About mbutt

mbutt · ‎07-18-2013

Hi Art, If you have a particular URL's where it can be downloaded from then you can block them based on custom URL. Hope this helps Thanks

mbutt · ‎07-18-2013

Can you share an example of which logs are you talking about. Are you talking about URL filtering logs showing category as unknown. If that is the case verify that the URL is categorized on Brightcloud or PANDB depending whichever vendor you are using. If it is not being categorized there and you think it should be then you can submit a re-categorization request to them. Hope this helps. Thanks

mbutt · ‎07-17-2013

If the tunnel is not between two Palo Alto Firewalls make sure that you have proxy ID's under Network---> IPSec Tunnels for the network that is not able to pass the traffic. Also if that is not the case to further debug you can also do the following to see what might be causing the issue 1. Need to setup the filters for the traffic we are interested in. To do this, execute the following steps: Navigate to Monitor--Packet Capture Click 'Manage Filters' Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank ) Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field) 2. Setup up the captures Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop) 3. Enable filters and captures debug dataplane packet-diag set filter on debug dataplane packet-diag set capture on 4. open 2 CLI windows on 1 run the following command to look at the counter ( make sure it run this command once before running the traffic) show counter global filter packet-filter yes delta yes on the 2nd window run the following command to look at he sessions show session all filter source <ip address> destination <ip address> 5. Now run the test for ftp while it is failing to look at the counters and captures and sessions to determine what is causing the issue. 6. Once you have finished testing and capturing. Make sure to turn off the debugs. Thanks

mbutt · ‎07-17-2013

Here is some more relevant information regarding Wild fire https://live.paloaltonetworks.com/docs/DOC-5266 Symptom When a wildfire-upload-skip message is seen in the data filtering logs, all the files do not appear on the WildFire portal. Cause In PAN-OS 5.0, when a file is received by the firewall, a hash is created and checked with the WildFire server. If the hash matches on the WildFire server, the action wildfire-upload-skip is taken. At this point, one of the following occurs based on the categorization of the file: If the file had been previously determined to be malicious, then the report, previously generated when the verdict was made, appears on the WildFire server. If the file was not malicious and was determined to be benign, then the report is not shown on the WildFire server. Thanks

mbutt · ‎07-17-2013

Hi AFN.Paul, I think you should check with you Sales Engineer so he can verify for you if the feature was filed for it and if it is in plans. Thanks

mbutt · ‎07-17-2013

Hi, You can also do the following to see what might be causing the issue 1. Need to setup the filters for the traffic we are interested in. To do this, execute the following steps: Navigate to Monitor--Packet Capture Click 'Manage Filters' Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank ) Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field) 2. Setup up the captures Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop) 3. Enable filters and captures debug dataplane packet-diag set filter on debug dataplane packet-diag set capture on 4. open 2 CLI windows on 1 run the following command to look at the counter ( make sure it run this command once before running the traffic) show counter global filter packet-filter yes delta yes on the 2nd window run the following command to look at he sessions show session all filter source <ip address> destination <ip address> 5. Now run the test for ftp while it is failing to look at the counters and captures and sessions to determine what is causing the issue. 6. Once you have finished testing and capturing. Make sure to turn off the debugs. Hopefully this helps you resolve your issue. Thank you

mbutt · ‎07-12-2013

The severity of the threat can not be changed. However you can change the default behavior whether to drop or allow the traffic. Below doc explains how to create exception on a threat. https://live.paloaltonetworks.com/docs/DOC-3699 Thanks

mbutt · ‎07-11-2013

Hi , Run the following commands on the firewall to see if you see the group and then the users in the group The command will show you list of all the user groups. admin@PA-3050> show user group list + xmlapi List groups from XML API | Pipe through a command <Enter> Finish input Run the following command to see the users in a group admin@PA-3050> show user group name <value> Show group's members Also what version of OS are you on ? Hope this helps. Thanks

mbutt · ‎07-11-2013

Adding to the above comment if you want to clear it for particular interface etc you can use the following command admin@500> clear dhcp lease interface ethternet1/2 > expired-only clear expired leases > ip clear lease for IP address > mac clear lease for mac address (format xx:xx:xx:xx:xx:xx) <Enter> Finish input Hope this helps. Thanks

mbutt · ‎07-11-2013

Below are some good docs on User id agent. https://live.paloaltonetworks.com/docs/DOC-3664 https://live.paloaltonetworks.com/docs/DOC-3120 https://live.paloaltonetworks.com/docs/DOC-1920 https://live.paloaltonetworks.com/docs/DOC-1807 https://live.paloaltonetworks.com/docs/DOC-2013 https://live.paloaltonetworks.com/docs/DOC-2019 Hope this helps. Thanks

mbutt · ‎05-28-2013

Hi , Also if you have GUI access you can just type in the ip address and it will bring up all the rules matching that ip address. For example: Hope this helps. Thank you

mbutt · ‎05-28-2013

Hi, When you are using application override you are create a customer app with a port number defined in it. Moreover you also create an services and select that particular service in that application. Since when app override is created it does not pass through firewalls app engine i think it would be best to either user any or define the service. Hope this helps Thank you

mbutt · ‎05-23-2013

Hi Minh, As far as i know CRL uses wget to retrieve the file. Currently firewall does not support for crl https and you will see this error. If you set it up as http it should work. Please give a try and see if that resolves the issue. If you find out having CRL as https is not working and with http it is working you can request your Local Sales Engineer to file a Feature request on your behalf. Thank you

mbutt · ‎05-22-2013

Hi, The below link explains the reason for application showing as not-applicable https://live.paloaltonetworks.com/docs/DOC-1404 Hope this helps. Thank you

mbutt · ‎05-22-2013

Hi, Below is the link for supported MIBS. https://live.paloaltonetworks.com/docs/DOC-1269 Hope this helps. Thank you

Member Since	‎03-19-2012 02:28 PM
Date Last Visited	‎03-21-2025 02:22 PM
Posts	365
Total Likes Received	206

Online Status	Offline
Date Last Visited	‎03-21-2025 02:22 PM

About mbutt

Re: CLI part 2

Re: How to Configure Dual VPNs with Dual ISPs from a Active Active Cluster to a Remote Site

Re: Avoid scanning threat vulnerabilities

Re: HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0

Re: CLI part 2

Re: How to setup a redundant IP?

Re: Problem with NAT rules

Re: UIA - Not domain user Identification Problem

Re: how to work decryption policy?

Re: Network Monitor does not show specific data.

Re: Difference between apps and contents

Re: Custom App-ID iMessage

Re: Panorama Generating Blank Reports

Re: commands to debug traffic between two host using Palo alto firewall

Re: SNMP monitor parameters for Palo Alto

Steps to Apply Microsoft Patch to Addressed Meltdown and Spectre Vulnerability on Traps Agents

Re: Anyone Blocked a specific file from being downloaded?

Re: Log Type Unknown

Re: VPN user cannot access another network segment

Re: No logs in wildfire log section on device- PAN OS 5.0.3

Re: Logs Retention

Re: FTP Data connection broken, need help

Re: Vulnerability Protection Threat level

Re: LDAP 389 Group Mapping

Re: DHCP server runs out of ip pool interface Error

Re: User-ID Agent Logging

Re: Security Rules using CLI

Re: Using application-default with application override

Re: Please help me about sslmgr error !!!

Re: Application : not-applicable in traffic log what does that mean ?

Re: How to add a PA5050 to OPManager?

Unlock your full community experience!

About mbutt