About rkra

rkra · ‎10-15-2014

All FQDN Jobs are finished Enqueued ID Type Status Result Completed -------------------------------------------------------------------------- 2014/10/15 12:21:38 894 FqdnRefresh FIN OK 12:21:42 2014/10/15 11:51:37 893 FqdnRefresh FIN OK 11:51:39 2014/10/15 11:21:36 892 FqdnRefresh FIN OK 11:21:38 2014/10/15 10:51:34 891 FqdnRefresh FIN OK 10:51:36 2014/10/15 10:21:33 890 FqdnRefresh FIN OK 10:21:35 2014/10/15 09:51:31 889 FqdnRefresh FIN OK 09:51:34 2014/10/15 09:21:30 888 FqdnRefresh FIN OK 09:21:32 2014/10/15 08:51:29 887 FqdnRefresh FIN OK 08:51:29 2014/10/15 08:21:28 886 FqdnRefresh FIN OK 08:21:30 2014/10/15 07:51:22 885 FqdnRefresh FIN OK 07:51:26 2014/10/15 07:21:20 884 FqdnRefresh FIN OK 07:21:24 2014/10/15 06:51:19 883 FqdnRefresh FIN OK 06:51:23 2014/10/15 06:21:18 882 FqdnRefresh FIN OK 06:21:20 2014/10/15 05:51:16 881 FqdnRefresh FIN OK 05:51:19 2014/10/15 05:21:15 880 FqdnRefresh FIN OK 05:21:17 2014/10/15 04:51:14 879 FqdnRefresh FIN OK 04:51:16 2014/10/15 04:21:12 878 FqdnRefresh FIN OK 04:21:16 2014/10/15 03:51:11 877 FqdnRefresh FIN OK 03:51:15 2014/10/15 03:21:10 876 FqdnRefresh FIN OK 03:21:14 2014/10/15 02:51:08 875 FqdnRefresh FIN OK 02:51:12 2014/10/15 02:21:07 874 FqdnRefresh FIN OK 02:21:11 2014/10/15 01:51:06 873 FqdnRefresh FIN OK 01:51:10 2014/10/15 01:21:04 872 FqdnRefresh FIN OK 01:21:09 2014/10/15 01:00:44 871 Content FIN OK 01:02:05 2014/10/15 01:00:17 870 Install FIN OK 01:00:44 2014/10/15 01:00:13 869 Downld FIN OK 01:00:15 2014/10/15 00:51:03 868 FqdnRefresh FIN OK 00:51:05 2014/10/15 00:21:02 867 FqdnRefresh FIN OK 00:21:06 2014/10/14 23:51:01 866 FqdnRefresh FIN OK 23:51:05 The real name is ZGTFS2.zgtroot.ads Here the output request system fqdn show PROTEUS.intern.zgt.de (Objectname PROTEUS.intern.zgt.de): 10.136.20.99 -919 949 SFTP.ZGT.DE (Objectname SFTP.ZGT.DE): 185.9.109.121 -949 949 ZGTFS2.zgtroot.ads (Objectname ZGTFS2.zgtroot.ads): Not resolved ZGTSQL1.zgtroot.ads (Objectname ZGTSQL1.zgtroot.ads): 10.160.0.121 251 949 ZGTSQL2.zgtroot.ads (Objectname ZGTSQL2.zgtroot.ads): 10.160.0.122 251 949 BUT! PING from console ist WORKING when the FQDN is pointing to a CNAME too. It seems FQDN Refresh and PING use differenet processes to resolve DNS names. rkrakovic@PA1(active-secondary)> ping host ZGTFS2.zgtroot.ads PING EFMETRO01A.intern.zgt.de (10.136.233.101) 56(84) bytes of data. 64 bytes from EFMETRO01A.intern.zgt.de (10.136.233.101): icmp_seq=1 ttl=251 time=0.464 ms 64 bytes from EFMETRO01A.intern.zgt.de (10.136.233.101): icmp_seq=2 ttl=251 time=0.462 ms 64 bytes from EFMETRO01A.intern.zgt.de (10.136.233.101): icmp_seq=3 ttl=251 time=0.449 ms 64 bytes from EFMETRO01A.intern.zgt.de (10.136.233.101): icmp_seq=4 ttl=251 time=0.450 ms

rkra · ‎10-14-2014

Can not login to: For more information refer bellow link. Re: SNMP for tunnel interfaces

rkra · ‎10-14-2014

Hi Hadrik, the address Object was already created and worked as long there was a A RECORD in the DNS. host.mydomain.de A 1.1.1.1 After switching to host.mydomain.de. CNAME newhost.mydomain.de, it stopped working. Roman

rkra · ‎10-14-2014

Is it very easy to read SNNP Values from physical interfaces: Connect the SNMP Browser to the PA Set the right Community password: PA shows you the interfaces - but only the physical IFs. How to read SNMP Values from VPN-Tunnel-Interfaces? Roman See: Palo Alto Tunnel Interfaces | thwack

rkra · ‎10-14-2014

My PA can not resolve FQDNs pointing to a CNAME. This is dangerous, if you are using FQDN instead of IPs in policies. They can stop working. We configured a FQDN hostname host.mydomain.de and bound it to a policy. Few months later moved this Service to another server using CNAME. host.mydomain.de. CNAME newhost.mydomain.de PA can not resolve this new IP for hot.mydomain.de and the policy stops working. Is there a way to prevent this? Roman

rkra · ‎09-26-2014

I configured a Netflow profile and associated it with a "Untrust" Interface on my active Machine in my setup. I was surprised seeing that the second Active machine got this assotiation too. So I accume both machines are sending to the same receiver and to the same port. I'm new to Netflow and my question is: How does the receiver distinguish which data is coming from which server? Both IFs are sending to UDP 2055. Do I have to send each Flow to a different port on the Flow-Receiver? Roman

rkra · ‎09-25-2014

Is it possible to make a reverse DNS Query in reports to get Names instead IPs in report displayed? Roman

rkra · ‎09-25-2014

Where to start with this topic: I can monitor the bandwith with SNMP and PRTG Network Monitor. Now I'm interested in data >>>PA can provide <<< about types of data, sources and destinations? I would like to check e.g. this: How much VoIP is running through the PA? Who is downloading most data at the moment. a.s.o. I know there is sflow, but may be PA can help. Roman

rkra · ‎09-25-2014

"You can control this behavior by denying at service level. ie. configure policy that denies port 20 and 21 from untrust to dmz. That way firewall will not wait to evaluate the application and drop the packets once received. Hope this helps." Ssharma, can you help me with this? When denying 20 and 21 from UNTRUST to TRUST FTP will not work. May be you mean to combine this policy with the FTP app policy? Roman

rkra · ‎09-24-2014

I'm trying to get some data about the amount of data on the interfaces. Device/ Operations/ SNMP configured, SNMPV2 enabled. SNMP on my Trust interface per IF Profile enabled. I still can not get SNMP Data. Roman

rkra · ‎09-24-2014

Hi Hulk, here are the details. rkrakovic@PA1(active-primary)> show session all filter source 176.28.45.241 destination 185.9.109.124 -------------------------------------------------------------------------------- ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port]) Vsys Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 9066 ftp ACTIVE FLOW 176.28.45.241[50780]/UNTRUST/6 (176.28.45.241[50780]) vsys1 185.9.109.124[21]/DMZ1 (185.9.109.124[21]) rkrakovic@PA1(active-primary)> show session id 9066 Session 9066 c2s flow: source: 176.28.45.241 [UNTRUST] dst: 185.9.109.124 proto: 6 sport: 50780 dport: 21 state: ACTIVE type: FLOW src user: unknown dst user: unknown s2c flow: source: 185.9.109.124 [DMZ1] dst: 176.28.45.241 proto: 6 sport: 21 dport: 50780 state: ACTIVE type: FLOW src user: unknown dst user: unknown start time : Wed Sep 24 15:50:56 2014 timeout : 1800 sec time to live : 1768 sec total byte count(c2s) : 0 total byte count(s2c) : 0 layer7 packet count(c2s) : 0 layer7 packet count(s2c) : 0 vsys : vsys1 application : ftp session to be logged at end : True session in session ager : True session synced from HA peer : True session owned by local HA A/A : False layer7 processing : enabled URL filtering enabled : False session via syn-cookies : False session terminated on host : False session traverses tunnel : False captive portal session : False ingress interface : ae1.301 egress interface : ae4.303 session QoS rule : N/A (class 4) rkrakovic@PA1(active-primary)>

rkra · ‎09-24-2014

There is no allow policy from Untrust to DMZ to contact the FTP Server. There is an deny policy instead as a last policy between ZONE Untrust und ZONE DMZ. But if I try to connect to FTP Server a connection is estabilished and my FTP Server asks for a Username. This is the end of communication - but is anyone allowed to connect to my FTP Server? Roman

rkra · ‎09-24-2014

Does "Unknown-udp" Appl. allow any UDP Packets? I did not find any app and would like to allow UDP only. Roman

rkra · ‎08-19-2014

Hi there, it is a very nice feature to give a name to a route. But if would be much nicer to sort them by name in GUI. Or ist there a way how to do it? Roman

rkra · ‎08-13-2014

Hello all, I found a problem in the PKI configuration. IPSec Crypto Profile pointed to "default" which was renamed few day ago. Never rename default :=)) Thanks for help. Roman

Member Since	‎07-25-2013 08:00 AM
Date Last Visited	‎12-28-2016 05:22 AM
Posts	41
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎12-28-2016 05:22 AM

About rkra

Multiple outgoing connections

Re: Report about all rules from zone 1 to zone 2

Report about all rules from zone 1 to zone 2

How to Move Policies Up and Down with Keyboard

Is it possible to get Telnet Client an a Palo Firewall running?

Re: How to test AV Functionality when Eicar is not recognised?

Re: How to test AV Functionality when Eicar is not recognised?

How to test AV Functionality when Eicar not in signatures?

How to create and configure 100 tagged subinterfaces via CLI

How to trigger a message when a particular DENY rule was hit?

How to Move Policies Up and Down with Keyboard

Re: Ping form CLI not working - Invalid Syntax

Re: How to create and configure 100 tagged subinterfaces via CLI

Eicar no longer in AV signatures?

Re: Using FQDNs pointing to a CNAME instead of A Record does not work

Re: How to read SNMP Values from VPN-Tunnel-Interfaces?

Re: Using FQDNs pointing to a CNAME instead of A Record does not work

How to read SNMP Values from VPN-Tunnel-Interfaces?

Using FQDNs pointing to a CNAME instead of A Record does not work

Using Netflow v9 in a Active/Active cluster

Re: Is it possible to create reports or graphs displaying type and amount of transported data, sources and dests?

Is it possible to create reports or graphs displaying type and amount of transported data, sources and dests?

Re: FTP Server: No Allow policy but 3-Way-Handshake and Username prompt possible?

Is there a global "enable SNMP" switch?

Re: FTP Server: No Allow policy but 3-Way-Handshake and Username prompt possible?

FTP Server: No Allow policy but 3-Way-Handshake and Username prompt possible?

Does "Unknown-udp" app allow any UDP Packets?

Sorting Routes in GUI

Re: Troubleshooting Commit: How to find a problematic line in a candidate config?

Unlock your full community experience!

About rkra