About syadav

@rbista  Just in case you are looking for the status, this is still not possible. Currently considered as a feature request. ... View more

@ajrockn  The "None:" prefix seem to indicate the Threats (and corres. Thread ID) for domains which are identified (as suspicious) by  "Wildfire content signatures"   > The range is as follows : Wildfire Suspicious DNS Signatures: 3800000 - 4000000 https://live.paloaltonetworks.com/t5/Threat-Articles/Threat-ID-Ranges-in-the-Palo-Alto-Networks-Content-Database/ta-p/59969   Hence "None:" prefix  seems to be a notation placeholder for this threat ID range.You should be able to confirm this by your observation of the IDs in the logs.                      ... View more

@ajrockn can you tell which field in the threat log, you are referring to ? ... View more

@euanbarker    Do you mean the bandwidth requirement for the communication between the HA1 and HA2 links of the HA ? If yes, I dont readily see any document stating this information (it is tricky for the vendor to publish any specfic values). The following DOC explains what is synchronized via which link (HA1/HA2). You will find that this is very less bandwidth intensive info (more than bandwidth, stablility and availability is important here)   https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/documentation_tkb/568/1/HA_Synchronization_RevD.pdf   Also, since this is not a Active/Active setup, there is not transfer of actual traffic between the nodes (via HA3) which might have required high bandwidth (or aggregated )HA3 link.       ... View more

Hi JC,   To avoid the certificate error when using Self signed certificate, at least you need to make sure that the "signing certificate" ie the self signed CA used to sign the portal and gateway cert  is downloaded and added in the Trusted Root CA store of the end user machines.   Though there can be more complications regarding certificates (like one mentioned in the DOC below) depending on exact implementation of the GP setup. It is difficult to conclude the reason without knowing the exact setup/config.   https://live.paloaltonetworks.com/t5/Management-Articles/GlobalProtect-Gateway-Certificate-Error-When-Trying-to-Use/ta-p/57043   It would help if you could add the exact error message snapshot seen on the user machines and GP Agent and panOS version.       ... View more

@Brandon_Wertz...seems I was spot on ! 😉  Regarding pcap log, On top of my head, I dont remember any particular log file which would log the pcap setting but following comand can be used to see the realtime setting :     admin@PA-VM> debug dataplane packet-diag show setting   -------------------------------------------------------------------------------- Packet diagnosis setting: -------------------------------------------------------------------------------- Packet filter   Enabled:                   no   Match pre-parsed packet:   no             -------------------------------------------------------------------------------- Logging   Enabled:                   no   Log-throttle:              no   Sync-log-by-ticks:         yes               Features:   Counters: -------------------------------------------------------------------------------- Packet capture                                                                                             <<<<<<<<<<<<<<<<   Enabled:                   no   Snaplen:                   0             --------------------------------------------------------------------------------     A painful way of achieving this would be writing a script and fetching this output periodically.         ... View more

Hi Burtond,   As others have mentioned, NO license is required for setting up IPSEC VPN on Palo alto firewalls.   Regarding setting up a VPN with Cisco, I would advise you to keep in mind that the "proxy-IDs" match (vice-versa) exactly as on Cisco since Cisco doesnt like 0/0 proxy IDs. This is a common gotcha when dealing with IPSEC between Cisco and other vendors (which support 0/0 proxy IDs)     ... View more

Hi Marcos,   Thanks for your response. Also make sure that if the Client certificate is generated on firewall you export it in format PKCS12.   If this advice helps your case, please mark it as a solution so that it may help others.               ... View more

  Hi Marcos,   Please find the answers to your questions below :   1) I would recommend you to remove the older certificate from the personal store and add the new one. Certificate management is usually done with GPO, you may use the same to deploy/withdraw the certs.   2) Yes, in case the signing CA certificate is renewed, it needs to be imported on the client machines and added in the Trusted     Root CA store.   Please mark as a solution if it resolves your problem. ... View more

  Hi Marcos,   There are two possibilities for which you may be using the Device (locally) generated certificate :   1.  Server Certificate for Portal and Gateway : In this case the signing CA cert is still the same and has not changed.      Hence the end users would still be able to validate the new server certificates as they have the signing CA cert.   2.  Client Certificate for Authentication of End users : If this certificate has expired and renewed then it needs to be imported       on the local devices (clients). If not, they would not authenticate the local machine due to expiry.     ... View more

Hi Brandon,   It is less likely to be NAT exhaustion issue since other traffic like HTTPS (and other) like is working fine (which would also use source NAT). This seem to be a software issue which would require deeper analysis by the Tech support team.         ... View more