About Metgatz

Hello good afternoon, as always thank you very much for your time and collaboration.   I have a question, currently I have configured at the level of Global Protect, cookies in both Portal and Gateway.   The issue is that this was configured to keep the credentials and not have to be entering these manually, twice, ie for the portal and gateway.   -Now I would like to be able to use cookies but only to ask for the credentials in one instance, not in two, i.e. ask for them for the Portal, but for the Gateway simply use the authentication already done in the Portal.   To achieve this goal, how should I configure the cookies section?   Thank you, I remain attentive   Best regards ... View more

HA - Path-monitoring - VLAN-TAG-Vwire environment Hello good afternoon, as always thanks for the support and for the good will as always, it is much appreciated. I have the following question:   Environment detail: HA firewall, Vwire, with Vlan Tags by subinterfaces of a portchannel ( Ae1 ).   Is it possible to apply some kind of Path monitoring, to an environment, where vwire exists, but with the condition that it has vlan, tagged subinterfaces.   Reviewing this article, which is somewhat old, it indicates that in Vwire environments, of TAG of vlans, it is not possible: https://live.paloaltonetworks.com/t5/general-topics/path-monitoring-virtual-wire/m-p/20691#:~:text=Next%20Topic-,1%20ACCEPTED%20SOLUTION,-Swhyte     Path monitoring Vwire: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClrwCAC   We need to monitor an IP, but the environment is as discussed above, vwire, tagged vlans subinterfaces.   Thank you very much   Best regards ... View more

Reboot/upgrade time approximate/estimate Panorama M-200   Good morning, thank you for the help and collaboration as always.   Question, how many hours it takes approximately to perform the following Upgrade of Panorama M-200, when the reboot is performed by the version to install:   1.- Reboot/upgrade time - M-200 PAN-OS 9.1.4 to 9.1.14-h4 ( recommended by TAC )   2.- Reboot/upgrade time - M-200 PAN-OS 9.1.4 to 10.0.11-h1 ?   3.- Reboot/upgrade time - M-200 PAN-OS 10.0.11-h1 to 10.1.6-h6 ?   Considering this Link/KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClyWCAS:  This KB indicates that after 90 days, when rebooting, it applies a check of the disks, which will take much longer, considering a Panorama M-200 16TB RAID storage (4 8TB RAID certified drives preinstalled). I remain attentive   Thank you   Best regards     ... View more

Hello colleagues:   Good afternoon, hope you are all well.   Some of you have reported these critical vulnerabilities to them, by Nesus Scan:   Protocol Port Name Synopsis Description Solution TCP 443 CGI Generic Command Execution (time-based) It may be possible to run arbitrary code on the remote web server. The remote web server hosts CGI scripts that fail to adequately sanitize request strings.  By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host. Note that this script uses a time-based detection method which is less reliable than the basic method. Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade. TCP 443 CGI Generic SQL Injection (blind, time based) A CGI application hosted on the remote web server is potentially prone to SQL injection attack. By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database. An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system. Note that this script is experimental and may be prone to false positives. Modify the affected CGI scripts so that they properly escape arguments.   Do you know if these two are false positives, if they can be mitigated with an adjustment or by performing an upgrade?   This was reported on PAN-OS 9.1.4 platform.   I remain attentive to your comments and suggestions   Thanks   Best regards     ... View more

Migration / Import of configuration only to a destination Vsys, a particular vsys.   Hello good afternoon, as always thank you very much for the support and collaboration as always. Please your your suggestions, advice and / or guidance, how is it possible to perform the import/load config, of a PA configuration, to be loaded only, but only in a vsys( vsys4 ) without touching anything of the rest of vsys of the firewall, just import and load that configuration to the vsys4 ?   Environment/Infra: PA-5250 Physical Firewall - HA Vsys1 ready and OK Vsys2 ready and OK Vsys3 ready and OK. Vys4 created, without any configuration, but waiting for the configuration.   Thank you, I remain attentive, best regards ... View more

Hello good afternoon, as always thanks for the support and collaboration:   I recently added a couple of Raid to m-100, as these were not configured, I made the settings at log setting level to send only configuration and system logs of the firewalls. At the configuration level, everything is fine, from panorama to the firewalls, so that the log setting has the Panorama checkbox, Device-Log-Settings, of system logs, as the configuration log, without filters in both cases, ie "All Log" in all of firewalls.   Everything is fine from the local configuration of the managed collector and the collector group. It appears in the Panorama gui as Connected and In sync, in green everything ok. all ready with the respective commit and push to the local collector. Although it is only one local collector, add the Device Log Forwarding list, all the firewalls and pointing to the local collector, the only one.   The issue is that in Panorama, I go to check the logs, I go to Monitor to the Log part "System" and "Configuration" I see nothing in Panorama, absolutely nothing ... I go to the firewall directly and if there are system and configuration logs.   I have already validated the connectivity and port issues and everything is ok without restrictions. Infra-environment: Firewalls Pan-os 9.1.4 and M-100 Panorama.   What do you suggest to check, adjust, reboot, restart,etc ?   I remain attentive   Thank you, best regards ... View more