About SOC_CSG

i  got installed the last content version deleting all the content and refreshing and installing the last one. Now the problem is different. I prefer try other things before talking to my customer in order to reinstall the software and restart the device. ... View more

I deleted all the content apps and threats, i checked, and i installed the last content and it worked but the problem now is that i cant find the threat in my vulnerability profile. i try to look for 36729 or bash and i cant find anything....im following these steps Click the checkbox next to signature #36729 to enable an exception: Click on the item listed under the "Action column to modify the action of this signature, and configure with the desired blocking action. ... View more

telindus@fw1orgt(active)> tail mp-log paninstaller_content.log Mon Sep 29 16:23:31 CEST 2014 *********************************************** ******** old dir copy end time *********************** ******** copy end time *********************** Mon Sep 29 16:27:07 CEST 2014 *********************************************** removing panupv2-all-contents-456-2370 ******** extract start time *********************** /opt/pancfg/mgmt/content-images/panupv2-all-contents-458-2380.tgz Mon Sep 29 17:07:19 CEST 2014 *********************************************** ... View more

telindus@fw1orgt(active)> show jobs id 4595 Enqueued                     ID             Type    Status Result Completed -------------------------------------------------------------------------- 2014/09/29 15:56:47        4595          Install       FIN   FAIL 15:57:04 Warnings: Details:content update failed with the following messages: Image File Authentication Error Failed to extract rpm file  /opt/pancfg/mgmt/content-images/tmp/panupv2-all-cont ents-458-2380.tgz ... View more

Its my client´s network i only give support to FW Palo Alto, i dont know exactly what is behing PA in the client side. I am guided by Palo Alto config. I suppose its something like this. OSPF speaking between L3 devices. i suppose in this case R1 and R2 should speaking OSPF to reach IP 10.98.200.16 to the MGMT interface. ... View more

Yes. In the LAN eth1/22.250 is configured OSPF and the FW s sending the traffic to 10.98.200.16 throguh this interface by OSPF. I think OSPF routers should know how to arrive to the management ip (10.98.200.16), because 10.98.200.0/24 is running over OSPF. what do you recomend me to do?? ... View more

Yes, but if it was a routing problem the management ip would not respond to ping. I can ping the management inteface and do a trcert succesfull. ... View more

Yes, the ip 172.16.33.132 is allowed. Ill do this debug tomorrow. Please confirm this config (filter), it could crash using this short filter???? debug dataplane packet-diag set filter on debug dataplane packet-diag set filter match source 172.16.33.132 destination 10.98.200.16 debug dataplane packet-diag set log feature flow basic debug dataplane packet-diag set log on ... View more

If i use like filter 172.16.33.132 i cant see anything. I dont know what PA is doing with the traffic.... If, for example, i use like filter 10.98.200.16, i see several connections.... ... View more

hi, i did several captures. If i try to open ssh to the management IP, i only can see the SYN, not SYN/ACK is generated. If i try to open ssh to the LAN IP, i oan see how SYN,SYN/ACK, and ACK are generated. ... View more

but the network 172.16.33.132 is reached through the tunnel. i think you mean destination 10.98.200.16 (management ip), but i think i will happen the same. Now its working like if i create the route that you want. admin@GOLIAT1(active)> test routing fib-lookup ip 10.98.200.16 virtual-router VR1 -------------------------------------------------------------------------------- runtime route lookup -------------------------------------------------------------------------------- virtual-router:   VR1 destination:      10.98.200.16 result:           interface ethernet1/22.250 ... View more

Yes, its sending the trafiic to the interface1/22.250 and it should do it admin@GOLIAT1(active)> test routing fib-lookup ip 10.98.200.16 virtual-router VR1 because the oowner of this ip is the PA. It shouldnt know the PA that it has this ip and not routing. -------------------------------------------------------------------------------- runtime route lookup -------------------------------------------------------------------------------- virtual-router:   VR1 destination:      10.98.200.16 result:           interface ethernet1/22.250 -------------------------------------------------------------------------------- admin@GOLIAT1(active)> show routing route destination 10.98.200.0/24 virtual-router VR1 flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,        Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2 VIRTUAL ROUTER: VR1 (id 2)   ========== destination                                 nexthop                                 metric flags      age   interface          next-AS 10.98.200.0/24                              10.105.0.11                             20     A O2       1176268 ethernet1/22.250 total routes shown: 1 ... View more

I attached the service route config. I thought that to access by SSH you only needed to permit SSH in the Management interface. ... View more

Hi, this is the result. Any idea??? admin@GOLIAT1(active)> show session id 34480892 Session        34480892         c2s flow:                 source:      172.16.33.132 [VPN]                 dst:         10.98.200.16                 proto:       6                 sport:       52478           dport:      22                 state:       INIT            type:       FLOW                 src user:    unknown                 dst user:    unknown                 qos node:    ethernet1/22.250, qos member N/A Qid 0         s2c flow:                 source:      10.98.200.16 [TRANSITO]                 dst:         172.16.33.132                 proto:       6                 sport:       22              dport:      52478                 state:       INIT            type:       FLOW                 src user:    unknown                 dst user:    unknown                 qos node:    tunnel.1, qos member N/A Qid 0         DP                            : 1         index(local):                 : 182575         start time                    : Tue Sep 16 18:05:01 2014         timeout                       : 5 sec         total byte count(c2s)         : 156         total byte count(s2c)         : 0         layer7 packet count(c2s)      : 2         layer7 packet count(s2c)      : 0         vsys                          : vsys1         application                   : incomplete         rule                          : Trafico VPN         session to be logged at end   : True         session in session ager       : False         session synced from HA peer   : False         layer7 processing             : enabled         URL filtering enabled         : False         session via syn-cookies       : False         session terminated on host    : False         session traverses tunnel      : True         captive portal session        : False         ingress interface             : tunnel.1         egress interface              : ethernet1/22.250         session QoS rule              : Capar-Jesus (class 4)         tracker stage firewall        : Aged out ... View more