About kadak

kadak · ‎06-16-2014

Hello MMCiobanu, This could be due to the dataplane hitting the kernel NMI causing the control plane to exit with internal path monitoring failure. We need to determine the reason for the initial NMI failure which could be due to either a software caused memory corruption or due to a hardware problem. That calls for a support case to be opened so that the assigned TAC engineer can investigate the tech support files. Remember, the tech support files needs to be gathered along with crash files (if any) before rebooting the firewall. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎06-16-2014

Hello dvlacic, One thing to note is that, you need permission to access that community. If you don't have, you can certainly request account's sales engineer to provision it for you. Thanks and regards, Kunal Adak

kadak · ‎06-16-2014

Hello dvlacic, Your question about migrating from Checkpoint to PAN would be best answered at the following community : Firewall Migrations Also, the following document can also be referred; MT20-Checkpoint Source files Formats Supported in 2.1.1 Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎06-16-2014

Hello gmoss, Instead turning off the AV scan for the entire rule, you can put a threat exception for that Threat ID (2455553) in the relevant AV profile. Here is a document that explains the same: How to Add a Threat Exceptions Or you can also exempt the IP addresses for that threat, so that exception is applied to a particular set of source and destination IP addresses. This is more granular approach than the previous one: How To Add Exempt IP Addresses From the Threat Monitor Logs Hope that helps. Thanks and regards, Kunal Adak

kadak · ‎06-15-2014

Hello jwolach, Once the template is created and configuration is committed (to make sure that configuration is pushed to dataplane), you can execute the following command: # show shared reports 1.) Customer report created -- 'Kunal' Make sure that the configuration is committed. 2.) Through CLI: > set cli config-output-format set > configure # show shared reports set shared reports Kunal type thsum aggregate-by [ threatid category-of-app technology-of- app ] set shared reports Kunal type thsum values count set shared reports Kunal period last-24-hrs set shared reports Kunal topn 10 set shared reports Kunal topm 10 set shared reports Kunal caption Kunal 3.) You can copy-paste the above commands and use it on other firewalls. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎06-13-2014

Hello MMCiobanu, 5.0 Userid Agent will work with a 6.0 PANOS. Thanks and regards, Kunal Adak

kadak · ‎05-27-2014

Hello SilverTiger, How about using a Zabbix template where it pulls traffic flow in terms of Mbps/Kbps at interface level: Zabbix - Basic PA Host Template Will that work for you? Regards, Kunal Adak

kadak · ‎05-27-2014

Hello SilverTiger, You can use Cacti Templates to monitor PAN firewalls via SNMP for monitoring interface statistics with respect to concurrent sessions and utilization This should help you: Cacti - Templates Regards, Kunal Adak

kadak · ‎01-16-2014

Hello rgreens, msreg.gale.com domain is not a false positive. "Wildfire has detected a malware sample (ba491bb1eb3d62c5520883c8a24ac08f) which tried to resolve this domain "msreg.gale.com", which can not be resolved. So a malware sample tried to visit an un-resolvable domain and hence we marked this domain as malware" Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎01-08-2014

Hello bbsoc, For automatic global-protect logins, firstly we need to make sure that the connection method is Single-Sign-On (SSO). As far as the error 'Detected another instance (An old Global Protect instance exists, new instance cannot be started!)' is concerned, can we try to uninstall the entire GP package from MAC and re-install it? Here is a document that will help you in doing the same: How to Uninstall GlobalProtect Client Mac OS X FYI, there was an old known issue where the same error was seen while running GP client 1.1.4 on MAC. Although, it was fixed in 1.1.6 version. I am sure you would be using the latest version : GP-1.2.8 Let me know if that works! Thanks and regards, Kunal Adak

kadak · ‎01-08-2014

Hello Randy Greenspon, This is a false positive. The signature is now disabled and the fix will be available in AV-1186. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎01-06-2014

Hello Luke, Currently we do not have the functionality of filtering logs by address group objects. However, we do have a feature request (FR ID : 130) submitted for it and to be included in the future releases ,your our account's SE can vote for it. One other thing you can try is using subnet masks in filter. That can help encompass more IP addresses with less hassles. Hope that helps! Regards, Kunal Adak.

kadak · ‎01-03-2014

Hello Hartkently, You can get a brief idea about your logging rate and log forwarding rate by issuing the following command: > debug log-receiver statistics. As far as allocation of space and sizing is concerned, there are various factors to considered: network topology number of firewalls sending logs, type of traffic and subscriptions (URL etc..). I believe this document might just be what you are looking for: Panorama Logging Suggestions for PAN-OS 4.1 and 5.0 Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎12-24-2013

Hello ldavie, Currently we do not have the ability for a GP client to launch script after successful tunnel establishment. However I do a see a feature request (FR ID : 2572) submitted to our development team to be included in our future release. The feature request will include a logon script to include: 1.) Modifying routes on local client 2.) Letting the host setup mapped drives across the tunnel 3.) Re-executing logons so domain GPOs and other things can be accomplished. You can request your account's SE to vote for it. Hope that helps! Thanks and regards, Kunal Adak

kadak · ‎12-23-2013

Hello Suhaimi, Wildfire subscription enables hourly wildfire signature updates, Integrated logging (Monitor Tab-->Wildfire logs) and Wildfire API. Wildfire free edition (no license subscription) will still copy and forward files (PE) matching the file blocking profile policy to the Wildfire cloud and administrators can view reports of these submitted samples through the Wildfire web portal. Hope that helps! Thanks and regards, Kunal Adak

Member Since	‎11-07-2011 07:38 AM
Date Last Visited	‎03-08-2024 01:53 PM
Posts	259
Total Likes Received	129

Online Status	Offline
Date Last Visited	‎03-08-2024 01:53 PM

About kadak

Re: How Does the "Highlight Unused Rules" Option Work on Panorama?

Re: Remove access report

Re: Safe Search Enforcement

Re: Reports

Re: Safe Search Enforcement

Re: PA5020 and Proxy Server

Re: PA5020 and Proxy Server

Re: PA5020 and Proxy Server

Re: Wildfire Alert - Malicious status but benign detail

Re: PA5020 and Proxy Server

Re: NAT sessions

Re: Highest Risk User

Re: Panorama template push on production devices

Re: will an unlicensed Palo Alto pass traffic?

Re: Forwarding with ICAP

Re: HA broken after upgrading to 6.0.3

Re: Check Point R77 URL policy migration

Re: Check Point R77 URL policy migration

Re: PA500 says virus - virus total says no

Re: Export Custom Report Templates

Re: User-id-agent Upgrade to 6.0.3

Re: Can I see throughput through snmp? Let me know throughput OID Value

Re: Can I see throughput through snmp? Let me know throughput OID Value

Re: Legit Suspicious DNS Query?

Re: Is it possible to have Global Protect start on Windows and Mac automatically?

Re: Legit Suspicious DNS Query?

Re: Possible ?

Re: Size of Logs

Re: GlobalProtect and logon scripts

Re: WildFire license expiration

Unlock your full community experience!

About kadak