About mbutt

mbutt · ‎12-13-2012

Hi, If you are going from 4.0.8 to 4.1.8. The main difference i can think of is that if you are using sslvpn netconnect. It is not available in 4.1.x anymore. It will change the netconnect to global protect automatically. Also if you are going from 4.0.8 to 4.1.8 the steps would be as follows download 4.1.0 down and install 4.1.8 and yes after you install the system will require a reboot. Thanks Numan

mbutt · ‎12-13-2012

Hi, It depends why the firewall has rebooted. You can look in different logs for finding the reason.Good place to start is with the system logs. If you know around what time it happen. you can look at the system logs to see if it shows any event generated during that time. Another place would be to look in the ms.log You can use the following command to look at those less mp-log ms.log Another thing to look for would be the cores on the files. you can use the following command to see if there are any cores on the system show system files. Hopefully this helps. Thank you Numan

mbutt · ‎12-13-2012

Hi, Can you revert it to running config and then make the changes again. Let us know if that helps. Also another things you can try is to put them on a different zone if possible and then try to do the commit and see if that helps. Thank you Numan

mbutt · ‎12-06-2012

Hi , 5.0.1 was released yesterday. If you go to the device-> software tab and do a check now you should see the release 5.0.1. Hopefully this helps. Thank you Numan

mbutt · ‎12-06-2012

Hi Osman, If you do not find Office 365 as an application you can request addition of that app to our database. Here is the link where you can request to add it http://researchcenter.paloaltonetworks.com/tools/ Hopefully, this helps. Thank you Numan

mbutt · ‎12-05-2012

Hi Sarah, Can you please verify if you have Under Network Tab---->Zones -------> enabled user identification is checked where you need to identify the user. Please let us know if this helps. Thankyou Numan

mbutt · ‎12-05-2012

Hi Johan, Please look at the following post https://live.paloaltonetworks.com/message/16282#16282 Let us know if this helps. Thank you Numan

mbutt · ‎12-04-2012

HI SOC, you can find the Visio stencils at the following link https://live.paloaltonetworks.com/docs/DOC-1197 Let us know if this helps Thank you Numan

mbutt · ‎12-04-2012

Hi You can look at the session id from the traffic logs for the session you are interesting in finding the NAT rule for and then go to the CLI and type show session id (session id number) and it will give you an output as below and you can look at the NAT rule that it is hitting. admin@PA-2050> show session id 1 Session 1 c2s flow: source: 192.168.86.205 [L3-Trusted] dst: 4.2.2.2 proto: 17 sport: 60968 dport: 53 state: INIT type: FLOW src user: unknown dst user: unknown s2c flow: source: 4.2.2.2 [L3-Untrusted] dst: 10.30.6.86 proto: 17 sport: 53 dport: 34370 state: INIT type: FLOW src user: unknown dst user: unknown start time : Mon Dec 3 23:28:12 2012 timeout : 30 sec total byte count(c2s) : 158 total byte count(s2c) : 229 layer7 packet count(c2s) : 2 layer7 packet count(s2c) : 1 vsys : vsys1 application : dns rule : rule1 session to be logged at end : True session in session ager : False session synced from HA peer : False address/port translation : source + destination nat-rule : NAT4Trusted2Untrusted(vsys1) layer7 processing : enabled URL filtering enabled : True URL category : any session via syn-cookies : False session terminated on host : False session traverses tunnel : False captive portal session : False ingress interface : ethernet1/6 egress interface : ethernet1/3 session QoS rule : N/A (class 4) DoS rule : L3-Trust2L3-Untrust Please let us know if this helps. Thank you Numan

mbutt · ‎11-12-2012

Hi Matt, Look for the session by using the following commands show session all filter source <ip> <ip> and then look at the session details by using the following commands show session id <value> <1-2147483648> Show specific session information Check if you see both way traffic on that particular session. Also you can do a packet capture from the GUI to look the traffic. Usually if you are getting application as incomplete either it is uni directional traffic or there was not enough traffic for it to determine the application. Also you can see the global counter to check if any traffic is getting dropped. so can setup the filter in the GUI under Monitor------>packet capture. Then on the CLI after enabling the filters run the following command to see what counters are incrementing for the interested traffic. show counter global filter packet-filter yes delta yes Let us know if this helps. Thanks Numan

mbutt · ‎11-12-2012

Hi, Currently the recomended release on 4.1.x is 4.1.8-h3. Thank you Numan

mbutt · ‎10-22-2012

Hi Birdson, Make sure that you have logging enabled on security policies. Also if you want the URL and categories to show up in the user activity make sure to have those profiles added to the security policy and make sure to have them alteast on alert. So it can generate an entry in the logs. Once this is done allow it alteast 15 minutes to accumulate the data and make sure that user produces some traffic. After the 15 minutes try to generate the report and see if you are able to see the data now. The reason is becasue these reports are generated from the database and the system takes the snapshot of the database every 15 minutes. Hopefully this helps. Thank you Numan

mbutt · ‎10-22-2012

Hi, Regardless of A/P or A/A high availability. Both the devices should never be configured to handle the load of more than one device. In case one device goes down the other will have to handle the load of both the devices. The table size will not increase with A/A for a single device. Hopefully this makes things more clear. Please let us know if this helps. Thank you Numan

mbutt · ‎10-22-2012

Hi, the ldap profile and filter still need to be configured as usual, the proxy functionality will then piggyback the ldap query over the uid-agent session, egressing out of the uid-agent. This helps in case the ldap server is not reachable directly off the management interface due to routing/acl restrictions. Please let us know if this helps. Thank you Numan

mbutt · ‎10-15-2012

Hi, Do you have to manually go and delete the logs or are the new logs are still being written. If the new logs are still being written that means the logs are being purged. Also as mentioned the logs are purged to keep the log file as close to full as possible. If a partition is set to 100MB, the logs are not purged until the log file is 100% full (100MB+). The usage can be over the quota because the indexing will take up space, but it does not use the purging mechanism as the normal log writes. If the index takes place, but no new logs have come in, the usage can be over the quota (over 100MB for example) until the next log is written. Once the next log is written, the system will purge enough logs and index files to get below the quota. Also if you would like to request a feature to delete logs partially please contact your local SE (Sales Engineer) and he should be able to file an enhancement request for you. Thank you Numan

Member Since	‎03-19-2012 02:28 PM
Date Last Visited	‎03-21-2025 02:22 PM
Posts	365
Total Likes Received	206

Online Status	Offline
Date Last Visited	‎03-21-2025 02:22 PM

About mbutt

Re: CLI part 2

Re: How to Configure Dual VPNs with Dual ISPs from a Active Active Cluster to a Remote Site

Re: Avoid scanning threat vulnerabilities

Re: HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0

Re: CLI part 2

Re: How to setup a redundant IP?

Re: Problem with NAT rules

Re: UIA - Not domain user Identification Problem

Re: how to work decryption policy?

Re: Network Monitor does not show specific data.

Re: Difference between apps and contents

Re: Custom App-ID iMessage

Re: Panorama Generating Blank Reports

Re: commands to debug traffic between two host using Palo alto firewall

Re: SNMP monitor parameters for Palo Alto

Steps to Apply Microsoft Patch to Addressed Meltdown and Spectre Vulnerability on Traps Agents

Re: Firmware 4.0.8 to 4.1.8

Re: Which logs to check for firewall auto reboot?

Re: "Interface X has no zone configuration" error when commiting

Re: 46076 ARP issue and 5.0.1

Re: Office 365 App detection

Re: Mapping users with user agent

Re: SSL decryption, which version of SSL is used ?

Re: Visio stencils / icons

Re: How can I see users hitting a certain NAT rule?

Re: issue with uturn nat, please help!

Re: Unable to access PA-500 via GUI/SSH on v4.1.7

Re: Empty Reports, What a I missing?

Re: ARP load sharing

Re: Ldap Proxy

Re: Traffic log database exceeds alarm threshold

Unlock your full community experience!

About mbutt