Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About gwesson
About gwesson
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
10-10-2019
441Posts
264Likes
184Solutions
Oct 10, 2019Last Visited
User
Activity
User
Profile
Latest posts by gwesson
| Subject | Views | Posted |
|---|---|---|
| 3185 | 07-02-2019 11:52 AM | |
| 8655 | 07-01-2019 02:22 PM | |
| 4427 | 05-23-2019 12:55 PM | |
| 4431 | 05-23-2019 12:29 PM | |
| 4435 | 05-23-2019 12:00 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 05-02-2013 03:23 PM | |
| 1 | 01-25-2019 11:23 AM | |
| 1 | 10-16-2018 10:11 AM | |
| 1 | 06-09-2014 03:24 PM | |
| 3 | 02-12-2019 06:19 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 2 | |||
| 1 | |||
| 2 |
User Badges
Public Statistics
| Date Registered | 03-27-2012 04:23 PM |
| Date Last Visited | 10-10-2019 02:19 PM |
| Total Messages Posted | 735 |
| Total Likes Received | 264 |
04-26-2019
10:20 AM
> Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct? Yep! It modifies it prior to egress: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKrCAK
... View more
04-25-2019
03:43 PM
1 Kudo
There are a couple options: 1. If you want to set it on a specific type of traffic regardless of security rules, you can add a QoS policy for it to add the DSCP/ToS values. Policies > QoS > Add > DSCP/ToS tab > Add. Name: your choice Type: EF If you don't want just EF, you can select others or even write a custom value (in binary). 2. If you want to base it on specific security policies instead, you can open your security policy for this traffic and add a QoS marking: Policies > Security > your_rule > Actions tab > Other Settings section > QoS Marking. Chose IP DSCP and a new drop-down appears. EF should be there, and should be 101110 in binary.
... View more
04-25-2019
12:09 PM
3 Kudos
It's normal, support will likely direct you to disable the alerts if it bothers you. The evasion detection is prone to false positives because it is a very simple check. I had to dig, but found it from the 7.1 New Features Guide: Setting up this evasion prevention feature enables the firewall to check that the hostname or SNI indicated in an initial HTTP or TLS request corresponds to the destination IP address for the connecting client. The problem is that if the firewall's DNS query for the hostname/SNI happens to get a different address, this signature will trigger even if it is a valid address. Personally, I've disabled the logging for those two signatures by setting them to "allow" instead of alert or higher:
... View more
04-25-2019
11:50 AM
2 Kudos
You will need to create a new rule above the one that blocks China. Just put in that IP you want to allow and tighten down the rest of the parameters you want (zones, users, apps, ports, etc.). Rules do have the option of negating the addresses, but it's all the addresses in the rule, so you cannot have a single IP negated while leaving China non-negated.
... View more
04-25-2019
11:44 AM
You'll need to acknowledge the alarm before it will clear, as long as whatever caused it is no longer present. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/web-interface-basics/alarms.html In your GUI, there should be an icon at the bottom. Click that, select the log(s) you want to acknowledge and then they should go away. That should also clear the LED on the chassis as well.
... View more
04-24-2019
01:31 PM
1 Kudo
Yep. When the first packet (a SYN for a TCP connection) is assigned a session ID it moves from INIT to Opening then almost immediately to Active. You would be lucky to get a "show session id" output that has any of the transient states, they're super fast. Microseconds fast.
... View more
04-24-2019
01:27 PM
A couple things you may be able to test to see what's going on: 1. Dump the fib table. It won't help for your PBF rule, but since your VR has a static route it should show that correctly: > show routing route 2. Test the routing to see what the firewall thinks the correct route should be: > test routing fib-lookup virtual-router your_vr_name ip 2a00:1450:4001... The virtual router will always take a more specific route, so make sure your eth1/1 route doesn't have a more specific IPv6 route that is overriding your static route. It may also be helpful to see what your static route and PBF policy does (if you can sanitize it for public consumption here in the forums).
... View more
04-24-2019
01:19 PM
1 Kudo
Init means it's not an active session. Full breakdown here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk9CAC Short answer: when a session ends, the session state retuns to INIT. You can still see the most recent session details that used that particular session ID until new traffic allocates that ID.
... View more
04-22-2019
02:25 PM
1 Kudo
Officially, no support for Windows Server 2019 yet: https://docs.paloaltonetworks.com/compatibility-matrix/user-id-agent/where-can-i-install-the-user-id-agent.html The 9.0 agent will work fine with PAN-OS 8.0.16, you don't need to be running the same major/minor version. It's fairly uncommon though, so take that with a grain of salt.
... View more
04-18-2019
12:01 PM
1 Kudo
The continue page is a category-based timer. Once the user hits the continue button, they can browse to that category without getting the continue page again for 15 minutes (I think). Could the traffic you're seeing be in that window of time? You can use the URL response pages, including continue, without a full blown decryption environment, but it is still technically decrypting: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFKCA0
... View more
04-16-2019
03:42 PM
You just plug it in and it boots. Since yours is stuck on an error when you try, there's literally nothing more you can do. You also won't be able to get support on it, you can't run traffic through it, and you can't get the dynamic updates (apps, threats, etc.). AWS is something like $1/hour if you just want to play with a firewall. But that 2020 is really just e-waste at this point.
... View more
04-16-2019
03:34 PM
Unfortunately, there's nothing useful you can do with that device. The PA-2000 series is End of Sale as of 2015, and will be End of Life in about a year. Because of that EoS status, you won't be able to purchase a support contract or get any licenses for it. The Secondary Market Policy has the details. Your best bet for on-the-cheap learning is a cloud license (AWS, Azure, etc.), a lab license on a VM (talk to your account team), or a PA-220.
... View more
04-12-2019
02:29 PM
1 Kudo
If the sessions have already started when you set your capture filter, it will not output anything. In addition to the 'clear filter-marked-sessions' command you tried, you may also want to clear the active sessions (assuming an interruption to those is ok): > clear session all filter source 192.168.180.210 You can also check to see if your filters are matching before you actually attempt to capture by running a delta against the counters using that filter: > show counter global filter packet-filter yes delta yes The first time you run the command you'll probably get a big output, but each subsequent time you run it the output will just be a delta between the last time you ran it. If you're seeing packet numbers increment, you can start the capture and should see the same number of packets there.
... View more
04-12-2019
02:24 PM
Routing is the most common issue I see for this symptom. Are you doing source-NAT for your GlobalProtect clients? Recall that the gateway config on the firewall defines the source IP pools for your clients, and assigns them based on that. If you are not doing NAT, then you'll just need to ensure that the networks you're trying to reach understand that they have to send the replies back to the firewall. If there's a more general/broad route on those networks' gateways, you'll need to use a more specific route for your GP clients source pool.
... View more
04-10-2019
03:27 PM
In all three scenarios, you're still using a single download. There are bottlenecks that can be associated with a single session (and even more when it comes to IPSec). Things like encapsulation/decapsulation and how it is split across multiple cores, and a whole host of things. The datasheet numbers are for scale, not for individual downloads from a single client. I don't want to come across as harsh, I just can't think of a better way to say it. A single download is VASTLY different than real clients connecting and doing regular work. If you insist on using this type of flawed testing, at the very least try doing several downloads at the same time from different sites on that test client at site B. At least then you'll be using multiple sessions to fill the tunnel better.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-10-2019
02:19 PM
|
Likes Given To
Likes From
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
