About Sly_Cooper

- Anyways we are getting rid of ASA with PAN so I am not bothered any more . I wanted to simulate it for other environment. Passive PAN in vwire mode will have all its interfaces shut/down. Are you seeing the interfaces UP? Also the traffic will eventually flow from the vwire to reach ASA or gateway so the path monitor will have no data on the passive PAN. Check the output below from passive PAN. There is a possibility that the active PAN will be able to reach the destination ip from the standby ASA (when Active). I did not get time to check about it. I will check with our SE. pan(passive)> show high-availability path-monitoring -------------------------------------------------------------------------------- path monitoring statistics unavailable due to inactive device state total paths monitored :                         1 interval to send ICMP probe packets :           200 ms last N probes to determine path availability :  10 hold time to send probe packets :               60000 ms   (after device becomes active) -------------------------------------------------------------------------------- name/type                        destination     succ/total rtt min/max/avg (ms) -------------------------------------------------------------------------------- ha-monitor-vrouter/virtual-router <dst monitored ip>       N/A         N/A ------------------------------------------------------------------------------- I tested it in production as well as I have running setup with this limitation :smileygrin:. I am going to try next with Juniper firewall which has the option to assign separate management ip address apart from the floating one to an interface. As per support, it is not possible to monitor destination which is one hop away/routed. The L3 interface on PAN will have to be in the same subnet as dst address. ... View more

- Looks like we are in the same boat. The ASA failover does not trigger PA failover. Creating a separate L3 interface for monitoring is what suggested by our SE. Here is what I had tried over the last weekend but did not get satisfactory results due to ASA issues in our environment. - Connect an interface from PAN to LAN switch - Configure interface in L3 mode. I am assuming that PAN trust/inside is connected to a L3 switch having default gateway as ASA - Configure new zone - Configure new virtual router. I preferred to create new as the purpose was to use it purely for HA path monitoring. My PAN anyways configured in vWire mode - Ping destination using src ping on PAN. Please note that somehow I was not able to ping ASA untrust from inside/trust. I am not sure if that is the feature in ASA but I did not have time to work on it. If you know how then please let me know. ASA egress IP is reachable from public - Configure path monitoring with type as "virtual router". Configure destination address and select the virtual router with proper routing - Check path monitoring status from cli # show high-availability path-monitoring pan(active)> show high-availability path-monitoring -------------------------------------------------------------------------------- total paths monitored :                         1 interval to send ICMP probe packets :           200 ms last N probes to determine path availability :  10 hold time to send probe packets :               60000 ms   (after device becomes active) -------------------------------------------------------------------------------- name/type                        destination     succ/total rtt min/max/avg (ms) -------------------------------------------------------------------------------- ha-monitor-vrouter/virtual-router <destination ip>    10/10      0.80/1.04/0.88 -------------------------------------------------------------------------------- My failover scenario worked fine after shutting down the ASA untrust link. I however had issues later when Active PAN become Primary again. I will be trying the same thing with Juniper firewalls again over coming weekend. If you manage to test in the meanwhile then please share the results. ... View more

Can you not click on the actual report and then hit "Run" -> export it to PDF/CSV? I have not seen email option for that. ... View more

I ran into similar situation with conficker spyware. The option is to enable logging on the DNS server to find out the original client. That is usually not possible due to high volume of logs. The other option is to SPAN/mirror your DNS server port and configure TAP on PAN. I have this configuration running in my network and it provides you with the real client ip address. ... View more

- Glad to know that it helped. I hope I will get answer for my questio as well. I am waiting for suggestions from for my testing. Till then I would continue to use your thread ... View more

: L3 interface configuration is what suggested by our SE. The support talked about having src and dst ip in the subnet. That doesn't make any sense when you want to monitor devices beyond connected one. Have you tried this by yourself? Unfortunately I don't have an environment to play with and before touching the production devices, I wanted to make sure that I can plan ready for configuration and testing. I am running 4.x code. Do I need to have a combination of virtual wire and virtual router in the path monitoring config? Can you provide me more details? Here is what my scenario is (apologies @gmparis for hijacking thread). Internet -> Internet router -> public switch -> Untrust firewall -> Untrust PAN -> Trust PAN -> DMZ switch. I can monitor dmz switch and trust interface of firewall using link monitoring and is working fine. I want to monitor the untrust firewall to pub switch connectivity. Here is what I understood. - Connect new interface on PAN to dmz switch - Configure L3 interface with trust side subnet of firewall - Configure path monitoring with newly added interface? How do I add destination ip? I dont see any option to use single interface under path monitoring. ... View more

Device -> High Availability -> Path Monitoring -> Path Group -> Add Virtual Wire has the option to add Source and Destination address. I am also working on similar monitoring where I would like to monitor device beyond connected device. I am still not sure how the routing would though. I have a case open with support with not much progress. ... View more

Thanks - The requirement is simple www.google.com port 80 hits and then apply control based on hits per second (similar to brute force attack signature thresholds). I however like the custom iPad signature. I can definitely use it for something else . Thanks for sharing. ... View more

The test systems are spread across and hence difficult to block *.google.com. Yes we always find the culprit however wanted trying to see if there is any way to get a proactive notification when a certain hit rate threshold reached. ... View more

Here is the use case. We had seen some of the test systems using www.google.com in monitoring test. Over the time or with continuous probes, Google starts doing image verification. We would like to have a way to identify hosts and block. This may be applicable to other sites as well. We just want to make sure that a wrongly configured test system does not cause to block our egress IP and cause issues for all normal users. ... View more

Can you please provide an example of how they look like? Can I get WildFire email notification like alerts in the logs? I forwarded information logs and can see all the files names in the logs. Is that what you are referring by WildFire logs? ... View more

I managed to pass the first hurdle. Pushing user-id/group based policies via Panorama is possible. Under Panorama -> Device Groups -> There is an option called as "Master Device" (refer screenshot below). If you add a device here and if that device has the LDAP, Group Mapping etc. configured then Panorama can pull the user/group information from it. I was able to create an active directory group based policy via Panorama. Now the next pending is, do I need to have Group Mapping created on the individual device where the policy is pushed. ... View more

Sure. I will check with support. Thank you all. ... View more

I am running vwire based setup. When I try the > test security-policy match command, it shows the correct ANY policy. ... View more