About mbutt

mbutt · ‎12-17-2012

Hi Ryan, Please see the link below on how to setup Active Active HA. https://live.paloaltonetworks.com/docs/DOC-1756 Hope this helps. Thank you Numan

mbutt · ‎12-13-2012

Hi, Here is the list which shows the current Brighcloud mapping to PAN-DB. https://live.paloaltonetworks.com/docs/DOC-3604 However it doesnt show blue coat categories but you will be able to see Brigh cloud categories. Hopefully this helps. Thank you Numan

mbutt · ‎12-13-2012

Hi, If you are going from 4.0.8 to 4.1.8. The main difference i can think of is that if you are using sslvpn netconnect. It is not available in 4.1.x anymore. It will change the netconnect to global protect automatically. Also if you are going from 4.0.8 to 4.1.8 the steps would be as follows download 4.1.0 down and install 4.1.8 and yes after you install the system will require a reboot. Thanks Numan

mbutt · ‎12-13-2012

Hi, It depends why the firewall has rebooted. You can look in different logs for finding the reason.Good place to start is with the system logs. If you know around what time it happen. you can look at the system logs to see if it shows any event generated during that time. Another place would be to look in the ms.log You can use the following command to look at those less mp-log ms.log Another thing to look for would be the cores on the files. you can use the following command to see if there are any cores on the system show system files. Hopefully this helps. Thank you Numan

mbutt · ‎12-13-2012

Hi, Can you revert it to running config and then make the changes again. Let us know if that helps. Also another things you can try is to put them on a different zone if possible and then try to do the commit and see if that helps. Thank you Numan

mbutt · ‎12-06-2012

Hi , 5.0.1 was released yesterday. If you go to the device-> software tab and do a check now you should see the release 5.0.1. Hopefully this helps. Thank you Numan

mbutt · ‎12-06-2012

Hi Osman, If you do not find Office 365 as an application you can request addition of that app to our database. Here is the link where you can request to add it http://researchcenter.paloaltonetworks.com/tools/ Hopefully, this helps. Thank you Numan

mbutt · ‎12-05-2012

Hi Sarah, Can you please verify if you have Under Network Tab---->Zones -------> enabled user identification is checked where you need to identify the user. Please let us know if this helps. Thankyou Numan

mbutt · ‎12-05-2012

Hi Johan, Please look at the following post https://live.paloaltonetworks.com/message/16282#16282 Let us know if this helps. Thank you Numan

mbutt · ‎12-04-2012

HI SOC, you can find the Visio stencils at the following link https://live.paloaltonetworks.com/docs/DOC-1197 Let us know if this helps Thank you Numan

mbutt · ‎12-04-2012

Hi You can look at the session id from the traffic logs for the session you are interesting in finding the NAT rule for and then go to the CLI and type show session id (session id number) and it will give you an output as below and you can look at the NAT rule that it is hitting. admin@PA-2050> show session id 1 Session 1 c2s flow: source: 192.168.86.205 [L3-Trusted] dst: 4.2.2.2 proto: 17 sport: 60968 dport: 53 state: INIT type: FLOW src user: unknown dst user: unknown s2c flow: source: 4.2.2.2 [L3-Untrusted] dst: 10.30.6.86 proto: 17 sport: 53 dport: 34370 state: INIT type: FLOW src user: unknown dst user: unknown start time : Mon Dec 3 23:28:12 2012 timeout : 30 sec total byte count(c2s) : 158 total byte count(s2c) : 229 layer7 packet count(c2s) : 2 layer7 packet count(s2c) : 1 vsys : vsys1 application : dns rule : rule1 session to be logged at end : True session in session ager : False session synced from HA peer : False address/port translation : source + destination nat-rule : NAT4Trusted2Untrusted(vsys1) layer7 processing : enabled URL filtering enabled : True URL category : any session via syn-cookies : False session terminated on host : False session traverses tunnel : False captive portal session : False ingress interface : ethernet1/6 egress interface : ethernet1/3 session QoS rule : N/A (class 4) DoS rule : L3-Trust2L3-Untrust Please let us know if this helps. Thank you Numan

mbutt · ‎11-12-2012

Hi Matt, Look for the session by using the following commands show session all filter source <ip> <ip> and then look at the session details by using the following commands show session id <value> <1-2147483648> Show specific session information Check if you see both way traffic on that particular session. Also you can do a packet capture from the GUI to look the traffic. Usually if you are getting application as incomplete either it is uni directional traffic or there was not enough traffic for it to determine the application. Also you can see the global counter to check if any traffic is getting dropped. so can setup the filter in the GUI under Monitor------>packet capture. Then on the CLI after enabling the filters run the following command to see what counters are incrementing for the interested traffic. show counter global filter packet-filter yes delta yes Let us know if this helps. Thanks Numan

mbutt · ‎11-12-2012

Hi, Currently the recomended release on 4.1.x is 4.1.8-h3. Thank you Numan

mbutt · ‎10-22-2012

Hi Birdson, Make sure that you have logging enabled on security policies. Also if you want the URL and categories to show up in the user activity make sure to have those profiles added to the security policy and make sure to have them alteast on alert. So it can generate an entry in the logs. Once this is done allow it alteast 15 minutes to accumulate the data and make sure that user produces some traffic. After the 15 minutes try to generate the report and see if you are able to see the data now. The reason is becasue these reports are generated from the database and the system takes the snapshot of the database every 15 minutes. Hopefully this helps. Thank you Numan

mbutt · ‎10-22-2012

Hi, Regardless of A/P or A/A high availability. Both the devices should never be configured to handle the load of more than one device. In case one device goes down the other will have to handle the load of both the devices. The table size will not increase with A/A for a single device. Hopefully this makes things more clear. Please let us know if this helps. Thank you Numan

Member Since	‎03-19-2012 02:28 PM
Date Last Visited	‎04-16-2024 08:37 PM
Posts	365
Total Likes Received	204

Online Status	Offline
Date Last Visited	‎04-16-2024 08:37 PM

About mbutt

Re: CLI part 2

Re: How to Configure Dual VPNs with Dual ISPs from a Active Active Cluster to a Remote Site

Re: Avoid scanning threat vulnerabilities

Re: HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0

Re: CLI part 2

Re: How to setup a redundant IP?

Re: Problem with NAT rules

Re: UIA - Not domain user Identification Problem

Re: how to work decryption policy?

Re: Network Monitor does not show specific data.

Re: Difference between apps and contents

Re: Custom App-ID iMessage

Re: Panorama Generating Blank Reports

Re: commands to debug traffic between two host using Palo alto firewall

Re: SNMP monitor parameters for Palo Alto

Steps to Apply Microsoft Patch to Addressed Meltdown and Spectre Vulnerability on Traps Agents

Re: Active Active Setup PA-500

Re: BrightCloud to BlueCoat Category mapping?

Re: Firmware 4.0.8 to 4.1.8

Re: Which logs to check for firewall auto reboot?

Re: "Interface X has no zone configuration" error when commiting

Re: 46076 ARP issue and 5.0.1

Re: Office 365 App detection

Re: Mapping users with user agent

Re: SSL decryption, which version of SSL is used ?

Re: Visio stencils / icons

Re: How can I see users hitting a certain NAT rule?

Re: issue with uturn nat, please help!

Re: Unable to access PA-500 via GUI/SSH on v4.1.7

Re: Empty Reports, What a I missing?

Re: ARP load sharing

Unlock your full community experience!

About mbutt