About Adrian_Jensen

 That error means that the browser can not resolve an IP address for the name given... so the DNS is not working. If you do a nslookup for the name on a command line, what do you get? I am guess it is a "Non-existant domain" error. Does this extend to other internet names as well?   It sounds like you have DNS filtering in place somewhere that is blocking/filtering DNS responses (you can sinkhole DNS on the PaloAlto, but normally that returns an IP that directs to a blocked page or gets dropped, not return a not-resolved DNS error). ... View more

I have seen 2 issues that match the description. I have seen the URL database seeming reset and have to re-initialize, which may take several minutes. There is a known issue specifically with Google search URLs (including play.google.com/) and URL filtering. Apparently a change was made that overwhelmed the URL cloud database. PaloAlto put in a workaround but it seems that sometimes that workaround misses or they are pushing updates which temporarily cause not-resolved again. Have seen the issue intermittently for months. ... View more

@suba_muthuram    It is a PaloAlto-style regular expression (regex) for filtering output from the "match" command on the CLI. Specifically, the CLI "show running security-policy" command will show all the Security Policies on the PaloAlto. The output of that is piped the to "match" command with the regex filter "{\|destination{\|10.3.83.13". This will match any line on the show command output that matches "{" or "destination{" or "10.3.83.13".   The pipe "|" is the also the OR operator in the regex, so it must be escaped with a "\|" to be interpreted as an OR in the CLI, instead of being a pipe to another command. The filter is also a bit weird as the "{" is half of another regex "{nn}" which will match nn number of characters... but apparently since the opening "{" bracket is not immediately followed by a number and closing "}" bracket, I guess it doesn't get interpreted as a regex. Note that I also think the "destination{" is wrong in this example as it would match "destination" explicitly followed by a "{" which doesn't exist in the show command output. (Perhaps it did in an earlier version of PANOS? This thread is 10 years old at this point.)   Because the "show" command outputs the Security Policies as multiple lines for the same policy and "match" only matches single lines, the given filter is kind of a hack to find all policies which might match the terms. It doesn't show just the policy with all the matching terms. So if you run a "show running security-policy" command you get an output with the entire policy set: admin@PA(active)> show running security-policy "Allow Trust to DMZ; index: 1" { from Trust; source [ 10.10.0.0/24 192.168.0.0/24]; to DMZ; destination 192.0.2.0/24; application/service 0:any/any/any/any; action allow; } "Allow DMZ to Trust; index: 2" { from DMZ; source 192.0.2.0/24; to Trust; destination 10.10.0.0/24; application/service 0:any/any/any/any; action allow; } "Allow Internet to MailServer; index: 3" { from External; source any; to Trust; destination 192.168.0.25; application/service 0:any/any/any/any; action allow; } "Allow Trust to Internet; index: 4" { from Trust; source [ 10.10.0.0/24 192.168.0.0/24 ]; to External; destination any; application/service 0:any/any/any/any; action allow; }   If you wanted to find all Security Policies that might contain an internal destination or 192.168. address you could do a command like this: admin@PA(active)> show running security-policy | match {\|destination\|192.168.0 "Allow Trust to DMZ; index: 1" { source [ 10.10.0.0/24 192.168.0.0/24]; destination 192.0.2.0/24; "Allow DMZ to Trust; index: 2" { destination 10.10.0.0/24; "Allow Internet to MailServer; index: 3" { destination 192.168.0.25; "Allow Trust to Internet; index: 4" { source [ 10.10.0.0/24 192.168.0.0/24 ]; destination any;   The above is a poor example for the above stated reasons. Going back to @Wbm's reply, I would guess it should have been more like this searching for a specific address in the Security Polices: admin@PA(active)> show running security-policy | match {\|192.168.0.25 "Allow Trust to DMZ; index: 1" { "Allow DMZ to Trust; index: 2" { "Allow Internet to MailServer; index: 3" { destination 192.168.0.25; "Allow Trust to Internet; index: 4" {   ... View more

 I am not getting any of those OIDs with a PA-3420 running 10.2 either. In fact i don't get anything in the 1.3.6.1.4.1.25461.2.1.3 tree, either on my PA or with in the compiled MIB files. Importing all 7 MIBs, 1.3.6.1.4.1.25461.2.1.x should be panCommonMIB.x. However, when I look at the PAN-COMMON-MIB file, it defines as being under 1.3.6.1.4.1.25461.1.1.x   From the PAN-ENTITY-EXT-MIB, the fan and power supply status seem to be under 1.3.6.1.4.1.25461.1.1.7.1.x, but that doesn't exist for me. Looking at the PA docs for the MIBs it says:   Use PAN-ENTITY-EXT-MIB.my in tandem with the ENTITY-MIB to monitor power usage for the physical components of a PA-7000 Series or PA-5450 firewall (for example, fan trays, and power supplies), which are the only two Palo Alto Networks firewalls that support this MIB.   https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/snmp-monitoring-and-traps/supported-mibs/pan-entity-ext-mibmy   So it looks like fan/power monitoring doesn't exist unless it is a 5450 or 7000 PA? ... View more

You are most likely going to want to add a Security Policy to allow only known inbound connections to the GP interface and block all others (how you do this will depend greatly on how accessible you want your GP to be... i.e. only connections from a few known home users?, or all users in your country?, or from around the world?). Unfortunately, I don't know of any way to have the PA auto-block sources which repeatedly fail to authenticate (would be nice if you could build selft-updating dynamic address lists).   First, you may want to create an initial Security Policy with a blacklist of addresses that should never connect for any reason. These can be addresses that are constantly scanning you, known region address groups, PaloAlto-provided dynamic lists, and/or external dynamic lists (EDLs): Name = Blackhole_Source SrcZone = Untrust SrcAddr = "Kenny_is_not_allowed - 192.0.2.123",                  RU,                  "Palo Alto Networks - Known malicious IP address",                  "Firehole EDL - bad IP list" DstZone = Untrust DstAddr = external_GP_address Action = Drop   Then, depending on your GP user base, you may want to further allow only from certain address ranges, either IPs you know or IPs in a certain region. Depending on how your have your Security Policies setup**, this could be an allow rule for traffic meeting certain criteria (with further allow rules for other services) and a final Security Policy rule that drops all non-matching traffic (i.e. a permission-based ruleset), or you could block traffic that meets certain patterns outright (i.e. a rejection-based ruleset). The following is a permissive ruleset, but could be rejection-based by using only the first rule and negating the source address/dropping traffic. Name = Allow US GlobalProtect connections SrcZone = Untrust SrcAddr = US DstZone = Untrust DstAddr = external_GP_address Application = panos-global-protect,                       ipsec-esp-udp Action = Allow ... Name = Drop all other traffic SrcZone = any SrcAddr = any DstZone = any DstAddr = any Action = Drop   ** Pay special attention to your existing Security Policies to know what type/where your current policies filter and how new rules would affect that. If you haven't already you will want to turn on logging for all your security rules (including the default "intrazone-default" and "interzone-default") so you know which connections are currently going through which policies (log on session end is typically enough to determine). ... View more

The OP and you have not provided a lot of debugging information, so its a bit difficult to guess, but there are a couple important caveats to check for: The management interface IP should never exist on the same subnet as a regular interface on the PA. Edit: Actually.. I think I was thinking about the HA interface IP here... management IP might be OK, would have to re-read documentation. If you have previous made service route configuration changes, look to see if a management destination route has been added (Setup->Services->Service Route Configuration->Destination), you may be forcing traffic to certain destination out other interfaces. If a separate device is to contact the management interface, verify that the source is allowed as a permitted address if an ACL has been added (Setup->Interfaces->Management). ... View more

PAN-OS 9.1.17 OS fixed the PAN-189182 Change Summary issue (which is described as a Panorama appliance problem but occurred on a non-Panorama PA firewall). 9.1.17 has not fixed the Global Find issue for me. ... View more

We use the following custom URL category for selectively allowing/blocking Facebook: fb.com/ *.fb.com/ facebook.com/ *.facebook.com/ facebook.net/ *.facebook.net/ fbcdn.net/ *.fbcdn.net/   Either as a category in URL filtering, or as a modifier for specific destinations in a Security Policy. You can usually do overall blocking without SSL decryption (with just the SNI), but doing all SSL decryption leads to far better pattern matching. ... View more

PaloAlto does provide an EDL service for some SAAS services, including M365/Azure. Its automatically updated daily, though it doesn't give you quite the same granularity you get from manually building the lists. Unfortunately, there is no way to pull EDLs into GP client configs yet, but works on the firewall. You can find the available options here:   https://docs.paloaltonetworks.com/resources/edl-hosting-service ... View more

15min or so it was not working for a couple minutes, but has already resolved itself.   I have seen this multiple times over the last few weeks as it will temporarily not resolve for a minute and then work normally again. It looks like PA still has the temporary patch in. Not sure if they are testing patch removal or the patch fails momentarily from time to time. ... View more

Yes, I saw this a bit earlier today. This morning it was still showing up as "not-resolved" in the local cache:   adrian.admin@PA-HA(active)> test url www.google.com/search www.google.com/search not-resolved (Base db)expires in 5 seconds www.google.com/search search-engines low-risk (Cloud db) adrian.admin@PA-HA(active)> test url-info-host www.google.com/search www.google.com/search: Doesn't exist in the URL DB adrian.admin@PA-HA(active)> test url-info-cloud www.google.com/search BM: google.com/search,9,5,search-engines,low-risk google.com/search?q=community+first+foundation+site:coloradogivesfoundation.org%26rlz=1c1gceb%5fenus848us848%26sa=x%26ve d=2ahukewid0j394j3%5fahxredqihtntcluqran6bagteae%26cshid=1685474396026528,9,5,society,low-risk     Then this afternoon it started showing up as matching the cloud category but doesn't actually exist in the local DB (though it somehow shows as cached with an expiration date in an overall query...). Seems like they pushed something that always cancels local caching for the google.com URLs.   adrian.admin@PA-HA(active)> test url www.google.com/search www.google.com/search search-engines low-risk (Base db)expires in 1650 seconds www.google.com/search search-engines low-risk (Cloud db) adrian.admin@PA-HA(active)> test url-info-host www.google.com/search www.google.com/search: Doesn't exist in the URL DB adrian.admin@PA-HA(active)> test url-info-cloud www.google.com/search BM: google.com/search,9,5,search-engines,low-risk google.com/search?q=community+first+foundation+site:coloradogivesfoundation.org%26rlz=1c1gceb%5fenus848us848%26sa=x%26ved=2ahukewid0j394j3%5fahxredqihtntcluqran6bagteae%26cshid=1685474396026528,9,5,society,low-risk     We have undone our temporary fix and so far not seen any issues. ... View more

Yeah, I was going to possibly add www.google.com/ to my custom URL category allow filter for the time being. In discussions with our Infosec department. Don't want to leave it that way for long, but it is a simple bypass in the mean time. ... View more