Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About Ameya-Kawimandan
About Ameya-Kawimandan
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
2 weeks ago
385Posts
249Likes
121Solutions
May 20, 2020Last Visited
User
Activity
User
Profile
Latest posts by Ameya-Kawimandan
| Subject | Views | Posted |
|---|---|---|
| 591 | 01-07-2014 05:50 PM | |
| 1125 | 01-07-2014 04:31 PM | |
| 682 | 12-31-2013 03:19 PM | |
| 451 | 11-10-2013 12:41 AM | |
| 402 | 11-08-2013 01:16 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 06-12-2012 02:12 PM | |
| 1 | 06-05-2012 11:52 AM | |
| 1 | 05-31-2013 03:28 PM | |
| 1 | 04-24-2013 05:26 PM | |
| 1 | 08-26-2013 02:55 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 5 | |||
| 4 | |||
| 1 | |||
| 1 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 02-22-2012 01:14 PM |
| Date Last Visited | 2 weeks ago |
| Total Messages Posted | 439 |
| Total Likes Received | 249 |
09-09-2013
05:56 AM
2 Kudos
Can you please report this mis-identification to Support: How to Validate and Report Application Misidentification
... View more
09-09-2013
05:44 AM
1 Kudo
For VLANs behind L2 switch you can set up PA firewall as a Router on a stick. Not sure how PA could play a role in securing inter-VLAN traffic for the VLANs terminated on the L3 Switch. Following References can be helpful. Securing Inter VLAN Traffic Layer 2 Networking
... View more
09-09-2013
05:19 AM
1 Kudo
Can you try to set Local ID on ASA =Public IP of the NAT device && Peer Identification on PA firewall = Public IP of the NAT device under ike-gateway on PA.
... View more
09-09-2013
05:08 AM
2 Kudos
Does authentication work w/o Allow list i.e with all groups. What's the format used for Authentication, It should be simply username and not domain\username. Check if you have configured Auth Profile correctly. I always miss Login attribute : sAMAccountName
... View more
09-07-2013
08:08 AM
1 Kudo
Pattern-Based Application Identification occurs in the App_ID Engine. If a matching signature is not found in the Application Database the Application is identified as either unknown-tcp, unknown-udp, or non-syn-tcp. For applications changing from one to another, Identification is done via protocol decoding in content inspection. For detailed Packet Flow :ReferPacket Flow in PAN-OS See Also :Unknown Applications
... View more
09-06-2013
05:04 PM
Assuming : HA Active-Active between PANA (Dev ID =0 ) and PANB (Dev ID =1) PANA-Device Priority -100 ===>Active-Primary ----Dev ID =0 PANB-Device Priority -200 ===>Active-Secondary----Dev ID =1 Rationale : Priroties assigned to the Device IDs for a certain Floating IP govern which Unit will own the Floating IP. Floating IPs are tied to the priorities of the Device ID and not the Device Priority (Device>High Availability >Election Settings). Lower priority takes precedence. Example: Configure floating IPs 192.168.50.254 and 192.168.50.253 on the interface eth-1/4 with Device ID =1 have lower priority than Device ID 0. This will ensure that a floating IPs 192.168.50.254 and 192.168.50.253 will always stay active on Device ID-1 or Active Secondary. IP 192.168.50.252 will always stay active on Dev-0 or Active Primary. HTH, Ameya
... View more
08-27-2013
11:15 AM
Have not tested all the scenarios but Rebooting the FW or Updating the PAN-OS should not stop the functionality to work as the Content DB would not change with reboot. .I guess Factory reset could be a corner case.
... View more
08-27-2013
12:35 AM
Threat prevention (AV/Apps & Threats) license expiration will only stop the new updates while these features will continue to function with existing Database.
... View more
08-26-2013
10:49 PM
Can you add the o/p for following commands to this discussion >show running nat-policy >show routing route Also start a continuous ping to the DMZ public IP and monitor the session table: >show session all filter source <ip> if you see any PING sessions displayed add the following o/p with this discussion >show session <id>
... View more
08-26-2013
05:49 PM
1 Kudo
Can you add a packet-filter and monitor the Global counters for the packet-filter for the source IP (Monitor>Packet Filter) Initiate a PING to the destination (Public DMZ) ,and verify if the packets are making it to the firewall using the following command: >show counter global filter packet-filter yes delta yes (Run multiple times )
... View more
08-26-2013
02:57 AM
1 Kudo
CAn you please follow the procedure described in the following KB article: Content Filter Update Error "No matching apps package"
... View more
08-26-2013
02:55 AM
1 Kudo
These are Dead Peer Detection check logs shown in ikemgr.log
... View more
08-26-2013
12:14 AM
1 Kudo
Application PCAPs are generally enabled for Unknown apps : unknown-tcp or unknown-udp You can use the following filter ( app eq unknown-tcp ) or ( app eq unknown-udp ) You can verify the capture settings using CLI command : > show running application setting
... View more
08-26-2013
12:03 AM
Please Allow the Original address 1.2.3.91 in the Security rule. Source : Outside Source Address : Any Destination : Inside Destination Address : 10.100.1.120 Change to : Source : Outside Source Address : Any Destination : Inside Destination Address : 1.2.3.91
... View more
08-25-2013
11:53 PM
1 Kudo
At the moment, there is no direct method to block files using their names . Following workarounds can be used: 1> Create a Custom URL category using the source URL of the file and block this custom-url category. Eg : If you know the URLs where this file "hacker tutorial.pdf" could be downloaded from : Create a custom URL category and block this category using URL filtering profile. 2> Create custom application signature for the URL path including the filename. P.S: " But please keep in mind that once you block the file by filename your users will normally try to change the filename to bypass the control which makes it useless." Ref https://live.paloaltonetworks.com/message/10273#10273
... View more
08-25-2013
11:03 PM
Following article explains a way to achieve this Can Files be Blocked by Name?
... View more
08-25-2013
10:53 PM
Can you try to add a static route for 1.2.3.91/32 reachable through DMZ interface. Make sure the packets are being received on the firewall using traffic logs. P.S: Without addition of this static-route ,NAT rule Outside to Outside should be able to translate these packets. Try refreshing arp table of the upstream router. >test arp gratuitous ip 1.2.3.91 interface <outside interface>
... View more
08-24-2013
03:47 PM
1 Kudo
The statement is TRUE only for malware URLs /IP addresses identified by the PA Threat Research Team. PAN-DB does not contain all the IPs associated with a URL.
... View more
08-20-2013
05:32 AM
There is currently no limit for admins to login concurrently.However, you may experience a performance impact with the more admins logged in.For e xample : If the host of admins start generating reports,simultaneously , there could be some issues. But there should not be any issues configuring multiple admins as this is not limited by the Software.
... View more
08-20-2013
02:35 AM
Please confirm this information with your SE on the availability of Wildfire for Android.
... View more
08-20-2013
01:16 AM
1 Kudo
I was able to get this working using the interface address: admin@50-PA-5020(active-primary)> show interface logical | match 192.168 ethernet1/4 19 1 trust-L3 vr:default 0 192.168.50.1/23 admin@50-PA-5020(active-primary)> show high-availability virtual-address | match 192.168 192.168.50.1 Active:yes Type:floating admin@51-PA-5020(active-secondary)> show high-availability virtual-address | match 192.168 192.168.50.1 Active:no Type:floating IP-CONFIG Connection-specific DNS Suffix . : IP Address. . . . . . . . . . . . : 192.168.50.206 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.50.1 Results: Reply from 192.168.50.1: bytes=32 time<1ms TTL=64 Reply from 192.168.50.1: bytes=32 time<1ms TTL=64 Pinging 4.2.2.2 with 32 bytes of data: Reply from 4.2.2.2: bytes=32 time=25ms TTL=57
... View more
08-20-2013
01:04 AM
This information was not posted earlier ,I will post this as a knowledge base article. Regards, AK
... View more
08-20-2013
12:19 AM
Palo Alto Networks firewalls have been designed to perform an Auto-Probe/Auto-Discovery when a DHCP server is configured in auto mode. The auto-probing detects existing DHCP servers in the same subnet. When another DHCP server is detected in the subnet, the firewall will shut down DHCP services and the other DHCP would gain/retain control. Note: Auto-Probing cannot be turned-off and should not be mistaken for the "probe-ip" feature. When the DHCP server in auto mode on the Palo Alto Networks firewall stops working due to the discovery of another DHCP server, the following message will appear in the System Log : DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface <DHCP Server Interface>
... View more
08-19-2013
03:45 PM
1 Kudo
Please refer :https://live.paloaltonetworks.com/docs/DOC-3322 DES is not supported .
... View more
08-19-2013
12:08 PM
1 Kudo
I suggest deleting the GP PanPortalCfg.DAT file located (by default) at the following path. C:\Users\<Windows User>. This will force the GP Windows Agent to download the Altered config from the Portal rather than using GP config from the Local cache,when a User attempts to connect back to the Portal after disconnection.
... View more
08-19-2013
03:59 AM
Currently it is not possible to use Threat name as a filter in Threat logs ,you can alternatively just choose the Threat Id from the Available columns in the Threat logs as shown in the Snapshot. Threats details can also be searched from the Threat Vault. https://threatvault.paloaltonetworks.com/
... View more
08-19-2013
03:55 AM
1 Kudo
I tried answering this question in following Post : https://live.paloaltonetworks.com/message/26428#26428
... View more
08-19-2013
02:20 AM
3 Kudos
1. How much user-id be supported by agent-less user-id? I guess that 64K user-id and 640 user-group would be supported on all of PAN model. right? Right 2. When using user-id collector, How much user-id and user-group be supported by agent-less user-id for receiving all of user-id and user-group from other FWs? 64K user-id and 640 user-group be supported? Right 3. How many domain and DC be supported on user-id collector environment? Only 20 DC and 8 Different Domains be supported? Approximate Numbers: Agentless: Small/Medium-sized Deployments and LAB Environments Monitoring up to 20 Domain controllers and/or Exchange servers. User-ID Agent : Large Deployments Monitoring up 100 Domain controllers and/or Exchange servers 4. When Using User-ID Collector would support so many user-id, user-group Is it makes a problem of performance for MGMT of FWs? Using the User-ID feature to its max capacity would increase the MP CPU but should not affect the Managment Access to the FW. 5. I know that command "show user ip-user-mapping all" would show mapping user for DataPlane and "show user ip-user-mapping-mp all" would show mapping user for Management Plane? What's different for both of the command? When should I check for user-mapping for MP or DP? DP reads User ID info from MP ,so while debugging User-ID related issues start with MP related command ( show user ip-user-mapping-mp all).
... View more
08-14-2013
04:28 AM
1 Kudo
Few Options: 1>Enable QOS default profile on the interface to get realtime B/W usage. 2>Using ACC which gives a good estimation of Bytes Consumed over certain duration eg Last 15 mins. 3> Using SNMP and Cacti Templates: https://live.paloaltonetworks.com/thread/4367?tstart=0
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Latest Tags
No tags yet
Likes From
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
