About mbutt

Hi, skydrive application has two sub-applications skydrive-probe skydrive-uploading If previously they were just allowing skydrive-probe then they could have not uploaded. They can just allow parent app which is simply skydrive and that should allow them to browse as well as upload. Hopefully this helps. Thank you ... View more

Hi, There can be few reason why  the commit is failing. As mentioned above it is highly possible that the management plane is running high. Running of high CPU can be because of a process (which can be any process user id,  reporting etc) You can run the following command on the device to see if you management is running high show system resources or show system resources follow Here is a sample output admin@> show system resources top - 11:00:16 up 22 days, 18:12,  1 user,  load average: 0.29, 0.08, 0.11 Tasks: 101 total,   2 running,  99 sleeping,   0 stopped,   0 zombie Cpu(s):  2.2%us,  1.4%sy,  1.5%ni, 94.1%id,  0.6%wa,  0.0%hi,  0.1%si,  0.0%st Mem:    995872k total,   915016k used,    80856k free,     4836k buffers Swap:  2212876k total,   863728k used,  1349148k free,   165548k cached   PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND 20344       30  10 47116 7336 4144 S   46  0.7   0:00.24 pan_logdb_index 20345       30  10 26984 4260 1948 R   15  0.4   0:00.08 sdb 19778       30  10  3896 1284 1112 S    4  0.1   0:02.05 genindex.sh 20338       20   0  4468 1028  800 R    4  0.1   0:00.05 top     1       20   0  1836  564  536 S    0  0.1   0:02.48 init     2       20   0     0    0    0 S    0  0.0   0:00.00 kthreadd     3       RT   0     0    0    0 S    0  0.0   0:08.24 migration/0     4       20   0     0    0    0 S    0  0.0   0:00.17 ksoftirqd/0     5       RT   0     0    0    0 S    0  0.0   0:08.23 migration/1     6       20   0     0    0    0 S    0  0.0   0:00.07 ksoftirqd/1     7       20   0     0    0    0 S    0  0.0   1:46.39 events/0     8       20   0     0    0    0 S    0  0.0   0:40.84 events/1     9       20   0     0    0    0 S    0  0.0   0:00.02 khelper    12       20   0     0    0    0 S    0  0.0   0:00.00 async/mgr   112       20   0     0    0    0 S    0  0.0   0:00.00 sync_supers   114       20   0     0    0    0 S    0  0.0   0:00.00 bdi-default   115       20   0     0    0    0 S    0  0.0   0:11.58 kblockd/0   116       20   0     0    0    0 S    0  0.0   0:04.81 kblockd/1   125       20   0     0    0    0 S    0  0.0   0:00.00 ata/0   126       20   0     0    0    0 S    0  0.0   0:00.00 ata/1   127       20   0     0    0    0 S    0  0.0   0:00.00 ata_aux   132       20   0     0    0    0 S    0  0.0   0:00.00 khubd   135       20   0     0    0    0 S    0  0.0   0:00.00 kseriod   156       20   0     0    0    0 S    0  0.0   0:00.00 rpciod/0   157       20   0     0    0    0 S    0  0.0   0:00.00 rpciod/1   172       20   0     0    0    0 S    0  0.0  36:30.13 kswapd0   173       20   0     0    0    0 S    0  0.0   0:00.00 aio/0   174       20   0     0    0    0 S    0  0.0   0:00.00 aio/1   175       20   0     0    0    0 S    0  0.0   0:00.00 nfsiod   732       20   0     0    0    0 S    0  0.0   0:00.04 octeon-ethernet   760       20   0     0    0    0 S    0  0.0   0:00.00 scsi_eh_0   765       20   0     0    0    0 S    0  0.0   0:00.99 mtdblockd   793       20   0     0    0    0 S    0  0.0   0:00.00 usbhid_resumer   833       20   0     0    0    0 S    0  0.0   0:41.97 kjournald   886       16  -4  1996  404  400 S    0  0.0   0:01.23 udevd 1867       20   0     0    0    0 S    0  0.0   0:02.78 kjournald 1868       20   0     0    0    0 S    0  0.0   0:00.00 kjournald 1997       20   0     0    0    0 S    0  0.0   1:23.86 flush-8:0 2060       20   0  2008  620  572 S    0  0.1   0:10.14 syslogd 2063       20   0  1892  332  328 S    0  0.0   0:00.02 klogd 2072       20   0  1872  332  236 S    0  0.0   0:04.56 irqbalance 2080 rpc       20   0  2084  492  488 S    0  0.0   0:00.00 portmap 2098       20   0  2116  652  648 S    0  0.1   0:00.05 rpc.statd 2167       20   0  6868  584  500 S    0  0.1   0:02.87 sshd 2215       20   0  6804  388  384 S    0  0.0   0:00.00 sshd 2224       20   0  3280  620  616 S    0  0.1   0:00.03 xinetd 2243       20   0     0    0    0 S    0  0.0   0:00.00 lockd 2244       20   0     0    0    0 S    0  0.0   2:02.54 nfsd 2245       20   0     0    0    0 S    0  0.0   2:01.79 nfsd 2246       20   0     0    0    0 S    0  0.0   2:10.59 nfsd 2247       20   0     0    0    0 S    0  0.0   2:05.77 nfsd 2248       20   0     0    0    0 S    0  0.0   2:09.80 nfsd 2249       20   0     0    0    0 S    0  0.0   2:03.58 nfsd 2250       20   0     0    0    0 S    0  0.0   2:01.06 nfsd 2251       20   0     0    0    0 S    0  0.0   2:07.07 nfsd 2254       20   0  2488  672  580 S    0  0.1   0:01.55 rpc.mountd 2312        0 -20 65136 4624 1888 S    0  0.5  42:19.94 masterd_core 2315       20   0  1888  456  452 S    0  0.0   0:00.01 agetty 2322        0 -20 27864 1412 1036 S    0  0.1   7:29.42 masterd_manager 2329       15  -5 36656 2008 1216 S    0  0.2 254:45.16 sysd 2331        0 -20 32224 5084 1068 S    0  0.5  69:50.52 masterd_manager 2337       20   0 91984 2988 1676 S    0  0.3   1:53.24 dagger 2338       30  10 40568 3624 1656 S    0  0.4  59:15.43 python 2339       20   0 84284 3664 1644 S    0  0.4   0:39.58 cryptod 2340       20   0  166m 1760 1196 S    0  0.2   2:15.46 sysdagent 2354       20   0  7212  612  608 S    0  0.1   0:00.07 tscat 2357       20   0 71580 1056  928 S    0  0.1   0:09.70 brdagent 2358       20   0 31912 1084  928 S    0  0.1   0:25.94 ehmon 2359       20   0 47496 1036  908 S    0  0.1   0:01.15 chasd 2451       20   0     0    0    0 S    0  0.0   0:11.75 kjournald 2492       20   0  2900  628  572 S    0  0.1   0:03.45 crond 2503       20   0  646m  64m  63m S    0  6.7 150:48.80 useridd 2525       20   0  223m  71m 8864 S    0  7.3  45:02.84 devsrvr 2534       20   0 90584 1980 1520 S    0  0.2   0:16.09 ikemgr 2535       20   0  267m 4532 1832 S    0  0.5   2:28.18 logrcvr 2536       20   0 99744 2272 1520 S    0  0.2   0:05.44 rasmgr 2537       20   0 97720 1144  968 S    0  0.1   0:00.84 keymgr 2538       20   0  247m 2172 1532 S    0  0.2 102:25.79 varrcvr 2539       17  -3 56464 1716 1300 S    0  0.2   0:24.44 ha_agent 2540       20   0  112m 7096 1524 S    0  0.7   0:34.04 satd 2541       20   0  102m 1972 1300 S    0  0.2   0:04.48 sslmgr 2542       20   0 57136 1820 1392 S    0  0.2   0:02.48 dhcpd 2543       20   0 74708 2404 1440 S    0  0.2   0:03.97 dnsproxyd 2544       20   0 74392 1736 1356 S    0  0.2   0:04.19 pppoed 2546       20   0  141m 2708 1832 S    0  0.3   0:14.46 routed 2547       20   0  138m 4704 3540 S    0  0.5   2:16.44 authd 3796       20   0 27260 2100 1316 S    0  0.2   0:23.37 snmpd 5184 nobody    20   0  155m 6052 1552 S    0  0.6   1:49.99 appweb3 5190 nobody    20   0  122m 2208 1672 S    0  0.2   1:07.90 appweb3 16879       20   0  3744 3624 2756 S    0  0.4   0:00.02 ntpd 19653       20   0 21340 2448 2016 S    0  0.2   0:00.16 sshd 19664 admin     20   0 21476 1504 1044 S    0  0.2   0:00.03 sshd 19665 admin     20   0 97744  22m  10m S    0  2.3   0:02.97 cli 19695       20   0  2964  496  412 S    0  0.0   0:00.00 crond 19698       20   0  3720 1116  988 S    0  0.1   0:00.02 genindex_batch. 19702       20   0 33704 5176 3020 S    0  0.5   0:00.28 masterd_batch 20335 admin     20   0  2976  668  564 S    0  0.1   0:00.03 less 20337       20   0  3832 1192 1056 S    0  0.1   0:00.08 sh 20339       20   0  1940  536  464 S    0  0.1   0:00.00 sed 22550       20   0  616m 272m 3492 S    0 28.0  57:29.90 mgmtsrvr 26791 nobody    20   0  201m  24m 4296 S    0  2.5   6:35.70 appweb3 Check and see if these process are running high mgmtsrvr ( if it at 900m and above then it is not good) devsrvr If the above process are high then you might have to restart. Also check if %wa is high. If it is high it will indicate that you have two much logging and you can try to reduce the logging. Hopefully this helps. Thank you ... View more

Hi Jhickey, You can go to the following link. Here you can search the threats ( spyware, vulnerabilities, virues ) by names and there id's. https://threatvault.paloaltonetworks.com/ This should make it easy for you to search for them. Thank you Numan ... View more

Here is a good document on QoS https://live.paloaltonetworks.com/docs/DOC-3439 Also you can look at the following doc as well: https://live.paloaltonetworks.com/docs/DOC-3158 Hopefully this helps. Thank you Numan ... View more

Hi, Can you see if you are getting any cores on the device. You can do show system files from CLI and see if the system cores when commit fails. Also what happens if you revert the changes you made. Does it allow you to commit then. If it does then it is quite possible that the configuration might be incorrrect. Thanks Numan ... View more

Hi, All the sessions in the session tables are synchronized with the exceptions of following: In Active/Passive mode, ICMP sessions are not synchronized between peers. In Active/Active mode, Multicast sessions are not synchronized between peers. https://live.paloaltonetworks.com/docs/DOC-4375 Thank you Numan ... View more

Here is another Link for Dynamic Block Lists and Spamhaus https://live.paloaltonetworks.com/docs/DOC-4146 Hopefully this helps. Thank you Numan ... View more

Hi, Here is a doc that i found which might be helpful in configuring user identification with openLDAP. https://live.paloaltonetworks.com/docs/DOC-3434 Hopefully this helps. Thank you Numan ... View more

Hi, I don't believe currently there is a way to track this through MIBS. But you can for sure look at the currently logged in or previous users in the GUI under Network---->Global Protect -----> Gateway -----> Click on the more user info and that will display the required information The above information can also be retrieved from CLI with following commands admin> show global-protect-gateway previous-user          GlobalProtect Name : internal_gateway (0 users)          Domain User Name       Computer        Client          Private IP      Public IP       ESP     SSL     Login Time      Logout/Expiration TTL       Inactivity TTL          ------ ---------       ---------       ----------      ---------       ---     ---     ----------      ----------------- ---       -------------- admin> show global-protect-gateway current-user          GlobalProtect Name : internal_gateway (0 users)          Domain User Name       Computer        Client          Private IP      Public IP       ESP     SSL     Login Time      Logout/Expiration TTL       Inactivity TTL          ------ ---------       ---------       ----------      ---------       ---     ---     ----------      ----------------- ---       -------------- admin@LAB-123-PA-500> For the second question i think you are asking about the licensed version of global protect. If you have the licensed version of the global protect then you can configure multiple gateways and depending on the locality the client connects to different gateways. In other words GP measures latency from each external gateway configured and connects to the one which is has lowest latency. Also here are some good Tech Notes on Global Protect https://live.paloaltonetworks.com/docs/DOC-2020 https://live.paloaltonetworks.com/docs/DOC-1666 Hopefully this helps. Thank you Numan ... View more

Hi, Here is a good doc on the alarm you mentioned https://live.paloaltonetworks.com/docs/DOC-2437 It also explains when the logs are purged Hope this answers your question. Thank you Numan ... View more

Hi, I tried to search on the information provided but it doesn't seem like firewall does not have any file type which will block GPS exif file. Also there is only one application which is being blocked for such data by the firewall which is FOTKI. Here are the details from the firewall for the application Name:  fotki Description:  Fotki is a digital photo sharing, video sharing and media social network website and web service suite; it is one of the world's largest social networking sites. In many ways, the site appears to be similar to the majority of other popular photo sites which support a number of so-called Web 2.0 features, such as use of Ajax, tagging, RSS feeds, social bookmarking, GPS location information and Exif info display. Additional Information:  Wikipedia  Google  Yahoo! Standard Ports:  tcp/443, tcp/80 Depends on Applications:  web-browsing As mentioned above by akawimandan you can certainly check on the DevCenter if somebody else has already created a custom signature for this and are willing to share it with you. Also you can file a request for a new application for file type. Here is a doc which explains how to request a new application Hopefully this help. Thank you Numan ... View more

Hi Bob, If you are having issue with facetime then you can allow that as an applicaiton instead of using the ports. You can configure the Palo Alto firewall to either allow the traffic based on ports or applications. If it is allowed based on application then it checks the traffic and even if it is on non-standard ports it allows it. If you allow it as an application then firewall will check the traffic and make sure which ever session belongs to facetime is allowed . Here is the application details on face time from the firewall Name:  facetime Description:  FaceTime is a video calling software feature for iPhone 4's phone application, developed by Apple. It is based on numerous open standards: H.264 and AAC - video and audio codecs; SIP - IETF signaling protocol for VoIP; STUN, TURN, and ICE - IETF technologies for traversing firewalls and NAT; RTP and SRTP - IETF standards for delivering real-time and encrypted media streams for VoIP. Additional Information:  FaceTime  Wikipedia  Google  Yahoo! Standard Ports:  tcp/80,443,3478-3497,4080,5223, udp/3478,16384-16387,16393-16402 Depends on Applications:  ichat-av, sip, ssl, stun, web-browsing Another thing to notice here is that facetime has dependent application as well. So if you block those applications before the rule of face time then you might not be able to get the facetime going. Hopefully this helps. Thank you Numan ... View more

Hi BES, When upgrading to a major release in you case from 4.1.8 to 5.0.1 you have to always install the base release of the Major release. So in other words when upgrading from 4.1.8 you first have to download 5.0.0 and then download and install 5.0.1. Hopefully this helps. Thank you Numan ... View more