About SOC_CSG

This is our config in the palo alto.          DNS services PA-2050-10.84.96.115 PA-01(active)  Primary DNS Server 146.219.39.201 Secondary DNS Server 146.219.39.202 PA-2050-10.84.96.116 PA-02(passive) Primary DNS Server 192.168.1.1 Secondary DNS Server 194.179.1.121 So i can see in the logs in FW1 (active), that there is a connection from management interface FW2 (10.84.96.116) to destination its DNS secondary 194.179.1.121........why does FW2 do this connection?? I attach the logs in FW1 A tool in the DNS server is detecting these request like a attack.... … ... View more

Hello rgreens I also have this problem, DNS queries: msreg.gale.com lb-1.ezakus.net track.yeshj.com api28.thetrafficstat.net pix.trafficjoint.com file.soft365.com ... .. How to fix it? Thank you, Diego ... View more

Hi Some OID you requested are these: DataPlane 1.3.6.1.2.1.25.3.3.1.2.2 Management 1.3.6.1.2.1.25.3.3.1.2.1 SessionActive 1.3.6.1.4.1.25461.2.1.2.3.3 SessionActiveTcp 1.3.6.1.4.1.25461.2.1.2.3.4 SessionActiveUdp 1.3.6.1.4.1.25461.2.1.2.3.5 INTERFACES (BUT you need to add .NUMBER at the end for the different instances/interfaces for example MGMT .1 for Ha1 .2 for eth1/ .3 ifDescr 1.3.6.1.2.1.2.2.1.2 DESCRIPTION ifOperStatus 1.3.6.1.2.1.2.2.1.8 Status ifSpeed 1.3.6.1.2.1.2.2.1.5 Speed ifInBroadcastPkts 1.3.6.1.2.1.31.1.1.1.3 Broadcast packets IN ifInDiscards 1.3.6.1.2.1.2.2.1.13 Discard Paquets IN ifInErrors 1.3.6.1.2.1.2.2.1.14 Errors IN ifInMulticastPkts 1.3.6.1.2.1.31.1.1.1.2 Multicast packets in ifInNUcastPkts 1.3.6.1.2.1.2.2.1.12 Non-unicast packets IN ifInOctets 1.3.6.1.2.1.2.2.1.10 Octects packets in ifInUcastPkts 1.3.6.1.2.1.2.2.1.11 Unicast packets in ifOutBroadcastPkts 1.3.6.1.2.1.31.1.1.1.5 Broadcast packets OUT ifOutDiscards 1.3.6.1.2.1.2.2.1.19 Discard OUT ifOutErrors 1.3.6.1.2.1.2.2.1.20 error OUT ifOutMulticastPkts 1.3.6.1.2.1.31.1.1.1.4 Multicast Out ifOutNUcastPkts 1.3.6.1.2.1.2.2.1.18 Non-unicast out ifOutOctets 1.3.6.1.2.1.2.2.1.16 Octect Out ifOutUcastPkts 1.3.6.1.2.1.2.2.1.17 Unicast Packets OUT Hope it help you ... View more

Hi I have restarted the management-server but doesn't solve nothing. The output of the commands requested are these: telindus@fw1orgt(active)> show system resources | match srvr 7438       20   0  386m 220m 5896 S    2 22.7   3:23.14 mgmtsrvr 2450       20   0 234m  46m 7968 S    0  4.7 118:59.52 devsrvr telindus@fw1orgt(active)> show system resources | match total Tasks: 102 total,   2 running, 100 sleeping,   0 stopped,   0 zombie Mem:    995872k total,   942036k used,    53836k free,    22880k buffers Swap:  2212876k total,   311428k used,  1901448k free,   205648k cached telindus@fw1orgt(active)> show system disk-space Filesystem Size  Used Avail Use% Mounted on /dev/sda2 3.8G  1.4G  2.2G  39% / /dev/sda5 7.6G  4.1G  3.2G  57% /opt/pancfg /dev/sda6 3.8G  2.6G  1.1G  71% /opt/panrepo tmpfs 487M 67M  420M  14% /dev/shm /dev/sda8 125G   73G   46G  62% /opt/panlogs Thanks in advanced ... View more

Hi Jo The rule is my deny-all rule and I want to create another rule before it disabling the logging only for these attacking Ips. Gonzalo ... View more

Thanks everybody for the answer. I manage to export the log with cli (thanks to sraghunandan :smileygrin:) maybe later i will upgrade to 5.0 and try again with GUI. Best regards ... View more