About Vijaygvasan

Hi Team,   I have a query where i need to block some unknown attacker or someone malicious from external trying to access my internal network or DMZ. I need to ways to block or deny those specific traffic. We have enabled country based block, we have IP based block yet is there anyother way to block or deny malicious domains except using EDL, Which is aldready configured.   Let us know the ways to block or deny unknown or malicious sources from accessing the internal or dmz network.   ... View more

Hi Team,   I have three VPN connection for three isp network. We need to load balance the VPN connection when it reaches to a particular threshold for example 75% or 80% then the traffic need to shift to other tunnels.   For example if one tunnels is being used by 5 or 10 users and someone downloads or uploads a content then according to the bandwidth utilization is there any way to load balance the tunnel traffic to other tunnels.   Or is there any other way to load balance the traffic of VPN equally. If so please do let me know regarding this.   Regards.. ... View more

  Hi Team,   We are facing issue with OSPF is not working properly over the firewall as per the configuration part seems fine we checked with the below given document. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5ZCAS   All the configuration for HA is configured as per above given document. We checked with the configuration of OSPF as per below document which is fine. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEECA0   We checked with ping status from firewall but the packet is not reaching the neighbor device also not able to see the same over monitor tab. But on the other hand from Peer device we are able to see ping happening to the core device which is the neighbor Also we cannot find neighbor details over the OSPF tab. There is no LACP configured on any aggregate interface. Provide your output on the earliest to sort this out.   ... View more

Hi Team,   I have a situation where users a should not be able to login to user b machine as the same goes to user b as well. Is there a way to map the HIP profile to a specific user like mapping the specific mac address to a specific user so that the mentioned user alone gets logged in to that specific system or machine. Kindly share any documents related to this.   Thanks Vijay ... View more

This is regarding whether VPN Client store any session related information over the client software. Kindly find below comment that needs to be noted.   "Check if the VPN software writes session data to the remote workstation's disk. If possible, use a connection method that keeps the data in memory only, preferably encrypted."   kindly share the support document which will be submitted with Management. I could not find any document regarding this concern.   Kindly share the document. Thanks & Regards, Vijay ... View more

Hi Everyone,   Greeting!! I have a concern regarding the Global protect log forwarding for forwarding the logs to Qradar SIEM Tool.   The concern is about whether Global Protect support for LEEF Format if it does support i want a document that contains the required fields about the Global protect to be sent to the SIEM Tool. I want to confirm two things whether Global protect does support LEEF format? If it does support could you please share the required document or the whole details that needs to be in place to forward the log to Qradar from PA devices? Does Global protect provides public IP address details over the SIEM tool or both public and private address can be shown? I have also found documents like these but no mentioning of global protect https://www.ibm.com/docs/en/dsm?topic=SS42VS_DSM/t_dsm_guide_palo_alto_syslog_dest.html https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEcCAK   but no where there is a mention for Global protect syslog forwarding to Qradar in LEEF format. Kindly in need of you assistance guys. ... View more

Hi Team,   Current PAN OS -8.1.10 Customer had run a VAPT assesment where they came up with certain Vulnerability such as 90317 - SSH Weak Algorithms Supported 70658 - SSH Server CBC Mode Ciphers Enabled 71049 - SSH Weak MAC Algorithms Enabled While checking certain things are not there from the firewall end but while checking using their Vulnerability Assessment tool they are having these mentioned output as above mentioned vulnerability. Below is the firewall Output   Firewall output: # show deviceconfig system ssh ciphers mgmt aes128-ctr; aes128-gcm; aes192-ctr; aes256-ctr; aes256-gcm;   # show deviceconfig system ssh mac mgmt  { hmac-sha2-256; hmac-sha2-512; }   Are the above mentioned Vulnerability is addressed in any other PAN OS version?   ... View more