About mikand

The quickref over at https://live.paloaltonetworks.com/docs/DOC-4254 says: " Monitor Management or Device Server Display management server messages for commit failures, updates, licenses, link status, policy details, etc. show system resources follow tail follow yes mp-log ms.log Display device server message for commit failures, updates, licenses, link status, policy details, etc. tail follow yes mp-log devsrv.log " Unfortently it doesnt tell you the difference between the two, however until someone from PA clears this out you should be able to see some stuff comparing: tail follow yes mp-log with tail follow yes devsrv.log This post however tells you some details of each process: https://live.paloaltonetworks.com/message/16345#16345 ... View more

Thanks! 🙂 ... View more

1) Depends on how you setup your webproxy - if its transparent or non-transparent. When transparent your PAN will use dstip of the server on the Internet and just route its traffic to the proxy as nexthop. Also the request in transparent mode will be "GET / HTTP/1.0" or such. In this case the client does the DNS-resolution aswell to find out which dstip the packets should use. When non-transparent the proxy waits for a CONNECT statement similar to "CONNECT http://www.example.com/ HTTP/1.0" and then its the proxy who will do the DNS-resolution. 2) I have a slight memory that the PA-device at least could handle those "X-Forwarded-For" in its logs - but I dunno if it will map those ip's with userid. When you use this setup its a good thing to make sure your proxy will use "keepsource=yes", this way it doesnt matter if the webproxy is transparent or non-transparent towards the clients - it will be transparent towards the PA-device (since srcip will be kept when using keepsource=yes). Personally I prefer the second design because the PA will then protect the proxy itself from the internet. This way you can use this design: *) Client use proxysetting to use non-transparent proxy. This also brings us that in your internal network you will only see RFC1918 addresses (if you use them). This gives that if a non RFC1918 ip is seen it probably means that the client sending the packets have got a trojan/malware onboard (a trojan/malware that didnt pickup the proxy settings and instead tries to spread or monitor on its own). *) Proxy is setup to non-transparent mode (meaning incomming data has "CONNECT http://www.example.com/ HTTP/1.0" and its the proxy who does the DNS-resolution) along with keepsource=yes so next hop will see the clientip directly in the ip-header. *) PA-device uses userid and can map which user uses which ip either by using PAN-agent or by other userid methods. The PA-device will do the SNAT aswell. This also gives that you can utilize stuff like geoip based rules in your PA if you wish. *) On a DMZ to the PA-device you have your DNS resolvers which the proxy uses to query. ... View more

And this for more info ... View more

The pdf is regarding paloalto updates so it belongs to appid:paloalto-updates ? ... View more

By the way, could this be the problem (just saw it in the release notes for PANOS 5.0.2)? " * 47280, 46424, 45635 – The User-ID agent on a Windows 2008 server was intermittently failing to respond when the directory contained 50,000+ users, causing valid user to IP mapping information to be deleted on the firewall. This occurred when the session limit of the firewall was being reached. Issue was due to a buffer problem that occurred when trying to write the user to IP mapping to the firewall. In order for this fix to work properly, the User-ID agent must be at 5.0.1 or later. " ... View more

If you use BGP towards ISPs its often sufficient to just import a default route from each ISP and use BGP to announce your own ranges to each ISP (similar to your first point). This way you will basically only hold as many routes as you have ISPs/uplinks (except for your own ranges that is). Also you should question yourself if you really need BGP. Its not uncommon that admins use BGP because its "cool" and not that they really need it. In many cases using a static route is safer and will most likely give you far less problem than adding the problems BGP on itself might bring you. ... View more

Contact your PaloAlto support or your PaloAlto Sales Engineer in your region and file this as a bug. Hopefully they will shortly return to you with a workaround (if so, please update this thread) or for that matter inform you in which PANOS this will be fixed. Once this particular PANOS version is released you can upgrade to the new version. PaloAlto could also issue a private update which your devices would see in the list of possible updates in case they want to let you verify that its actually fixed before it hits the public releases. ... View more

How many DC-servers do you have and how many PAN-agents? And are each PAN-agent monitoring several servers at once or is it a 1:1 relation between each DC-server and each PAN-agent-server? Because if you have a 1:1 relation (either running PAN-agent locally on the DC-server and configure it to only follow log from localhost or run PAN-agent on a dedicated server but configure it to only follow one DC-server (the one which is closest to it networkwise)) you will not only lower the WAN-bandwidth of security logs being copied back and forth but also easier to identify which region is faulty. I would also again verify the settings of each PAN-agent service, do you perhaps have some incorrect white/blacklist on one of these servers or so? Or for that matter enabled netbios or WMI lookups (im thinking if one of the PAN-agents isnt allowed to query the clients either by firewalls in your infrastructure or by local firewalls on the clients - or for that matter a MTU-problem)? What about the useraccount which runs the PAN-agent service? ... View more

Nice to have: 1) Create rules based on MachineID as described in https://live.paloaltonetworks.com/thread/6589 ... View more

"default-application" is hardcoded in the application-db. You can however setup your own service-group which contains both TCP80 and TCP8080. A problem with that might be if you in the same rule allow (or deny) more than one application. For example: appid: smtp, ssh service: application-default would mean that smtp would only be allowed on its default-port(s) (TCP25) while ssh would be allowed on its default-port(s) (TCP22). Compared to if you have: appid: smtp, ssh service: test-service (containing TCP25, TCP22) which would allow SMTP on both TCP25 and TCP22 and SSH on both TCP25 and TCP22. A workaround for the above is of course to have one rule for smtp and another one for ssh and if you are not happy with application-default manually specify which port(s) should be allowed for each rule. I think a workaround in your case might be if you create a custom-appid (name it custom-web-browsing or so) which is (in your case) based on "web-browsing" but where you for application-default type both TCP80 and TCP8080. However im not sure if this custom-app will be detected before or after the built-in appid. ... View more

Just guessing here but: 1) ARP-WHOHAS is sent... (unless its reachable through some nexthop because then the 2) below is sent to this nexthop). 2) If someone replies to above (could be some proxyarp or so) an icmp echo request is sent to the mac (unless its routed through some nexthop). 3) If echo reply (or administratively prohibited) is returned the box assumes this ip is already taken. Someone from PA who could confirm? 🙂 The downside would be if you have a personal/desktop firewall who blocks incoming echo requests... ... View more

However you can file this as a feature request through your local sales engineer. I think it could be handy to get a list of various types of messages where you could select "default" or manually override into one of the severity levels available. This way one could "reclassify" so block-url messages are sent as "low" instead of "informational" (or whatever the names are for the severities). ... View more

Oh yeah that sucks 🙂 I think you should file this as a bug report. ... View more