About MMCiobanu

I have the same problem and tried "set shared ssl-decrypt ssl-exclude-cert "*.dropbox.com" "; but, I am still having the issue. It is intermittent, it works fine for most of the time, but once in a while I get the red X and the "Can't establish a secure connection" error. ... View more

hello, PAN requested we try to replicate the issue yesterday evening; the guy did apply this command - set system setting packet-path-test enable no - on the node that had issues before and restarted (he did not require restarting both  nodes). The issue did not re-occur, but, this still does not guarantee is not going to in the future. I don't quite know what this command does, but it looks like you apply it before the reboot, and once the node is up, it is cleared. Because we were not able to replicate, it is not considered as a solved issue; we are required to call PAN if happening again, so they can collect more information. Also, yes, I agree, this is the bug we are hitting - BUG-50153, even after upgrading to 6.0.3; we are not going to upgrade to 6.0.4. Thank you ... View more

If I understand correctly, the messages will be sent to the user-ID agent running on domain controllers? How would this work in an environment where there are about 50 User-ID agents installed, 3 collectors and 1 RADIUS server? Will the script send the information to all user-id agents? I am thinking that sending from the RADIUS logs directly to the firewalls would be a better solution in this case? I don't know if this is possible? Does anybody else have a similar situation? ... View more

this is probably what happens; I chose smaller time frames, like in this filter - ( user.src eq 'domain\username' ) and ((time_generated geq '2014/06/02 00:00:00') and (time_generated leq '2014/06/30 23:45:00')), and it works. Thank you. ... View more

hi Steven Puluka That's right, traffic is still passing through the secondary node as it became primary, actually it became the only node functional. There was not a network outage. we got the failed node back in the HA by restarting the dataplane on it: "request restart dataplane". This made it re-join the cluster as the passive node. Now, waiting for PaloAlto to come back with some kind of resolution. ... View more

This happened again after a few months now since we have upgraded; It happened after a reboot - secondary device was booted first, then primary, then secondary again. After every reboot, I have waited a few minutes and made sure HA was fine; however, in the morning the secondary device became the primary and displaying (Dataplane down: path monitor failure), and the primary became non functional. After restarting the dataplane on the non functional device, it came back as passive. From the logs it shows that it kept restarting the dataplane for a few hours. We have contacted PaloAlto support again and they are trying to figure out what causes these issues after the restart. ... View more

Thank you; voting as well. ... View more

Thank you; on it, as well. ... View more

PaloAlto still investigating, this is the response: "From the analysis of the collected the dataplane restart happened initially at 17:02 on 06/15 where an internal path monitoring failure detected . The internal path monitoring failure occurs when internal monitor packets between the daemons in the firewall are not ACKed timely. When the packets are not ACKed, the firewalls assumes some daemon is down and triggers a dataplane restart. 2014/06/15 16:56:45 high ha state-c 0 HA Group 30: Moved from state Passive to state Active 2014/06/15 17:02:39 high general general 0 9: path_monitor HB failures seen, triggering HA DP down 2014/06/15 17:02:39 critical ha datapla 0 HA Group 30: Dataplane is down: path monitor failure 2014/06/15 17:02:39 critical ha state-c 0 HA Group 30: Moved from state Active to state Non-Functional 2014/06/15 17:02:53 high general general 0 flow_mgmt: exiting because missed too many heartbeats 2014/06/15 17:03:17 critical general general 0 Internal packet path monitoring failure, restarting dataplane Device became active after the restart of dataplane and again detected the internal path monitoring failure and triggered the data-plane restart . This time dataplane didn't restart and was down causing the device to be in non-functional state until you rebooted the device next day 2014/06/15 17:07:30 info ha state-c 0 HA Group 30: Moved from state Initial to state Passive 2014/06/15 17:09:42 high ha state-c 0 HA Group 30: Moved from state Passive to state Active 2014/06/15 17:33:46 high general general 0 9: path_monitor HB failures seen, triggering HA DP down 2014/06/15 17:33:46 critical ha datapla 0 HA Group 30: Dataplane is down: path monitor failure 2014/06/15 17:33:46 critical ha state-c 0 HA Group 30: Moved from state Active to state Non-Functional 2014/06/15 17:34:25 critical general general 0 Internal packet path monitoring failure, restarting dataplane 014/06/15 22:24:45 high general general 0 flow_mgmt: exiting because missed too many heartbeats 2014/06/15 22:25:05 critical general general 0 Internal packet path monitoring failure, restarting dataplane The DP1 CPU was under high load for that moment right before the dataplane restart and did see some software buffer depletion which could have triggered the internal path failure. " They opened a bug with development team to validate the findings and analyze the crash files and logs further. And they want us to call them if this happens again, so they can do a live debug. ... View more

we have upgraded to 6.0.3, still not able to monitor the AGG and subinterfaces ... View more

No update from the PaloAlto support team; but, as I said, we solved the issue after rebooting the broken unit. We still don't know what caused the issue in the first place. ... View more

Hi hopcio, We did not have the error you had; our device went into "non-functional" mode. We had a case open, and sent the tech-support file, but we did not hear back by the end of the day and decided to schedule a reboot of the broken unit, while the second one was still Active and passing traffic. The reboot fixed the issue, so far. But, still don't know what caused it in the first place. I will post an update once hearing back from support. ... View more

Upgrading from 5.0.8 to 6.0.2 was an adventure for us; we have upgraded the Panorama, then the 5020s and 3020s, but once the upgrade was done, we started encountering an issue where the devices in Panorama Device Group showed as Out of Sync; committing the configuration would fail to all of them with an error regarding two custom applications we created and spyware identification option, which would classify the applications as invalid. We moved to 6.0.3 as there seemed to be a fix (issue 63608); however, even after upgrading to 6.0.3, we had to remove the two custom applications from the Application Override and security policies on each individual device (HA peers would not sync the configs neither), then delete the custom applications from Panorama, then successfully commit the changes to the device group. When we thought we were done with the issues, we are now trying to solve one on the 5020s, where the secondary device becomes the Active one, and the primary is not the passive but it displays this error:   We are not reverting back to 5.0 because there were features that we really looked forward to having (netflow stats, AGG interfaces monitored in SolarWinds), but trying to solve this one issue (so far). ... View more