About Carracido

Hello team,   I have an HA active/passive with a couple of PA-3250. After failover from active to passive there are a high latency for all the connections and some Http/https sessions cannot be established. I see in the traffic logs many aged out sessions and tcp-rst-from-server and also tcp-rst-from-client. After one minute aprox. the system gets stable. Is this expected behavior?     Thanks and Regards, Marcos. ... View more

Hello Community.   I have an inquiry with which maybe you can help me. This is the situation:   In order to know the uptime I´m using the OID 1.3.6.1.2.1.25.1.1.0 to get the value of object hrSystemUptime. This is a counter of 32 bits and considering it´s counting in hundreds of seconds, the maximum uptime without overflow is: 2^32 = 4294967296 (hundreds of seconds) -> 497 days. So if the device is not rebooted before 497 days the uptime value won´t be correct by using snmp.   Do you know any way (snmp or other means) to bypass this limitation and to get the correct uptime regardless the value??   Thanks in advance,   Marcos. ... View more

I´m using a HIP profile to check if antivirus real time protection is enabled in the PC, everything was working properly until upgrading Kaspersky from version 10 to 11. I cannot connect with GP anymore. Does anyone have the same issue?   "resubmit host profile" in the agent didn´t work   I´m running Pan-OS 7.1.16 adn GP agent 3.1.6 ... View more

Hello Community,   I´m having a strange behavior after configuring an IPSec tunnel, the situation is that I can ping a subnet trough the tunnel which hasn´t a proxy ID. This subnet has an entry in the virtual router and the tunnel interface points to it, there´s also a security policy which allows this traffic but as far as I know if this subnet has no proxy ID the communication trough the tunnel wouldn´t be possible. In summary:   To reach the subnet A.B.C.X trough an IPSec tunnel I configured: - IPSec tunnel (IKE Gateway, IPSec Crypto Profile, tunnel interface, ---> Proxy ID) - Security rule - virtual router   The strange behavior is that I can ping a subnet A.B.C.Y trough the same tunnel, but there isnt ProxyID for this subnet in the tunnel, only a route in the virtual router with the tunnel interface pointing to the subnet A.B.C.Y   Any ideas about why this may be happening??   Thank you in advance, Marcos. ... View more

Hello Community!   I have an issue with scheduled reports, they are not being generated. I send a "test email" and I receive it, I reboot the Firewall and I receive the scheduled reports for some time but then it fails again. I´m running PAN-OS 7.0.1   Did anyone have the same issue?? How can I troubleshoot this issue?? In which file in the tech support file may I see logs related with a scheduled report issue??   Many thanks in advance for your answers.   Kind Regards, Marcos.     ... View more

Hello guys,   In the detailed log view of traffic logs in the Category field I see always "any". I´ve never had URL filtering license so I created a custom URL category for filtering some URLs. I just would like to know why I´m no seeing in the logs the URL custom category I created and I always see "any" as category. Any idea??   Many thanks in advance. Kind Regards, Marcos. ... View more

  Hi all,   I want to renew the expiration date of the certificates for my globalprotect devices. The firewall is the CA that issued the certificates.   My question is whether I have to export and import the certificates after renewing them by following the steps on this article:  https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/certificate-management/revoke-and-renew-certificates.html   I don´t know if the certificates renewal requires any installation or the changes will be reflected in the devices without installation.    Many thanks in advance, Marcos ... View more