About darren_g

darren_g · ‎06-25-2014

#1 The dataplane load rarely if ever gets above about 17-20%. The *management* plane routinely runs at 60-70% with a known issue on the 2020's (one reason I'm looking to upgrade them). #2 No recent core dumps or crashinfo files exist Thanks for the suggestions, though. I'll log a case and see if PA TAC can find an answer

darren_g · ‎06-25-2014

The devices in question are on 5.0.12. I don't want to update them to the version 6 software because they're only 2020's, and I have concerns about their load if I do.

darren_g · ‎06-24-2014

Hi. I have a pair of 2020's (I know, don't comment - they're getting upgraded soon, I hope!) which run in active/passive HA pairing. This morning, I noticed the following entries in the logs on my primary (normally active) device 2014/06/25 08:58:37 info ras rasmgr- 0 RASMGR daemon sync all user info to HA peer exit. 2014/06/25 08:58:37 info vpn keymgr- 0 KEYMGR sync all IPSec SA to HA peer exit. 2014/06/25 08:58:37 info ras rasmgr- 0 RASMGR daemon sync all user info to HA peer started. 2014/06/25 08:58:37 info vpn keymgr- 0 KEYMGR sync all IPSec SA to HA peer started. 2014/06/25 08:58:37 info satd satd-ha 0 SATD daemon sync all gateway infos to HA peer started. 2014/06/25 08:58:37 info routing routed- 0 FIB HA sync started when peer device becomes passive. 2014/06/25 08:53:37 info ha connect 0 HA Group 1: HA1 connection up 2014/06/25 08:53:37 high ha ha3-lin 0 HA3 peer link down 2014/06/25 08:53:37 high ha ha2-lin 0 HA2-Backup peer link down 2014/06/25 08:53:37 info ha ha2-lin 0 HA2 peer link up 2014/06/25 08:53:37 high ha ha1-lin 0 HA1-Backup peer link down 2014/06/25 08:53:37 info ha ha1-lin 0 HA1 peer link up 2014/06/25 08:53:37 info ha connect 0 HA Group 1: Control link running on HA1 connection 2014/06/25 08:53:36 info satd satd-ha 0 SATD daemon sync all gateway infos to HA peer no longer needed. 2014/06/25 08:53:36 info vpn keymgr- 0 KEYMGR sync all IPSec SA to HA peer no longer needed. 2014/06/25 08:53:35 info ras rasmgr- 0 RASMGR daemon sync all user info to HA peer no longer needed. 2014/06/25 08:53:34 critical ha connect 0 HA Group 1: All HA1 connections down 2014/06/25 08:53:34 critical ha connect 0 HA Group 1: HA1 connection down (that's a backwards view - the oldest event is at the bottom). The standby (normally passive) device has similar entries. Trouble is, I 100% *know* the links didn't go down - there is nobody available to physically remove them (the devices are in a locked cabinet in another building which only two people are authorised to access, and both of them are sitting in the office right now), and both devices show uptimes which exceed 70 days Can anyone shed some light on what may have caused this? From memory, this isn't the first time I've noticed this, but on the last occasion I wrote it off as some environmental thing - maybe I should have chased it earlier. Any input appreciated. Thanks.

darren_g · ‎06-02-2014

rbergen wrote: 100% management CPU bug, etc. Yeah, and PA's answer to that one is 'upgrade your hardware' if you're unfortunate enough to run a 2000 series.

darren_g · ‎04-29-2014

nato wrote: this didn't help? if not, create a case after you're initial config and we can assist further How To Configure GlobalProtect SSO With Pre-Logon Access Using Self-Signed Certificates That wasn't the doc I found and was referring to - but it looks like the doc I need! Thanks!

darren_g · ‎04-28-2014

Folks. As the subject requests, is there an "idiots guide" to deploying certificate-based pre-login for Global Protect? My boss wants me to implement it so that pc's which are VPN-only connected can run domain scripts (machine policies) which only run on login - but you obviously don't connect to the domain until *after* you've logged in locally to the PC in the case of a VPN connected client - which means we need to have the PC connected to the VPN *before* login, so it can run scripts when the user actually logs in. I've looked through the docs a bit, but can;t get my head around a few things - mainly, how you create and deploy the certificates which the PC's use to verify/connect to the firewall before the user logs in and supplies actual credentials to Global Protect. Any pointers appreciated. Thanks.

darren_g · ‎04-28-2014

slv wrote: Hello Id like to share with You (sad) news about IE http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html and response from Microsoft https://technet.microsoft.com/library/security/2963983 This is probably will be first issiue on Windows XP that will be never patched. We are wating for 433 Thread prevention update ... I hope it will be realeased soon as a emergency update. Regards Slawek I'd like to point out that you can move towards mitigating this, even on XP, by installing EMET on your PC (http://support.microsoft.com/kb/2458544) This allows you to "sandbox" critical processes (in this case, IE) from being exploited by this bug. It's not perfect, but coupled with the content release by PA, you can certainly minimise your risk should you be in a position (like me) where you simply can't get rid of XP (completely) for whatever reason.

darren_g · ‎04-09-2014

Fair enough. Thanks.

darren_g · ‎04-09-2014

Is there any way of ensuring you have the correct one? I logged to the emergency notification this morning and was unable to download on my firewalls (way to go for your content delivery network, Palo Alto, by the way - just fantastic that you send out an emergency noticew via email and then we can't download it), so I downloaded it from the support portal and installed manually - but I don't know how to tell if I have the correct version installed.

darren_g · ‎03-23-2014

bdeschut - I saw an improvement exactly *once* - when I upgraded from, I think, 4.1.6 to 4.1.8-h3 - management CPU went from 70% constantly with spikes to 100% to only having spikes to 70% every five minutes - and it's been that way *ever* since. That's not an improvement - that's simply a change in priority/frequency of the process which is causing the issue.

darren_g · ‎03-20-2014

dieterb wrote: But still, I fear PA will not act. By the time our issue-report is complete, I expect PA support to say "please upgrade to version X first" (what we just did because they told us to) ... to start all over again. Been there, done that. At least twice. I've got a 3020 in service at another location, and the difference in commit times is staggering - I can commit the config through *10* changes on the remote site before I get *one* change done on my central site's 2020's. Software version doesn't make one bit of difference. If anything, it gets slower with software upgrades as they push more "features" into the base OS install/

darren_g · ‎03-20-2014

ericgearhart wrote: dieterb they should just issue a mass recall and replace everyone's PA2000 with either a PA500 (which in my personal experience can outperform a PA2000) or better yet replace them with the lowest end PA3000! Or at least put out an upgrade kit to put more RAM into the management plane. I understand why they won't make it customer upgradable like the PA500 (because you have to expose the power supply on the 2000 series), but for f*** sake, I'd *pay* to have someone come out and upgrade the RAM on my 2020's.

darren_g · ‎03-20-2014

dieterb wrote: Sadly, this seems to be the default answer to all 2000 series performance issues threads in this forum... Yeah, and the default reply is "We can't find anything wrong, this is expected behaviour". I got told last time I logged a job that I should select "manual" updates when I'm sitting in the console instead of the periodic 1 minute I have it set at to take load off the management plane. Ridiculous.

darren_g · ‎02-16-2014

So our PA runs a Global protect portal/gateway on it. We have actually gone out and purchased a legitimate SSL certificate for the portal address and installed it. However, *every* single F***ing time I save the config, I get "Warning, cannot find complete certificate chain for "Certificate_name".". There are also *some* browsers and client installs which this breaks on. How the h*** do I make this go away? I have downloaded the certfiicate issuers intermediate chains and - as far as I know - installed them into the firewall - yet I still get this damn error. Anyone shed some light on this? It's really starting to peeve me off.

darren_g · ‎02-12-2014

holmesw wrote: The CLI commands for forcing failover and then returning to HA mode are: admin@pafw2(active)> request high-availability state suspend Successfully changed HA state to suspended admin@pafw2(suspended)> request high-availability state functional admin@pafw2(passive) I knew about the suspend command, I just wasn't sure if it meant suspend the HA state, or suspend the HA (and make both firewalls active). I know now it's the former - and I've tested it this week, so I know it works. Makes troubleshooting the network issues way easier when I can just put the primary back online with two clicks! Cheers and thanks

Member Since	‎09-16-2012 09:05 PM
Date Last Visited	‎06-24-2025 04:02 PM
Posts	287
Total Likes Received	57

Online Status	Offline
Date Last Visited	‎06-24-2025 04:02 PM

About darren_g

Re: Block access on HIP check failure - how?

Block access on HIP check failure - how?

Network monitor shows huge traffic spike, but can't find traffic details

Re: LogDB Import failing - anyone suggest why?

Re: Split tunnel specific URL only, not entire site?

Split tunnel specific URL only, not entire site?

Re: Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Re: Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Global protect DNS and Windows 10 Home

Re: Force HA failover - how?

Re: LogDB Import failing - anyone suggest why?

Re: Scheduled reports not working

Re: BGP sessions not exporting

Restricting VPN access to internal services on per-user basis

Re: IPSEC vsys cli

Re: HOWTO Wanted : Trunked L3 intrerface with tagged VLAN's

Re: HOWTO Wanted : Trunked L3 intrerface with tagged VLAN's

Re: IPSec VPN routing across multiple tunnels

Re: IPSec VPN routing across multiple tunnels

Re: High Availability weirdness

Re: High Availability weirdness

High Availability weirdness

Re: PANOS 6

Re: Is there an idiots guide to deploying certificate-based pre-logon for Global protect?

Is there an idiots guide to deploying certificate-based pre-logon for Global protect?

Re: New Zero-Day Exploit targeting IE9-11 CVE-2014-1776

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Re: Tips to improve mgnt tasks in a PA-2020

Re: Tips to improve mgnt tasks in a PA-2020

Re: Tips to improve mgnt tasks in a PA-2020

Re: Tips to improve mgnt tasks in a PA-2020

Certificate errors on VPN portal - how do I make it work?

Re: Force HA failover - how?

Unlock your full community experience!

About darren_g