About ericgearhart

ericgearhart · ‎07-25-2013

We have a PA4020 that serves as a "canary in the mine" so to speak if you will... we have it only in tap mode, and we feed it various network taps at various points in our network. Well, having this "canary in the mine" just paid off. I upgraded this box from 5.0.5 to 5.0.6 and we started seeing dataplane restarts every few hours. At support's request and after they'd looked at some core files and tech support dumps, I moved the URL database from BrightCloud to PANDB. After doing so the dataplane literally does not stay up long enough to even boot... the box crapped its pants and booted into maintenance mode on its own. I downgraded back to 5.0.5 in maintenance mode (made no other changes), and the problem went away again. Is anyone else seeing this on 5.0.6? If anything else, this should serve as a warning...

ericgearhart · ‎07-25-2013

A_Gardner: if the PA is correctly identifying App-IDs, then maybe mikand's drawing needs an addition on the right. It's not normal to have a proxy server hanging directly off the Internet, so it would make sense that the proxy is "behind" the PA before going out to the Internet. If what's really happening is this: Client <--> PA <-->Proxy <--> PA (a separate zone possibly that the proxy sits in, on separate interfaces?) <--> Internet ... then the PA seeing actual App-IDs makes sense.

ericgearhart · ‎07-25-2013

Wait a second here... I'm not aware of the ability for the PAs to act as an explicit proxy. What you're saying is that I can take Internet Explorer, go into connection settings and point the browser's proxy settings at my PA device IP with some proxy port (8080 let's just say). I'm not aware of that being the case... PA can do VWire and be an inline web filtering appliances, and PA can route as a firewall and do web filtering, but I'm not aware of a case where you can explicitly define the PA as a proxy server.

ericgearhart · ‎07-24-2013

- I haven't experienced I/O problems with VM mis-alignment with Panorama, I was just providing some background on what the original poster was referring to, just to try help clarify.

ericgearhart · ‎07-24-2013

Well and PA themselves call it PANOS too... they released a "PANOS CLI guide" for Panorama 5.1 when it came out.... not a "Panorama CLI Guide." The support ticket interface has an entry for PANOS 5.1 and PANOS-5.1.1 in the little OS release" dropdown too. So it's completely correct to call the thing PANOS in my humble opinion.

ericgearhart · ‎07-22-2013

Good to hear it's working. Can you please mark this question as answered?

ericgearhart · ‎07-19-2013

Upgrading to 4.1.13 or 5.0.5 will solve the issue... it was an implementation issue in the way that PA's DHCP server was implemented. The PA wasn't responding with a NACK when a DCHP client requested an IP outside of the PA's IP pool (a "SHOULD" implementation detail as defined per the DHCP RFC), so the client was timing out, which was causing the delay. FYI we went to 4.1.13 on our internal firewalls and the issue has gone away.

ericgearhart · ‎07-18-2013

Vince: support's looking at a 'show tech support' file, I was just curious if anyone else had experienced this themselves after moving to 5.0.6

ericgearhart · ‎07-18-2013

As said, there are denies in that log you posted. You probably want to resolve letting traffic over the tunnel zone first. Your config looks ok from the screenshots you're posting... this was a very straightforward process when I went to set up a PA-PA tunnel.

ericgearhart · ‎07-18-2013

Do you have a catch all NAT policy configured on your PA? If you do, you need to set up a noNAT for the traffic you're trying to send over the tunnel. That's usually the culprit when I can't figure out why a tunnel isn't seeing interesting traffic and coming up

ericgearhart · ‎07-18-2013

We upgraded our PA 4020 to PANOS 5.06 (thankfully it's only in tap mode, no traffic is running through it). Our PA 4020 is kind of our "canary in the mine" so to speak when it comes to upgrades, and maybe having that implementation is proving itself out right now. Anyway, has anyone see dataplane CPU spikes on 5.0.6? See the nice little spikes on the far right. By the way, the dips in the graph are dataplane restarts... they always seem to happen around 12am to 3am...

ericgearhart · ‎07-18-2013

The static route is the thing that's needed as said. Also I would suggesting building a tunnel monitoring profile on both sides... I have Palo Alto to Palo Alto IPSec tunnels in production, and I noticed that the tunnels wouldn't come back up if I rebooted one side of the tunnel without tunnel monitoring in place (which kind of makes sense.. the IPSec SA was never being torn down on one side, I had to clear it manually to get the tunnel back up). I will say that my PA to PA tunnels have been rock solid though, after that one little gotcha.

ericgearhart · ‎07-17-2013

We actually haven't implemented firewalls on both sides of Riverbed appliances yet, so unfortunately I don't have any experiences to share. We have plans in the works to implement PA, but the actual implementation is about a month out. The most I had received from support was as it is above, basically "PA won't muck with option 76 traffic." So in theory the Riverbeds should see each other and work as normal (at least in theory). Sorry!

ericgearhart · ‎07-17-2013

We've been on 4.1.13 on a pair of 5020s we have for a week, and it's been solid so far.

ericgearhart · ‎07-17-2013

Basically what you're looking for is something like the way you can inject an X-Forwarded-For header into an HTTP data stream from the PA (really you'd want "X-Forwarded-By"). I only know of ways to do this with proxies... I'm not aware of a way to do it with PA with their current feature set. PA can PARSE X-Forwarded-For, but I don't see a way where the firewall itself can inject it.

Member Since	‎04-26-2012 04:24 PM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	411
Total Likes Received	154

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About ericgearhart

Re: Intial Setup Help

Re: Intial Setup Help

Re: Intial Setup Help

Re: THREAT ALERT : high : 169.254.254.238 -> 169.254.255.255 Microsoft Windows NAT Helper DNS Query Denial of Service(31339) alert

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

PANOS 7.0 timeline?

Re: Assistance: my palo is not accessible.

Re: Havex Malware

Re: PANOS 6 and PA2000 series

Re: IPSEC with Cisco ASA

Is there a possibility of Palo Alto releasing rule content, similar to the way Sourcefire/Snort handle IDS rules?

Re: Cacti - Templates

Re: Ubuntu and PA-200 DHCP

Re: Why do "incomplete" sessions show as "allowed"

Re: Intial Setup Help

Re: Intial Setup Help

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

Re: Assistance: my palo is not accessible.

Re: Havex Malware

Upgraded our tap mode only PA 4020 from 5.0.5 to 5.0.6 and it "cratered"... we get dataplane restarts every 10 minutes. Anybody else seeing this?

Re: User-ID via NTLM and a BC explicit proxy

Re: PAN as an explicit proxy?

Re: Panorama VM is misaligned.

Re: Qualys Scan alert on OpenSSH J-Pake

Re: Tunnel between PaloAlto and PaloAlto

Re: DHCP Server Delay

Re: PA 4020 and PANOS 5.0.6 dataplane CPU spikes: anyone else seeing this?

Re: Tunnel between PaloAlto and PaloAlto

Re: Tunnel between PaloAlto and PaloAlto

PA 4020 and PANOS 5.0.6 dataplane CPU spikes: anyone else seeing this?

Re: Tunnel between PaloAlto and PaloAlto

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

Re: 4.1.13 stable?

Re: Insert data in http stream?

Unlock your full community experience!

About ericgearhart