About Phoenix

Phoenix · ‎12-11-2013

Hello bsanders, Have you also verified that the Gateway configuration for GP also has the change made for the certificate if you are using same server certificate for portal and gateway. Thanks

Phoenix · ‎12-11-2013

Hello eugenep, We can create custom applications based on what file type you are looking for. The details about creating custom apps by analyzing a pattern is shared in the below document. Custom Application Signatures Thanks

Phoenix · ‎12-09-2013

Hello Natt, Here is a image of how we can do. We can use the filters by clicking the + in the image and custom based on the needs.

Phoenix · ‎12-09-2013

Hello Sascha, Refer the doc, GlobalProtect Configuration Tech Note Look for "Host Information Objects and Profiles" section in the above doc which explains the details and information about configuration as needed to block users based on identifying the user pc OS name and details. Note: This feature needs Portal and Gateway license. Thanks

Phoenix · ‎12-04-2013

Hello Roh, I go with Vince too. Pan would allow more than one IP with the same User_ID. This is practical that a single user can login through Phone / laptop / pc and so on. But on the PAN if we have security rules configured with usernames then all the IPs belonging to that username would be permitted. Thought of using the HIP profile feature but where we can restrict or allow users based on hostname or OS types and so on but that would be complex where we do not know which device first logged in and deny the second log on by identifying through HIP method. Thanks

Phoenix · ‎12-03-2013

Hello Vikas, If traffic is flowing for certain security rule then that would be marked as "used rule". If there is no more traffic matching a rule and right now it is showing "unused rule" then it would stay the same until new traffic matches the rule. Also by changing the name of the rule to a new name and if there is no traffic passing or hitting that rule it would still be unused. Unused counters would clear if the DP is restarted. If this is to be done this can be seen at Device Tab > setup > Operations > Restart Dataplane. Thanks

Phoenix · ‎12-03-2013

Hello peterpan13888 We have email means of notification configurable based on the severity of the system logs. So lets say if the "Vpn tunnel down" is of severity HIGH you can set on the PAN for all HIGH to be emailed. But we do not have a custom mechanism to send a email only for certain logs like vpn was down in this case. Thanks

Phoenix · ‎12-02-2013

Hello jeffthpinc I see you have tried to troubleshoot in the right direction, I have something more. 1> First identify if it is Url block page or app block page and so on to see if its URL engine blocking or App engine. 2> Once narrowed down as URL, we can go ahead and see what rule or category it is indicating as done by you. Now even after it is blocking when put in allow list, this explains there is some other category or so which is blocking it. When we see URL logs and a block action for download, what do we see when we click on the magnified icon on that log line ? What is the rule, category ? Have we verified if this rule has the URL profile with Allow list ? 3> Is there any threat logs for this action, just to verify if the PAN does not detect this as threat and block it. Thanks

Phoenix · ‎11-29-2013

Hello Cheon, The counter "ip ttl reaches zero" indicates that the packet reaching the device has value ttl 0. This indicating that the packet sent has low ttl value. OR there is a routing loop where they ttl is reducing as it is looping. If we can take packet capture on the device one hop before PAN and look at capture details for header information we should be seeing what ttl value is set on the packet before reaching the firewall. Thanks

Phoenix · ‎11-28-2013

Hello Cheon, Is ping enabled for the interface through interface management profile. Traceroute uses icmp to calculate the hops. Thanks

Phoenix · ‎11-28-2013

Hello pleroux, I have created a custom report per your requirement and it should work perfect for you. In the below I have selected the group by for the source address you can select the source username to see that as first column in the second report. I have selected the URL link, counts of visit to the site for each user. Make sure the search parameter is given as youtube as that is what we are looking for ! Hope this helps !.

Phoenix · ‎11-27-2013

Hello Jakub, Yes we will have to use PBF to have auto failover if the primary link is failed. In PBF rule we set the primary link ( in your case it is MPLS path ). PBF rules are given priority over default routes and security rules. If the PBF fails then it would take the default static route to the tunnel for backup path. Below are some doc suggestions to understand and customize your implementation. How to Setup a Palo Alto Networks Firewall with Dual ISPs and Automatic VPN Failover Dual ISP Branch Office Configuration Thanks

Phoenix · ‎11-26-2013

Hello Pcook, Did the CLI command help in getting the HA(High availability ) pair to be in Sync. If not at this point a support case is the option. The reason is an analysis can be obtained by running the logs at debug level for ms.log and also find what is happening in the "ha-agent.log" ( This log has all the details about HA operation on Management Plane ), "pan_dha.log" ( HA logs on Data plane ) and verify if any known issues are there for your software version and so on. Thanks

Phoenix · ‎11-26-2013

Hello namok77 I understand from the issue that if the first ldap server fails it is not trying to authenticate through the second ldap server. By design authentication has 30 sec timeout. In the below Ldap server authentication profile set the "Bind Time limit" probably 3 or 5 secs and try to authenticate, so if first one fails after 5 secs it should try the second ldap server and since it is less than 30 secs it should succeed. Hope this helps ! Thanks

Phoenix · ‎11-26-2013

Hello Pcook, Here is the command to try form the CLI, > request high-availability sync-to-remote running-config Also in the ms.log we will see details what is happening with error details and logs indicating the fail for the HA-sync Run the below command first " tail follow yes mp-log ms.log" and then try to do HA Sync to see the logs dynamically. This would give some explanation. May also have to look at any other pending job is running on the peer device show jobs pending Hope this would give a path. Thanks

Member Since	‎10-04-2011 12:48 PM
Date Last Visited	‎02-04-2021 12:13 PM
Posts	327
Total Likes Received	105

Online Status	Offline
Date Last Visited	‎02-04-2021 12:13 PM

About Phoenix

Introducing the BPA Quarterly Reminder

Re: How to open exported logs?

Re: Cleaning security policies

Re: Per IP Traffic shaping

Re: Group mapping with open Ldap in PAN-OS 6.0.1

Re: www server in DMZ - what aplication should me allowed?

Re: How to deal with certificat issues in production envirement

Re: How to enable safe search in youtube?

Re: Implementing QoS

Re: HTTP DDoS attack block signature

Re: Can FW do QoS for override application?

Re: full url address

Re: Dropped traffic - no log

Re: Search for hosts/IPs across entire PA environment

Re: Search for hosts/IPs across entire PA environment

Re: Show Hard Drive information

Re: Rest API and import

Re: logged in admin count Panorama

Re: Cannot set new certificate to portal

Re: Can I create a custom file type?

Re: Custom search in ACC

Re: Deny internet access by OS

Re: Can we possible to restrict another user log-in to GP using same USER-ID at the same time?

Re: highlight unused rules highlights rules possibly used in the past

Re: Monitoring VPN tunnel by email

Re: Have a site being blocked I cannot seem to unblock

Re: what cli command to allow does 'ip ttl reaches zero' drop count ??

Re: what cli command to allow does 'ip ttl reaches zero' drop count ??

Re: Tracking Youtube activity

Re: IPSec tunnel as backup link of MPLS connection

Re: Troubleshooting HA Sync

Re: LDAP Server failover

Re: Troubleshooting HA Sync

Unlock your full community experience!

About Phoenix