt/minemeld/local/config/traced/traced.yml', verbose=False) 2018-07-24T16:27:43 (962)main.main INFO: mm-traced config: {} Traceback (most recent call last): File "/opt/minemeld/engine/current/bin/mm-traced", line 11, in <module> load_entry_point('minemeld-core', 'console_scripts', 'mm-traced')() File "/opt/minemeld/engine/core/minemeld/traced/main.py", line 136, in main comm.start() File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 595, in start c = amqp.connection.Connection(**self.amqp_config) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 165, in __init__ self.transport = self.Transport(host, connect_timeout, ssl) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 186, in Transport return create_transport(host, connect_timeout, ssl) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 299, in create_transport return TCPTransport(host, connect_timeout) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 95, in __init__ raise socket.error(last_err) socket.error: [Errno 111] Connection refused Unhandled exception in thread started by sys.excepthook is missing lost sys.stderr 2018-07-24T16:27:45 (1939)main.main INFO: Starting mm-traced version 0.9.44.post1 2018-07-24T16:27:45 (1939)main.main INFO: mm-traced arguments: Namespace(config='/opt/minemeld/local/config/traced/traced.yml', verbose=False) 2018-07-24T16:27:45 (1939)main.main INFO: mm-traced config: {} Traceback (most recent call last): File "/opt/minemeld/engine/current/bin/mm-traced", line 11, in <module> load_entry_point('minemeld-core', 'console_scripts', 'mm-traced')() File "/opt/minemeld/engine/core/minemeld/traced/main.py", line 136, in main comm.start() File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 595, in start c = amqp.connection.Connection(**self.amqp_config) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 165, in __init__ self.transport = self.Transport(host, connect_timeout, ssl) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 186, in Transport return create_transport(host, connect_timeout, ssl) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 299, in create_transport return TCPTransport(host, connect_timeout) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 95, in __init__ raise socket.error(last_err) socket.error: [Errno 111] Connection refused 2018-07-24T16:27:47 (3575)main.main INFO: Starting mm-traced version 0.9.44.post1 2018-07-24T16:27:47 (3575)main.main INFO: mm-traced arguments: Namespace(config='/opt/minemeld/local/config/traced/traced.yml', verbose=False) 2018-07-24T16:27:47 (3575)main.main INFO: mm-traced config: {} Traceback (most recent call last): File "/opt/minemeld/engine/current/bin/mm-traced", line 11, in <module> load_entry_point('minemeld-core', 'console_scripts', 'mm-traced')() File "/opt/minemeld/engine/core/minemeld/traced/main.py", line 136, in main comm.start() File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 595, in start c = amqp.connection.Connection(**self.amqp_config) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 165, in __init__ self.transport = self.Transport(host, connect_timeout, ssl) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 186, in Transport return create_transport(host, connect_timeout, ssl) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 299, in create_transport return TCPTransport(host, connect_timeout) File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 95, in __init__ raise socket.error(last_err) socket.error: [Errno 111] Connection refused 2018-07-24T16:27:50 (4843)main.main INFO: Starting mm-traced version 0.9.44.post1 2018-07-24T16:27:50 (4843)main.main INFO: mm-traced arguments: Namespace(config='/opt/minemeld/local/config/traced/traced.yml', verbose=False) 2018-07-24T16:27:50 (4843)main.main INFO: mm-traced config: {} Is this an existing bug or is there at least a solution on how to get more than 128 nodes? Thanks in advance for your help. Remo

Remo · ‎08-01-2018

3) This depends if you are already managing a firewall (cluster) comoletely with Panorama or not. If the firewall is already managed, then a migration is really simple. You only have to add the new firewall to the same devicegroup and template as the old one, push the configuration and then physically reconnect the cables from the old to the new firewall in a maintenance window. At least this applies to situations where you will use the same network interfaces on the old and new firewall and it also works for example if you upgrade lets say from a PA3060 to a PA5220. If you will change the network interfaces or if you want to set up the firewall in parallel that you do not need to physically change something at day X, then the best way probably is to copy the existing template(stack) and add the new firewall to this copy. In this new template you can change whatever you want (for example change from single interfaces to LACP channels). Just make sure that the interfaces are set to down until you actually migrate the firewall. In a maintenance window you can then set all the interfaces of the old firewall to down, up for the new ones and push the configuration. Depending on the used hardware this config push needs to be timed a little to keep the downtime as low as possible. This is because a PA3050 needs mlre time for a commit than a PA5220. If a firewall is not yet managed with panorama follow these steps here and then the description above in this post to leverage panorama for such a device migration.

Remo · ‎08-01-2018

2) Unfortunately no and no. The firewalls cannot be joined to AD and there is (so far) no way to use MSAs. If the requirement is that the passwords are changed periodically the only way is to write a script to get something like MSA. With a powershell script this tasks seems not that difficult. This script needs to do the following: Generate a random password (really random so that it cannot be guessed with some state information of the server) Change an accounts password in active directory Change the account credentials on the firewall with the API This script can then run as scheduled task as often as needed. ... but of course this is only as close as possible to Managed Security Accounts

Remo · ‎07-31-2018

Added FR ID 2153 - Terminal Server Agent for Linux Added FR ID 4035 - Dedicated Log category for Global Protect Added FR ID 9509 - DoH (DNS over HTTPS)/DoT (DNS over TLS) Support for DNS Sinkhole Feature

Remo · ‎07-31-2018

@BPry wrote: @ducatipilot1198s, Feature requests should be sent to your SE so that he can add your vote to an existing FR, or create a new FR if it doens't exist. SE = Sales Engineer

Remo · ‎07-31-2018

Or this one --> https://www.grc.com/sqrl/sqrl.htm

Remo · ‎07-30-2018

@PaulParlevliet So far I don't know if this is possible in the WebUI. But with the XML config and a XPATH query this definately can be done.

Remo · ‎07-27-2018

Hi @Lcroce https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/user-id/map-ip-addresses-to-users/map-ip-addresses-to-usernames-using-captive-portal/configure-captive-portal --> step 3 explains the steps where you configure a TLS profile including a certificate for the captive portal to enable it on https. I think you have to configure only the webform in the captive portal profile for not showing this http basic auth to the non domainjoined clients.

Remo · ‎07-27-2018

@SThatipelly As I wrote there is no certificate that the firewall uses to identify itself. In a standard TLS handshake only the server identifies itsself to the client - not otherwise. And this is what the firewall does in this case where the firewall has the role of the client. (https://en.m.wikipedia.org/wiki/Transport_Layer_Security)

Remo · ‎07-27-2018

Hi @SThatipelly What the firewall actually does here is a Man-in-the-middle attack on TLS connections. As you already wrote it terminates the connection and presents an on the fly generated cert to the client. This is the first connection (between client and the firewall). The second one is the connection that the firewall initiates towards the server. For this connection, the firewall does initiate a connection to the server without any client certificate - simply because there is no client cert required. If your question is about connections where a client cert is required: these connections the firewall cannot decrypt. So for these you have to configure exceptions to make them work.

Remo · ‎07-26-2018

@Brandon_Wertz wrote: I woudl agree 100%. Maybe even a ACC dashboard item? Exactly. Once global protect logs are in their own category, I think PaloAlto has a lot more flexibility to do whatever with these logs: ACC, Custom Reports, dedicated menuentries in the monitor tab, correlation events, ...

Remo · ‎07-26-2018

@Lcroce The required commands should be these here: https://FIREWALL/api/?type=op&cmd=<clear><user-cache><ip></ip></user-cache></clear>&key=APIKEY https://FIREWALL/api/?type=op&cmd=<clear><user-cache-mp><ip></ip></user-cache-mp></clear>&key=APIKEY And here is an article to get started with the API: https://live.paloaltonetworks.com/t5/Community-Blog/The-Power-of-XML-API/ba-p/202789

Remo · ‎07-26-2018

Ok, yes from a management process/cpu perspective, this could have impacts. But if the process crashes this sounds more like a bug to me. Anyway, do you have a lot of unused objects or disaabled firewallrules that you no longer need?

Remo · ‎07-26-2018

Hi @Lcroce In the Web-UI this isn't possible. Another possibility is to do that with the API, so you could write a little script that you could run if you want to de-auth a user.

Member Since	‎03-20-2013 04:23 AM
Date Last Visited	‎11-26-2025 01:29 PM
Posts	2,247
Total Likes Received	806

Online Status	Offline
Date Last Visited	‎11-26-2025 01:29 PM

About Remo

Re: Certificate Expired Warning in Deploy but all certificates are good

Re: How to request a URL filtering change to High-Risk?

Re: Template vs Device Group

Re: sorting question

Re: Panorama Disk

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Bad support from plaoalto

Re: Activate Firewall with Expired License / Unknown Auth Code

Re: Wait time

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Active-Passive pair takes long to show the status when one is rebooted.

Re: sorting question

Re: Deal Registration End Customer Details not Include

Re: Enable Qos on sub-interface

Firewallcrash because of Application cloud Engine (ACE)

Re: Admin console unreachable/cant remote in or ping - PA support wont let you submit a ticket without a TSF file - which you get via admin console

Re: How to request a URL filtering change to High-Risk?

Re: Log Container Page Only - impact?

Re: Stop wsc files

Re: Customer Support Portal error

Nominated Discussion - Sorting Question

Nominated Discussion: URL Filtering in TLS v1.3

How to Add Log Forwarding Profiles in All Security Policies

Re: Question about outbound hostname restrictions

Miners do not collect any Information when more than 128 nodes

Re: Ignite '18 Wrap Part 3 - Answer the orphaned questions and bag some swag - last chance!

Re: Ignite'18 Wrap Part 2 - Answer the orphaned questions and bag some swag

Re: Feature Request List

Re: Product Enhancement Request - Two Factor Authentication for Global Protect VPN Client

Re: Product Enhancement Request - Two Factor Authentication for Global Protect VPN Client

Re: Filter security policies by no description

Re: Captive Portal web form displaying basic auth in chrome

Re: Firewall cert-SSL forward proxy-To actual destination,

Re: Firewall cert-SSL forward proxy-To actual destination,

Re: Feature Request List

Re: Any way to de-auth a user outside of SSH?

Re: Determine configuration size on Palo Devices

Re: Any way to de-auth a user outside of SSH?

Seattle Beta - GlobalProtect (ELK)

Unlock your full community experience!

About Remo