About dreputi

Hello Amit, You can also run the following command and see what it shows: > debug swm status Partition         State             Version -------------------------------------------------------------------------------- sysroot0          REVERTABLE        6.0.0        <<<< Here you need to see whatever previous version you had sysroot1          RUNNING-ACTIVE    6.0.4    <<<<Here you need to see 6.0.5 maint             READY             6.0.4 You can also see the info in the system logs when the device was rebooted. You will see "Management server started. Running version 6.0.5" If you do not want to take any chances, you can install 6.0.0 and then upgrade to 6.0.5 so that you can be sure of this. -Dileep ... View more

Hello X, The info provided is very less, however since you mentioned about failover, please check if the HA settings has the 'Passive link state' as shutdown. You can change it to 'auto' which reduces the failover time since the passive links will be up even before the failover. Hence, the time taken to bring up the passive links can be reduced. During this time, it is possible that you might see some issues with respect to arp on the connected devices. If possible provide us more details. Regards, Dileep ... View more

Hello Gavin, If you create one Bi-directional NAT, PAN breaks the NAT rule into two which looks like this(Bidirectional from Trust to Untrust): "Trust-Untrust-Bidirectional NAT" {         from trust-L3;         source 192.168.18.1;         to untrust-L3;         to-interface  ;         destination any;         service  any/any/any;         translate-to "src: 10.10.10.10 (static-ip) (pool idx: 5)";         terminal no; } "Trust-Untrust-Bidirectional NAT" {         from any;                                                           source any;         to untrust-L3;         to-interface  ;         destination 10.10.10.10;         service  any/any/any;         translate-to "dst: 192.168.18.1";         terminal no; } This can be seen in the CLI command "show running nat-policy". Regards, Dileep ... View more

Hello Mark, In your case I see the message: (T2896) 10/20/14 13:46:17:270 Debug(1114): FlushDNS not set or not YES, ingore flush dns cache GP client version >1.2.9 or >2.0.3 has a fix for flushdns setting set to YES. 58852—DNS settings did not revert correctly with FlushDNS set to YES in the GlobalProtect client registry, causing the network to become unstable until they were reset. Updates have been made to ensure that DNS settings revert correctly to the original DNS settings after GlobalProtect disconnects. Let us know what client version you are using and if the above info helps. Regards, Dileep ... View more

Hello Rrau, You can pre-deploy the portal address through the Windows Registry: (HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup with key Portal) or the Mac plist (/Library/Preferences/com. paloaltonetworks.GlobalProtect.settings.plist and configure key Portal under dictionary PanSetup). Additionally for the agent settings: You can set the GlobalProtect agent customization settings in the Windows registry (HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\) or the Mac global plist file (/Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist). -Dileep ... View more

Hello Cdp181, If logs show no up with no 'user-mapping' for the denied traffic, it could mainly be because of i) no ip-user mapping for that ip/user        : check CLI command >show user ip-user-mapping all ii) no group mapping                                 : check > show user group list iii) the user is not identified part of that group      :check  > show user group name "cn=xxxxxx -name of group"                                                                                           - it will show the way the user id is expecting its users ie domain\username. Make sure it matches with user-ip mapping shown in output i) iv) security rule has group in its source user part with a 'single user icon(means a user)' rather than 'double user icon(means a group)'     :In this condition, most likely the group is not identified properly, you can try deleting and adding the groups/users again. v) Make sure that the source zone has user-identification enabled Let us know how it works. Regards, Dileep ... View more

Hello Bhelman, I have noticed quite a few incidences where netflix has been identified as web-browsing. Please make sure you are on the latest content version (463 being latest today) and test again as I see some improvements being reported. You may open a support case to follow the updates from bug 68271. Regards, Dileep ... View more

Hello Jambulo, You can check if the configured interfaces are having proper arp entries on the PAN. Also, check the arp entries on the connected switches/routers. If the device is in HA mode, and if the connected devices didn't update the arp entries to the active device, you can try to clear the arp entries on those devices so that they learn the arp entries freshly. You can also try to run test gratuitous arp command to send out grat arps that will force connected devices to update their arp entries. >test arp gratuitous ip <ip/netmask> interface <interface> -Make sure the traffic is hitting the correct rules. For ex, if group-mapping is used in security rules, make sure that the users are properly identified so that they hit correct rules. Regards, Dileep ... View more

Hello Lewis, The category of a URL is determined in the following top-down approach: 1. Block list 2. Allow list 3. Custom Categories 4. DP URL cache 5. MP URL database(Base DB) 6. MP dyanamic database(Dynamic DB) 7. Cloud server(Cloud DB)---if dynamic url-filtering is enabled in the URL filtering profile. URLs will show up as no-resolved if there is no response from MP in 5sec(default timeout can be changed) or if MP is unable to connect to the cloud(when it doesn't have that URL in its database). Make sure the management-server is not too busy. You can restart management-server(typically during off peak hours) and device-server. If its because of MP or device-server, the issue should be fixed here. >debug software restart management-server > debug software restart device-server Also check if the firewall is able to connect to cloud >show url-cloud status Hope it helps! -Dileep ... View more

Hello Mike, I see two feature requests FR# 1701 and 898 regarding QoS reporting and continuous graphs for bandwidth, you can check the status through your SE. However rightnow you may have to use t hird party tools like Netflow or the templates as discussed here: QoS Reporting Hope that helps. -Dileep ... View more

Hello Holtcg, You might still continue to see this as it is still being investigated, probably one of the upcoming versions should have a fix for it. Regards, Dileep ... View more

Hello Hartkently, There is no direct command to show the threat prevention throughput because it is basically just throughput of the device with some default profiles like AV, anti-spyware, vulnerability protection etc. This value has already been calculated and published at Product Selection It is best to see the throughput of the device itself with the command "show system statistics session" which tells the current throughput value under operating conditions with your configuration subject to the amount of traffic going through firewall at that moment. To improve performance you may disable DSRI or Disable Server Response Inspection. With DSRI turned on, server response traffic is not inspected, which will increase the throughput capacity. Obviously, enabling this feature is only recommended for trusted servers. References: Threat Prevention Deployment Tech Note Threat Prevention Throughput Let us know if you have any questions. Regards, Dileep ... View more

Hello Infotech, It would be the source zone of global protect's tunnel interface. Its a good practice to have global protect in a separate zone not interfering with your trust/untrust. In case this zone is also used by another interface, then you will see more traffic not just the one coming from gp but from outside as well. Regards, Dileep ... View more