About Abs

Abs · ‎03-07-2013

Not putting in the next hop enables Proxy ARPing, which then adds an entry for all ARP requests. A.

Abs · ‎03-07-2013

There is an updated version of software 5.0.3 out soon that will address this issue. A.

Abs · ‎03-06-2013

Hi, I just generated two CSRs on Panorama, and I am unable to export them. When I try, I get an errors.txt file that says "Failed to prepare CSR <CertName> for export". I've worked around this by committing the configuration to the devices, and then exporting directly from the firewalls. I'm just wondering why I am unable to do so directly from Panorama? Thanks. A. (Now shamelessly accepting the next 68 friend requests.)

Abs · ‎03-05-2013

Not under the monitor tab, but under the ACC you can click the drop down for the Applications box (1st one) and select based on Applications, High Risk Applications, Categories, Sub Categories, Technology, and Risk. A. (Now shamelessly accepting the next 68 friend requests.)

Abs · ‎03-05-2013

Hi Chuff, The way to do that is exactly as you'd expect. Under Objects > Applications, filter both for general internet and file sharing. Then search for an application called 2ch, which does not fall under this filter. It will not appear. Deselect the filters and search again, and you'll find the application again.If you're looking to search for everything under the networking filter, then just select the networking filter. A. (Now shamelessly accepting the next 69 friend requests.)

Abs · ‎03-05-2013

You may also want to look into external syslogging if you need to revisit the logs after an extended period of time. A. (Now shamelessly accepting the next 72 friend requests.)

Abs · ‎03-05-2013

The benefits of templates can really be seen when moving up to larger deployments. For example, one of my clients has 100+ virtual firewalls that they would like to deploy across their chain. For ease of troubleshooting, I give them all the same internal interface addresses so that I am familiar with each site, no matter which site it is. A. (Now shamelessly accepting the next 72 friend requests.)

Abs · ‎03-05-2013

Hi, In Cisco ACLs, they have the option of adding rules like "access-list OUTSIDE extended permit icmp any any source-quench". Does Palo Alto have a way of distinquishing ICMP message types? I've tried looking in the application library, and ICMP shows up as an App (just like ping does) not nothing about Source-Quench, Time-Exceeded, Unreachable, etc... Any thoughts on how to best duplicate this?

Abs · ‎03-05-2013

Hi, I'm about to install two PA5060s in high availability and I am wondering if you guys have any best practice tips for this kind of install when it comes to UserID and how to add more than one domain to the Agentless install. Alex (Now shamelessly accepting the next 72 friend requests.)

Abs · ‎03-04-2013

So what I am to understand is that I have to type in something like: cn=information systems dept,ou=information systems,ou=users,ou=cec,DC=domain,DC=com into the M-100 and hope that it's right, as opposed to being able to browse the structure tree like I can on the firewall. What if I make a mistake? How am I supposed to have all this information handy? Does this mean that the easiest way is to do it on the firewall and then copy all that information manually to Panorama? I suppose my question still stands....why are they different? Alex Now shamelessly accepting all friend requests, until the first 72.

Abs · ‎03-04-2013

This is the response that I just received from Support: Under template we will have to manually configure LDAP settings and push to the device. It will not self populate. We will need base and bind information handy before configuring. When you push those templates to device, then you will be able to pull group information. Group mapping settings templates are different on Panorama and device by design. While pushing it as a template, you will need to have group information ready. Once you push it to the device, it will appear in same format as device's group mapping setting. You can override the setting and edit it later if you want to. I still don't understand why they removed the handy Available Groups window, and would love an official answer to this. Alex

Abs · ‎03-04-2013

Negate the external network you are trying to reach with your U-turn NAT from the PBF policy. Alex

Abs · ‎03-04-2013

I did. The answer is to click the Logout link on the bottom, and log back in again to clear the session. Opening the management interface in a new browser tab is not sufficient to clear the error. Hope this was helpful. Alex

Abs · ‎03-04-2013

Unfortunately, this is not possible due to VMWare workstation limitations (trust me, I tried so very hard to make this work). There is already a hard limit of 9 interfaces on the VM series of firewalls because that is all that VMWare can handle. The VM100 image has two NICs on it, and one is meant for the management interface, and the other one is assigned to Eth1/1; you could try adding as many interfaces as you'd like to the image, but you are still limited by VMWare's networking options (bridged, NAT, or host-only network). Finally, there is no way to set the Virtual Machine as your gateway, as you are its gateway. I hope that this has thoroughly answered your question. Please mark is as answered so that I may also get mission points. Alex

Abs · ‎03-04-2013

I called support and they told me that the firewall will not push information to Panorama. What are you basing this information on? Alex

Member Since	‎03-20-2012 09:56 AM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	61
Total Likes Received	29

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About Abs

Re: Captive Portal Login Button

If Vwire is transparent, then why do you have to specify which VLANs are allowed through?

Can VWire use aggregate links?

Re: Reason for VSYS

Re: Captive Portal and User Limit

Re: Captive Portal Login Button

Re: VM100 and Custom Reports.

Re: Tunnels killing the management plane

Re: Release Date for 5.0.3

Re: Risk Score in ACC

Re: Public IP not accessible from internal addresses.

Re: PCAP On threats.

Re: User id agent

Re: Cisco IP Any Migration

Re: MAP Widget Multiple Firewalls Panorama

Re: Captive Portal Login Button

Re: What is still missing or needs to be improved in PA Next Generation Firewalls ?

Re: Layer 2 Bridge and ARP Table.

Re: VM100 and Custom Reports.

Unable to Export CSR from Panorama?

Re: Searching for Protocol Categories? general-internet > file-sharing

Re: Searching for Protocol Categories? general-internet > file-sharing

Re: Limitted logging storage with Panorama Virtual Appliance?

Re: Panorama Templates

ICMP Source-Quench?

Best Practices for Agentless UserID in Multiple Domain Environment?

Re: Why is Group Mapping Different in M-100?

Re: Why is Group Mapping Different in M-100?

Re: Public IP not accessible from internal addresses.

Re: Unauthorized Request Panorama.

Re: Set VM-100 as gateway on host.

Re: Why is Group Mapping Different in M-100?

Unlock your full community experience!

About Abs