About Ameya-Kawimandan

Can you try OID 1.3.6.1.4.1.25461.2.1.2.3.2.0 Following Document lists the most common OIDs used on PA firewall Useful SNMP OIDs for Monitoring Palo Alto Networks Devices Following Document lists the  OIDs on OS-5.0 ... View more

If all the  Managed devices are forwarding logs or have forwarded logs to Panorama ,you could do the following. a> Create a Custom report choosing a Custom Time Frame with Database as Panorama Traffic Logs and Run a Report with Selected column as Device. : b> Result which could be exported in PDF or CSV format. ... View more

You can check the List of connected/managed devices from Panorama tab >Managed Devices. CLI commands: > show devices connected > show devices all ... View more

XML API request on PA interface would be treated as general admin web access ,identified as web-browsing. If there is a particular data plane interface that is used for XML-API requests ,you could configure Permitted IP through Interface-Management Profile or create an intra-zone rule allowing only a single address for Web-browsing . Other option would be to create  a Custom- HTTP based app for XML api. ... View more

You best reference would be The Release Notes of 5.0.6 which also mentions the addressed issues of 5.0.4 and 5.0.5. It would be difficult to comment on Pros/Cons as they may be relative to the  Network Setup. HTH ... View more

Do you see Mappings on the Agent? If yes, try to delete the User-ID config ,commit the config and then  Re-add User-ID >another commit. P.S: If above steps do not work and You can afford a production traffic hick-up try : > debug device-server reset id-manager type all followed by commit. I would suggest opening a Case with support to report this issue. ... View more

You could create a CustomReport based on Traffic Summary/Application Statistics for session choosing the required timeframe. PA does not have a provision to create reports based on Throughput /CPU . CLI command "show running resource-monitor " can give you a fair indication of DataPlane CPU load for last 13 weeks. You would have to manually parse through DP and MP logs for to fetch historic data. ... View more

http://shop.paloaltonetworks.com/ :smileycool: ... View more

Seems like compatibility issue with Browser.Try using GUI through a different browser. If running IE8 try  turning off compatibility mode ... View more

Q1. Where is unknown pcap stored? [Device] > [Setup] > [Management] > [ Logging and Reporting Settings] App Pkt Capture ? Application PCAPs are stored  at the following path /opt/panlogs/session/pan/application/ . These  PCAPs will appear in the traffic log as a little green arrow . You can use the  CLI command view-pcap application-pcap <date>/"    to view the Application pcaps [Device] > [Setup] > [Management] > [ Logging and Reporting Settings] is where you can alter the Storage Quota for various logs and PCAPs Q2. I want know Unknown Pcap Usage. Can be viewed using CLI command : > show system logdb-quota Quotas:              traffic: 32.00%, 38.060 GB               threat: 16.00%, 19.030 GB               system: 4.00%, 4.758 GB               config: 4.00%, 4.758 GB                alarm: 3.00%, 3.568 GB                trsum: 7.00%, 8.326 GB          hourlytrsum: 3.00%, 3.568 GB           dailytrsum: 1.00%, 1.189 GB          weeklytrsum: 1.00%, 1.189 GB                thsum: 2.00%, 2.379 GB          hourlythsum: 1.00%, 1.189 GB           dailythsum: 1.00%, 1.189 GB          weeklythsum: 1.00%, 1.189 GB              appstat: 6.00%, 7.136 GB               userid: 1.00%, 1.189 GB             hipmatch: 3.00%, 3.568 GB    application-pcaps: 1.00%, 1.189 GB         threat-pcaps: 1.00%, 1.189 GB   debug-filter-pcaps: 1.00%, 1.189 GB          hip-reports: 1.00%, 1.189 GB             dlp-logs: 1.00%, 1.189 GB Disk usage: traffic: Logs: 59M, Index: 14M threat: Logs: 42M, Index: 12M system: Logs: 5.6M, Index: 904K config: Logs: 17M, Index: 184K alarm: Logs: 20K, Index: 20K trsum: Logs: 86M, Index: 4.1M hourlytrsum: Logs: 2.7M, Index: 1.5M dailytrsum: Logs: 944K, Index: 1.4M weeklytrsum: Logs: 468K, Index: 224K thsum: Logs: 192K, Index: 192K hourlythsum: Logs: 176K, Index: 176K dailythsum: Logs: 168K, Index: 168K weeklythsum: Logs: 32K, Index: 32K appstatdb: Logs: 1.1M, Index: 852K userid: Logs: 100K, Index: 52K hipmatch: Logs: 20K, Index: 20K application-pcaps: 1.4M <<====App PCAP usage threat-pcaps: 4.0K debug-filter-pcaps: 12K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 16K Q3. When is capture unknown packet in PA packet flow? When PA firewall is unable to identify the application using APP-ID ,the application will be termed as unknown (unknown/ -tcp,unknown-udp,non-sysn-tcp). Following Tech note will give you detailed Information about unknown apps and how to report them to Palto Alto. ... View more

Looks like a management server issue ,Try to restart the management server using the following CLI command. > debug software restart management-server You will loose the management access to the firewall  for few seconds and would have to log back in.Try to perform commit or content update i nstall. P.S:Best to try this command after making the problem device passive. If the issue persists ,please open a case with support. ... View more

Following Tech note explains usage a each context for creating a Custom Threat Signature Creating Custom Threat Signatures ... View more

You might want to take a look at Re: Suspicious DNS Query - how to find source computer? ... View more

1>Are you able to access the Firewall using ssh and https via  Dataplane Interfaces? Firewall Management Using a Layer 3 Interface 2>Are you using any scripts? 3>Check the disk usage for any partition not running out of space (I assume telnet access is functional) >show system disk-space 4>You can try restarting the management server CLI: > debug software restart management-server I would suggest opening a case with Support for intrusive debugging . HTH ... View more