About SOC_CSG

Hi, I have  configured a VPN between JUNIPER SSG550 and PA-3020 (5.0.5) but this VPN is not going up. Yesterday I was configuring this VPN almost 4 hours until finally vpn went up but i checked this morning the vpn state and its down again and nobody has changed the config ...weird.... I have checked the VPN config and i have created the VPN again and the VPN is not going up now ====> Initiated SA: 126.51.38.50[500]-85.111.55.10[500] cookie:39e59d4fd22fc29a:0000000000000000 <==== 2014-03-07 12:40:33 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION FAILED AS INITIATOR, MAIN MODE <==== ====> Failed SA: 126.51.38.50[500]-85.111.55.10[500] cookie:39e59d4fd22fc29a:0000000000000000 <==== Due to timeout. 2014-03-07 12:40:33 [INFO]: ====> PHASE-1 SA DELETED <==== ====> Deleted SA: 126.57.38.50[500]-85.111.55.10[500] cookie:39e59d4fd22fc29a:0000000000000000 <==== 2014-03-07 12:40:36 [INFO]: IPsec-SA request for 85.238.28.10 queued since no phase1 found 2014-03-07 12:40:36 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS INITIATOR, MAIN MODE <==== ====> Initiated SA: 126.57.38.50[500]-85.111.55.10[500] cookie:2fa8ed99f184af97:0000000000000000 <==== 2014-03-07 12:41:28 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION FAILED AS INITIATOR, MAIN MODE <==== ====> Failed SA: 126.57.38.50[500]-85.111.55.10[500] cookie:2fa8ed99f184af97:0000000000000000 <==== Due to timeout. 2014-03-07 12:41:28 [INFO]: ====> PHASE-1 SA DELETED <==== I have similiar VPN configured between this juniper and PA and its working with the same config....... it seems like phase1 is up but i cant see the green light in NETWORK-IPSEC TUNNELS Any advice????? ... View more

I didn't find many about this domain "msreg.gale.com", Could someone help me to determine whether or not a false positvo?? In the link below say it is not malware. It's Word 2007 - "Connecting To" Pop-ups http://social.technet.microsoft.com/Forums/office/en-US/81a9d0a3-667c-4637-8d4d-1957120ec015/word-2007-connecting-to-popups?forum=word Thanks, dicu ... View more

How to avoid this threat: PHP Webshell Access (36180). From Zone Trust, Zone to Untrust. Thank you, ... View more

Hello I have a rule that permit traffic from "untrust" to some servers in "DMZ" but only for applicacions FTP, SSL and web-browsing, the problem is someone has gained access through SSH using the tcp 22. Shouldn't the PaloAlto has block this kind of traffic? Anyone knows a solution for this problem or know how to block some ip address? Best regards Gonzalo Arroyo ... View more

Hi Since upgrading a PA-2050 to 5.0.8 I noticed that the management CPU is always above 70% and DataPlane is under 5%. Do this behaviour is normal? Management CPU sometimes goes to 99%. Best regards Gonzalo Arroyo ... View more

Hello everybody The problem I have is this. I have identifed about 70 attacking ips and I like to block completly the traffic from them (I already have and deny-rule in the bottom of my polices but this rule log the traffic). I like to create a rule to deny this traffic or a blacklist to include these ip address avoiding any kind of logging (syslog or SNMP trap) Could someone help? Best regards GonzaloArroyo ... View more

Hello I'm having a curious behaviour with Captive Portal and web navigation, this is the situation. Every computer IN Windows Domain doesn't have any problems, user can navigate without issues, but computer or other devices (tablets, smartphones, etc...) which not belongs to the domain, when open a web page they are prompted to log in, when they log on, the web page of "Internet Explorer couldn't shows the web" appears...but if they refresh the navigator...the web pages shows without problem and the can work fine. I've just checked the System Monitor and the last message is "'Captive Portal renew from session cookie for user: XX/XXX on 192.168.xx.xx, vsys1" Any body has this problem? Best regards Gonzalo ... View more