About JiaXiang

JiaXiang · ‎05-03-2022

We have implemented Saasyan Assure to provide pastoral care controls and reports for our Palo firewall. Since upgrading to 10.1.5 (and h1 and h2) we're getting the below (or similar) message when we're trying to create a new security rule via API. {"status": "error", "result": "<response status=\"error\" code=\"13\"><msg><line>set failed, may need to override template object first</line></msg></response>", "xpath": "/config/devices/entry[@name='xxx.xxx']/vsys/entry[@name='xxxx']/rulebase/security/rules/entry[@name='ASSURE-XXXXXXX']", "uri": " https://X.X.X.X/api", "status_code": 200} Sometimes it causes the box to crash. Saasyan tells us this has happened to other schools running the same version of PanOS and HA like us. They have tested on their Palo without issue but they don’t run HA. It has now happened to both devices.

JiaXiang · ‎05-02-2022

After raise to PANW TAC checking and the issue is actually ISP BGP routing issue. PANW TAC perform a packet capture and notice there is no drop packet in firewall then PANW TAC confirm that the issue is from ISP. Due to ISP BGP route the traffic to some ip that is not firewall resolve to. After ISP fix the routing issue then the issue is resolve.

JiaXiang · ‎05-02-2022

I have raise it to PANW TAC to check. It is the a issue about masterkey and no other selection only can factory reset. After factory reset the firewall and link back to Panorama then the issue is resolve.

JiaXiang · ‎03-28-2022

With the same configuration showing above suddenly the firewall is work as load balance.

JiaXiang · ‎03-21-2022

User who is using Global protect or I try to test using mobile network to perform Windows update is fine. I think the problem is not in Windows firewall.

JiaXiang · ‎03-20-2022

Hi Kiwi, In the security policy I have allow above FQDN any service and any application but the log result is showing aged-out. When using outlook in office the outlook will have (!) mark.

JiaXiang · ‎03-13-2022

I have migrate 4 firewalls from old panorama VM to new panorama VM and notice the preshared key for IPSEC is missing. My customer have lost their all IPSEC VPN preshared key is there any method I can migrate the firewall to new Panorama I can migrate with the Panorama. We are following below guide to migrate the panorama https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/transition-to-a-different-panorama-model/migrate-a-panorama-virtual-appliance-to-a-different-hypervisor

JiaXiang · ‎03-11-2022

I have follow below link to allow these URL in my security policy but today I perform Windows update still very slow and from the log I still able to see some aged-out in my log for update. Any configuration change can help me to solve this issue ? https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus URL http://windowsupdate.microsoft.com http://*.windowsupdate.microsoft.com https://*.windowsupdate.microsoft.com http://*.update.microsoft.com https://*.update.microsoft.com http://*.windowsupdate.com http://download.windowsupdate.com https://download.microsoft.com http://*.download.windowsupdate.com http://wustat.windows.com http://ntservicepack.microsoft.com http://go.microsoft.com http://dl.delivery.mp.microsoft.com https://dl.delivery.mp.microsoft.com officeapps.live.com/ cd.office.net/ office.com/ officecdn.microsoft.com/ officecdn.microsoft.com.edgesuite.net/ microsoft.com/ *data.microsoft.com/ *.delivery.mp.microsoft.com/ *.metaservices.microsoft.com/

JiaXiang · ‎03-11-2022

I have a HA Firewall Active/Passive. Due to certificate is already expired I have exactly follow below guide to create my Self Sign ECDSA Certificate and apply it to my Passive firewall. The issue is when the passive firewall is in HA mode that time I`m unable to access to the management interface. When I make it as standalone mode that time there is no such issue. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boSoCAI The error message is This site can’t provide a secure connection x.x.x.x uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

JiaXiang · ‎03-02-2022

I have asked PANW TAC about this and the explain are the total I have set is 1000Mbps for Class 1 to 3 i have reserve a Guaranteed Egress traffic (20%+20%+20%) total = 600Mbps. 1000- 600= 400Mbps so for the remaining interface doesn't have setting one will use the 400Mbps.

JiaXiang · ‎02-20-2022

I also encounter issue on 5.2.10. All users that installed 5.2.10 having the issue to connect to LAN network will show unauthenticated and cannot access to network. For user who is still using old version still able to access as normal.

JiaXiang · ‎02-16-2022

Thanks Astardzhiev, below is my QoS setting . Do you know where is the 400Mbps come from or where to check it?

JiaXiang · ‎02-16-2022

Suddenly the traffic follow the round robin sequence flow. The issue is solve thank you.

JiaXiang · ‎02-10-2022

I do not have QoS configuration but from report showing some QoS setting. Anyone know why this will happen?

JiaXiang · ‎02-10-2022

The web server is in production so user just access it from browser but the traffic did not follow the round robin. If it follow round robin will cause asymmetric route ?

Member Since	‎09-28-2021 06:26 PM
Date Last Visited	‎04-23-2024 09:25 PM
Posts	121
Total Likes Received	5

Online Status	Offline
Date Last Visited	‎04-23-2024 09:25 PM

About JiaXiang

Re: PSE is still available for Palo Alto Networks ?

Re: Panopto Still Available ?

Re: Panopto Still Available ?

Panopto Still Available ?

PSE is still available for Palo Alto Networks ?

CVE-2023-38802 Dynamic Update Signature

Re: Impact after Changing the key size setting clears the current certificate cache.

Re: Impact after Changing the key size setting clears the current certificate cache.

Impact after Changing the key size setting clears the current certificate cache.

Do we need Admin right to downgrade Global Protect Client ?

Microsoft updates getting blocked by Firewall

When is PAN-OS 10.2.5 release

Re: QoS Configuration Subnet /32

Re: Microsoft updates getting blocked by Firewall

Destination NAT Round Robin for Load Balance Traffic for Web Server

Re: Impact after Changing the key size setting clears the current certificate cache.

Re: Impact after Changing the key size setting clears the current certificate cache.

Re: Palo Alto CSP Down

Re: Microsoft Exchange zero-day 2022

Re: Microsoft Exchange zero-day 2022

Integrate with Saasyan Assure

Re: Microsoft updates getting blocked by Firewall

Re: Migrate firewall to New Panorama and IPSEC VPN Preshared key is not migrating over with the config

Re: Destination NAT Round Robin for Load Balance Traffic for Web Server

Re: Microsoft updates getting blocked by Firewall

Re: Microsoft updates getting blocked by Firewall

Migrate firewall to New Panorama and IPSEC VPN Preshared key is not migrating over with the config

Microsoft updates getting blocked by Firewall

After Apply SELF-SIGNED ECDSA CERTIFICATE IN SSL/TLS PROFILE Cannot Access to Management Interface

Re: No QoS setting but from report show QoS setting

Re: global protect connectivity issue (version 5.2.10)

Re: No QoS setting but from report show QoS setting

Re: Destination NAT Round Robin for Load Balance Traffic for Web Server

No QoS setting but from report show QoS setting

Re: Destination NAT Round Robin for Load Balance Traffic for Web Server

Unlock your full community experience!

About JiaXiang