About kprakash

Do you have the traffic logs, and the information about the virus? In cases where the attack could have been a zero day attack, we can use the wildfire functionanlity of the PANFW to report unknown signatures to the cloud, analyze these signatures and determine if they are malicious or not. BR, Karthik RP ... View more

Hi, Did you go through this link? https://live.paloaltonetworks.com/message/22139#22139 It explains how to set up inbound NAT with DHCP BR, Karthik ... View more

Hi CRF, Yes, you are right again. 1) You will suspend the current passive box: request high-availability state suspend 2) Apply the changes and force the commit 3) Make the current box functional. The box will still remain passive, and there will be a mismatch in the running configuration on both the active and the passive devices 4) Now test the traffic by suspending the current active box, and make it functional and  passive: >request high-availability state suspend >request high-availability state functional ( on the suspended box) 5) If everything is fine, you can synchronize the running configuration, from the new active box > request high-availability sync-to-remote running-config ( on the current active box) If at all you encounter any issues, suspend the current active box ( with the new interface config. Bring back this box to passive ), and then synchronize the running configuration from the active box. BR, Karthik ... View more

You could also restart the devsrvr as a last resort to see if it makes a difference. There would be no outage whatsoever, but you can definitely try out in a window: >debug software restart device-server ... View more

Are the PANFWs in Layer3 mode or in vwire mode? Can you attach the sceenshot of the untrust to trust rule on the PANFW Thanks and best regards, Karthik RP ... View more

Hi CRF, I did not paste the configuration of the lines, my bad, but you are correct. You need these lines as well: delete network virtual-router vr-recette interface ethernet1/6.3 delete vsys vsys2 import network interface ethernet1/6.3 delete vsys vsys2 zone DMZ_Recette network layer3 ethernet1/6.3 set network virtual-router vr-recette interface ethernet1/8.3 set vsys vsys2 import network interface ethernet1/8.3 set vsys vsys2 zone DMZ_Recette network layer3 ethernet1/8.3 When you commit the PANFW, with all these changes, the configuration will be automatically pushed to both the devices in the cluster. But if you want to test this out on one box first, you can remove the passive box from the cluster, by disabling the HA, under the HA settings (Also be careful that you do not run into a split brain scenario). You can then apply these changes on this box and commit them, and test the traffic. If they work as expected, you can then apply these changes on the active box too, and bring back the other box into the HA cluster. ... View more

Hi Franck, We can delete the package from the root, although there is no harm in keeping the currently installed package on the box. With the expiration of the license, you cannot get the latest updates. The PANFW would continue scanning for threats by matching the signatures defined under the currently installed version. To Delete the file from the root, you need to open a case with TAC. BR, Karthik RP ... View more

You can log into the cli, and log the cli session: admin> confiugre admin# run set cli config-output-format set You can then filter the configuration of the interface 1/6 using the "show" command, and then pressing the / button, and typing "ethernet1/6",as below. It brings the configuration of eth1/6 and its subinterfaces. I am just showing for the sub interface eth1/6.3 admin#show /ethernet1/6 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement enable no set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement min-interval 200 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement max-interval 600 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement hop-limit 64 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement reachable-time unspecified set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement retransmission-timer unspecified set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement lifetime 1800 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement managed-flag no set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement other-flag no set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement enable-consistency-check no set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery router-advertisement link-mtu unspecified set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery enable-dad no set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery reachable-time 30 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery ns-interval 1 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 neighbor-discovery dad-attempts 1 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 enabled no set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 interface-id EUI-64 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ip 192.168.102.21/24 set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 adjust-tcp-mss no set network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 tag 3 Open the notepad on which the logs are being written to. replace the word "set" with "delete", so that we are gonna delete the eth1/6 references. Copy paste all these output again, and replace eth1/6 with eth1/8, so that you should have the output of the format set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 ipv6 enabled no set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 ipv6 interface-id EUI-64 set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 ip 192.168.102.21/24 set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 adjust-tcp-mss no set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 tag 3 Go back to the cli and then paste all the "delete" and the "set" commands for the eth1/6 and eth1/8 respectively once pasted, commit the configuration admin# delete config devices localhost.localdomain network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 enabled no delete config devices localhost.localdomain network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ipv6 interface-id EUI-64 delete config devices localhost.localdomain network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 ip 192.168.102.21/24 delete config devices localhost.localdomain network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 adjust-tcp-mss no delete config devices localhost.localdomain network interface ethernet ethernet1/6 layer3 units ethernet1/6.3 tag 3 set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 ipv6 enabled no set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 ipv6 interface-id EUI-64 set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 ip 192.168.102.21/24 set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 adjust-tcp-mss no set config devices localhost.localdomain network interface ethernet ethernet1/8 layer3 units ethernet1/8.3 tag 3 admin# commit force ... View more

Hi awarsame, From what I understand, the PANFW cannot connect to the wildfire server, and thats why we get the "Failed to check WildFire content upgrade info due to generic communication error". Can you change the update server to "staticupdates.paloaltonetworks.com" to see if it makes a difference. ( device tab--> setup--->services ) With regard to the Anti-Virus version does not match issue, verify if the HA pairs havent been configured to download and/or install the version at the same time. The recommended steps is to keep at least a 30 minute time difference, for the download and/or install 30 mins,between both the firewalls. Also verify that the "Enable config Syn" check box is clicked under the HA settings ( device----> high-availability-----> general) You can also use the command: request high-availability sync-to-remote running-config BR, Karthik ... View more

Can you verify if the interface on the router on LAN-B is not configured as a passive interface for OSPF, oe doenst have any wierd access list that is blocking the advertisement of the network? We can see that the PANFW is learning the routes via OSPF from its neighbours OSPF router and Cisco router. If its just one network, ie the LAN B, that the firewall isnt getting routing information for, we have to check the settings on the firewall on LAN B ... View more

Hi, From what I understand, there is a limit to the total number of URLs that can be added under the custom URLs, and it is platform dependent. The max URLs supported per platform can be obtained by issuing the command: >show system state | match cfg.general.max This outputs the list of max number of objects per platform. For a pheonix, I see that we have a limit of 25k. cfg.general.max-url-pattern: 25000 Let me continue digging for the number of URLs supported per URL object. ... View more