About glastra1

glastra1 · ‎01-03-2017

You could create an script use the XML api the get the logs, https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/pan-os-xml-api-request-types/retrieve-logs-api If you have further questions you can use our dev forum, https://live.paloaltonetworks.com/t5/APIs/bd-p/TechnologiesSDKsDiscussions regards, Gerardo.

glastra1 · ‎12-12-2016

Seems that the command is not exposed using the API. It'll be something like /api/?type=op&cmd=<show><system><statistics><session></session></statistics></system></show> That returns an invalid response probably because the CLI command returns information in real time. <response status="error"><msg><line>invalid client cli</line></msg></response> In adittion you can get the same info from ">show session info" /api/?type=op&cmd=<show><session><info></info></session></show> Regards, Gerardo.

glastra1 · ‎12-12-2016

Try using the following example with curl, https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/get-started-with-the-pan-os-xml-api/make-your-first-api-call#51855 Make sure it doesn't include spaces. If that still gives you an error I'd suggest trying generating a new API key with a different username. regards, Gerardo.

glastra1 · ‎11-16-2016

Try removing the "include groups" in group mapping and re-add them again. Probably one of them is no longer fecthed from the LDAP server (deleted). https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Search-Group-Mapping-Include-List-using-Wildcards/ta-p/64716

glastra1 · ‎09-19-2016

Is the traffic passing through the dataplane? If that's the case maybe you're the next document can help you out. https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Policy-behavior-change-application-default/ta-p/75664

glastra1 · ‎08-25-2016

Correct https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/globalprotect-features/disable-direct-access-to-local-networks regards, Gerardo

glastra1 · ‎06-20-2016

First of all the user to IP mapping should be refreshed at user logon. Please make sure that every logon is generating security events on the LDAP servers and the the agent is able to map them, https://live.paloaltonetworks.com/t5/Management-Articles/Security-Event-IDs-from-Active-Directory-Used-with-User-ID-Agent/ta-p/52448 Seems that almost all of your user to ip mapping relies on windows probes which is not ideal, As an alternative method you could enable kerberos SSO in captive portal. https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/authentication/configure-kerberos-single-sign-on.html regards, Gerardo.

glastra1 · ‎05-17-2016

Phase 2 (Each proxy ID) should be negotiated according to the key lifetime, so if in one side it's set to 5 minutes that's normal. You don't usually want to re-ley that often, if you're receiving delete messages the re-keys need to be troubleshooted in the side deleting the SA. If the other side it's also a palo alto a rekey can be triggered if tunnel monitoring is detected as "down", https://live.paloaltonetworks.com/t5/Configuration-Articles/Understanding-behavior-of-PBF-and-Tunnel-monitoring-probes/ta-p/68666 You can check the remaining lifetime for your Phases 2 with the following command, >show vpn flow. Regards, Gerardo.

glastra1 · ‎03-25-2016

googol you can find them in the next link https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/threat-prevention/best-practices-for-securing-your-network-from-layer-4-and-layer-7-evasions#16594 regards, gerardo

glastra1 · ‎03-25-2016

You need to contact your SE to enter in beta programs. Regards, Gerardo.

glastra1 · ‎03-17-2016

Make sure that the connection method configured in the portal is "user-logon" and not on-demand. regards, Gerardo.

glastra1 · ‎03-16-2016

well... I tested it in my FW and it worked in 6.1.10 > tcpdump filter "tcp[tcpflags] & (tcp-syn|tcp-fin) != 0" Press Ctrl-C to stop capturing tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes ^C5 packets captured 10 packets received by filter 0 packets dropped by kernel It captured just sync packets which by default are truncated https://live.paloaltonetworks.com/t5/Management-Articles/Tcpdump-Packet-Capture-Truncated/ta-p/63047 regards, Gerardo

glastra1 · ‎03-14-2016

you can create one policy per each server you're going to monitor. Just make sure to check the option "disable this rule if next hop/monitor is unreachable" (first screenshot in the next kb) https://live.paloaltonetworks.com/t5/Configuration-Articles/Policy-based-forwarding-rule-is-not-applied-when-the-monitoring/ta-p/57444 For the monitor profile attached to the PBF you can select either wait/recover or failover dependiong on your needs, the actions the firewall will take are explained in the admin guide (second column as disabled is goind to be selected in the PBF) https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/policy/pbf Regards, Gerardo.

glastra1 · ‎03-02-2016

Not sure how the client is trying to connect to the sinkhole IP addres if it's receiving an error code in the DNS response instead of the sinkhole IP address (unless the packet capture is missing something). By any chance is the client using an internal DNS server? From RFC 1035 (DNS) the response "no such name" 3 Name Error - Meaningful only for responses from an authoritative name server, this code signifies that the domain name referenced in the query does not exist.

glastra1 · ‎02-16-2016

Have you configured the same zone on both outgoing interfaces? If not the firewall will drop the packets The firewall session's table is based among other things on source and destination zones (not physical interfaces) if the destination zone changed the packets will be dropped (as it broke the ecisting session). There is a Global counter for it but I don't remember it at the top of my head (something lime pkt_flow_zone_change) You can check the global counters and see if the packets are being dropped. Before and after the issue, > show counter global filter delta yes | match drop Regards, Gerardo.

Member Since	‎07-31-2015 01:50 PM
Date Last Visited	‎07-26-2021 10:46 AM
Posts	110
Total Likes Received	22

Online Status	Offline
Date Last Visited	‎07-26-2021 10:46 AM

About glastra1

Checkpoint viewer missing in expedition

Re: Interfaces/zone associations lost after commit

Re: Global connect client connected but no IP address assigned

Re: SSL decryption & not working VPN

Re: VFW interface is down after configuring

Re: DG Articel not working for curl XML FIle update

Re: How to ignore routes learned by OSPF

Re: Local User Database :: Password Change :: VPN Global Protect Client

Re: Can i configure duplicate IP's in seperate interaces in seperate VR on a single VSYS or seperate

Re: How to ignore routes learned by OSPF

Re: API for 'show system statistics session' ?

Re: Interfaces/zone associations lost after commit

Re: SSL decryption & not working VPN

Re: How to ignore routes learned by OSPF

Re: How to ignore routes learned by OSPF

Re: Can't Update Expedition

Info: GlobalProtect VPN with iOS 10.2 and T-Mobile LTE network not working

Re: Can i prevent windows login bruteforce through palo alto?

Re: google not working with chrome update if unknown-udp is blocked

Re: How to Allow File Downloads from a Specific URL

Re: Searching Script For Panorama Traffic Logs

Re: API for 'show system statistics session' ?

Re: Credential errors API from remote Server

Re: ldap cfg LDAP failed to get info from server

Re: Failed to establish SSL connection to Panorama Server

Re: No direct access to local network

Re: Reached max allowble probes

Re: Frequent re-keying of ipsec tunnels

Re: Best practiecs

Re: New release of PANOS

Re: GP Internal Host Detection not Working

Re: tcpdump filters

Re: Multiple PBF probes?

Re: DNS Sinkhole not triggering for known malicious domains

Re: existing session behavior when routing table changes

Seattle Beta - GlobalProtect (ELK)

Seattle Beta

Unlock your full community experience!

About glastra1