About diennea

diennea · ‎06-26-2014

I follow this guide and I create a pkcs12 chained certificate with this command: openssl pkcs12 -export -in [certificate.pem] -inkey [certificate.key] -CAfile [chain.cer] -caname digicert -out [server-chain.p12] -name digicert -chain but when I import my certificate (IMPORTANT: it is a web server certificate) it is not recognized as a CA. I think problem is that my certificate was request for a web server. If I try to install DigiCert CA root certificate it is recognized as a CA but I cannot use it for decryption.

diennea · ‎06-25-2014

Thanks but in case of a Certification Authority like Verisign or Digicert I need to request a new certificate (signed by them) or I need to import a root certificate? Thanks

diennea · ‎06-25-2014

Hi, I have a PA500 (OS 5.0.11) I already configured it for SSL Decryption with a self signed certificate. I need to use a Digicert Certificate. I already have a wildcard certificate with Digicert. Question is: can I use my wildcard certificate for SSL Decryption? How? I try to import my certificate but I cannot use it for SSL Decryption Thanks Regards

diennea · ‎03-27-2013

Other tests: I configure a DHCP server responding on interface 10.168.0.0/16 (VR1) Then I configure DHCP realy from interface 192.168.2.0/24 (VR2) to DHCP Server on VR1 It works! There is some bug that do not correctly routes packet from new virtual routers to default virtual router IP interfaces? Problem concern only firewall interfaces IP addresses and not the entire subnet.

diennea · ‎03-27-2013

admin@Firewall1> show counter global filter packet-filter yes delta yes Global counters: Elapsed time since last sampling: 139.941 seconds name value rate severity category aspect description -------------------------------------------------------------------------------- pkt_recv 191853 1370 info packet pktproc Packets received pkt_sent 27 0 info packet pktproc Packets transmitted pkt_outstanding 27 0 info packet pktproc Outstanding packet to be transmitted pkt_alloc 15 0 info packet resource Packets allocated session_allocated 2 0 info session resource Sessions allocated session_installed 2 0 info session resource Sessions installed flow_rcv_dot1q_tag_err 28 0 drop flow parse Packets dropped: 802.1q tag not configured flow_no_interface 28 0 drop flow parse Packets dropped: invalid interface flow_qos_pkt_enque 5 0 info flow qos Packet enqueued to QoS module flow_host_pkt_rcv 1496 10 info flow mgmt Packets received from control plane flow_host_pkt_xmt 22 0 info flow mgmt Packets transmitted to control plane flow_host_service_allow 7 0 info flow mgmt Device management session allowed appid_proc 2 0 info appid pktproc The number of packets processed by Application identification dfa_sw 2 0 info dfa pktproc The total number of dfa match using software aho_sw 5 0 info aho pktproc The total usage of software for AHO ctd_pkt_slowpath 8 0 info ctd pktproc Packets processed by slowpath -------------------------------------------------------------------------------- Total counters shown: 16 -------------------------------------------------------------------------------- admin@Firewall1> show counter global filter packet-filter yes delta yes Global counters: Elapsed time since last sampling: 8.178 seconds name value rate severity category aspect description -------------------------------------------------------------------------------- pkt_recv 10218 1249 info packet pktproc Packets received pkt_sent 2 0 info packet pktproc Packets transmitted pkt_outstanding 2 0 info packet pktproc Outstanding packet to be transmitted flow_rcv_dot1q_tag_err 1 0 drop flow parse Packets dropped: 802.1q tag not configured flow_no_interface 1 0 drop flow parse Packets dropped: invalid interface flow_host_pkt_rcv 82 10 info flow mgmt Packets received from control plane flow_host_pkt_xmt 2 0 info flow mgmt Packets transmitted to control plane flow_host_service_allow 2 0 info flow mgmt Device management session allowed -------------------------------------------------------------------------------- Total counters shown: 8 --------------------------------------------------------------------------------

diennea · ‎03-26-2013

I capture DHCP packets and I see - DHCP Discover session from 10.168.100.1 to 192.168.2.100 - DHCP Offer Transaction from 192.168.2.100 to 10.168.100.1 Client IP address: 0.0.0.0 (0.0.0.0) Your (client) IP address: 10.168.100.50 (10.168.100.50) Next server IP address: 192.168.2.100 (192.168.2.100) Relay agent IP address: 10.168.100.1 (10.168.100.1) I think problem is routing between VR2 to VR1 Ping tests: Ping from a VR1 host (10.168.100.2) to VR2 host 192.168.2.100 works Ping from a VR1 host (10.168.100.2) to VR2 INTERFACE 192.168.2.1 works Ping from a VR2 host (192.168.2.100) to VR1 host 10.168.100.2 works Ping from a VR2 host (192.168.2.100) to VR1 INTERFACE 10.168.100.1 does not work (but I see in monitor it match an allow rule)

diennea · ‎03-26-2013

Hi, here the result: Global counters: Elapsed time since last sampling: 166.235 seconds name value rate severity category aspect description -------------------------------------------------------------------------------- pkt_sent 6 0 info packet pktproc Packets transmitted pkt_outstanding 6 0 info packet pktproc Outstanding packet to be transmitted session_allocated 1 0 info session resource Sessions allocated session_installed 1 0 info session resource Sessions installed flow_qos_pkt_enque 3 0 info flow qos Packet enqueued to QoS module flow_host_pkt_xmt 3 0 info flow mgmt Packets transmitted to control plane flow_host_service_allow 3 0 info flow mgmt Device management session allowed appid_proc 1 0 info appid pktproc The number of packets processed by Application identification dfa_sw 1 0 info dfa pktproc The total number of dfa match using software aho_sw 3 0 info aho pktproc The total usage of software for AHO ctd_pkt_slowpath 6 0 info ctd pktproc Packets processed by slowpath -------------------------------------------------------------------------------- Total counters shown: 11 --------------------------------------------------------------------------------

diennea · ‎03-26-2013

Upload the chain it works Thanks!

diennea · ‎03-25-2013

Hi, I have a problem with some untrusted issuer. For example Microsoft TechNet site (https://technet.microsoft.com) is blocked from my PA500 with this error: Certificate Error Certificate name: technet.microsoft.com IP Address: 65.52.103.106 Issuer: MSIT Machine Auth CA 2 Status: untrusted Reason: I downloaded MSIT Machine Auth CA 2 certificate from microsoft site ( Microsoft Federation Services Certificate Information Page ) and I import it into my certificate but I receive the same error. Can someone help me? Thanks

diennea · ‎03-21-2013

I forgot to wrote PAN OS version... 5.0.3

diennea · ‎03-21-2013

Hi, I have a PA500 configured with 2 virtual routers In both virtual routers I have some zone, interfaces and networks. For example: VR1 - Zone1: Network Ethernet1/1.1 - Interface Type Layer3 - Tag 1 - IP 10.168.100.1 / 16 - Zone2: Network Ethernet1/1.2 - Interface Type Layer3 - Tag 2 - IP 192.168.50.1 / 24 VR2 - Zone3: Network Ethernet1/2.1 - Interface Type Layer3 - Tag 3 - IP 192.168.1.1 / 24 - Zone4: Network Ethernet1/2.2 - Interface Type Layer3 - Tag 4 - IP 192.168.2.1 / 24 In both virtual routers I configured static routes for internal routing. In VR1 I configured route for 192.168.1.0 / 24 via next VR - VR2 route for 192.168.2.0 / 24 via next VR - VR2 in VR2 I configured route for 10.168.0.0 / 16 via next VR - VR1 route for 192.168.50.0 / 24 via next VR - VR1 I have a DHCP server on Zone4 DHCP Server IP: 192.168.2.100 mask 255.255.255.0 Gateway: 192.168.2.1 If I configure my PA500 as DHCP relay for Ethernet1/2.1 (DHCP server 192.168.2.100) all works fine But when I configure DHCP relay for Ethernet1/1.1 (DHCP server 192.168.2.100) I see packet go correctly to DHCP server but they cannot come back. In monitor I see allowed packets from 10.168.100.1 to 192.168.2.100 - application DHCP Can DHCP realy works in a virtual routers scenario? How? Thanks Regards

diennea · ‎02-25-2013

I have the same problem: PAN OS release 5.0.2 top - 17:59:34 up 3 days, 9:19, 1 user, load average: 7.70, 7.47, 7.32 Tasks: 100 total, 2 running, 98 sleeping, 0 stopped, 0 zombie Cpu(s): 27.1%us, 24.2%sy, 18.8%ni, 27.9%id, 1.8%wa, 0.0%hi, 0.2%si, 0.0%st Mem: 995872k total, 934576k used, 61296k free, 14248k buffers Swap: 2008084k total, 169024k used, 1839060k free, 246348k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2476 20 0 183m 72m 64m S 183 7.4 4347:37 useridd 27445 30 10 62036 21m 4272 R 15 2.3 0:02.21 pan_logdb_index 27453 20 0 4468 1028 800 R 5 0.1 0:00.06 top 1 20 0 1836 556 528 S 0 0.1 0:00.96 init 2 20 0 0 0 0 S 0 0.0 0:00.00 kthreadd 3 RT 0 0 0 0 S 0 0.0 0:01.53 migration/0 4 20 0 0 0 0 S 0 0.0 0:00.07 ksoftirqd/0 5 RT 0 0 0 0 S 0 0.0 0:01.78 migration/1 6 20 0 0 0 0 S 0 0.0 0:00.03 ksoftirqd/1 7 20 0 0 0 0 S 0 0.0 0:13.57 events/0 8 20 0 0 0 0 S 0 0.0 0:13.38 events/1 9 20 0 0 0 0 S 0 0.0 0:00.05 khelper 12 20 0 0 0 0 S 0 0.0 0:00.00 async/mgr 112 20 0 0 0 0 S 0 0.0 0:00.00 sync_supers 114 20 0 0 0 0 S 0 0.0 0:00.00 bdi-default 115 20 0 0 0 0 S 0 0.0 0:02.45 kblockd/0 116 20 0 0 0 0 S 0 0.0 0:01.62 kblockd/1 125 20 0 0 0 0 S 0 0.0 0:00.00 ata/0 126 20 0 0 0 0 S 0 0.0 0:00.00 ata/1 127 20 0 0 0 0 S 0 0.0 0:00.00 ata_aux 132 20 0 0 0 0 S 0 0.0 0:00.00 khubd 135 20 0 0 0 0 S 0 0.0 0:00.00 kseriod 156 20 0 0 0 0 S 0 0.0 0:00.00 rpciod/0 157 20 0 0 0 0 S 0 0.0 0:00.00 rpciod/1 172 20 0 0 0 0 S 0 0.0 11:01.97 kswapd0 173 20 0 0 0 0 S 0 0.0 0:00.00 aio/0 174 20 0 0 0 0 S 0 0.0 0:00.00 aio/1 175 20 0 0 0 0 S 0 0.0 0:00.00 nfsiod 732 20 0 0 0 0 S 0 0.0 0:00.10 octeon-ethernet 760 20 0 0 0 0 S 0 0.0 0:00.00 scsi_eh_0 765 20 0 0 0 0 S 0 0.0 0:00.97 mtdblockd 793 20 0 0 0 0 S 0 0.0 0:00.00 usbhid_resumer 833 20 0 0 0 0 S 0 0.0 0:06.93 kjournald 886 16 -4 1996 440 400 S 0 0.0 0:01.15 udevd 1850 20 0 0 0 0 S 0 0.0 0:00.09 kjournald 1851 20 0 0 0 0 S 0 0.0 0:00.00 kjournald 1963 20 0 0 0 0 S 0 0.0 0:04.59 flush-8:0 2043 20 0 2008 664 576 S 0 0.1 0:00.23 syslogd 2046 20 0 1892 380 328 S 0 0.0 0:00.04 klogd 2055 20 0 1872 332 236 S 0 0.0 0:00.06 irqbalance 2063 rpc 20 0 2084 500 444 S 0 0.1 0:00.00 portmap 2081 20 0 2116 592 588 S 0 0.1 0:00.05 rpc.statd 2150 20 0 6868 668 576 S 0 0.1 0:00.01 sshd 2198 20 0 6804 444 440 S 0 0.0 0:00.00 sshd 2207 20 0 3280 584 580 S 0 0.1 0:00.01 xinetd 2226 20 0 0 0 0 S 0 0.0 0:00.00 lockd 2227 20 0 0 0 0 S 0 0.0 0:19.59 nfsd 2228 20 0 0 0 0 S 0 0.0 0:25.23 nfsd 2229 20 0 0 0 0 S 0 0.0 0:22.94 nfsd 2230 20 0 0 0 0 S 0 0.0 0:25.19 nfsd 2231 20 0 0 0 0 S 0 0.0 0:16.96 nfsd 2232 20 0 0 0 0 S 0 0.0 0:26.38 nfsd 2233 20 0 0 0 0 S 0 0.0 0:23.47 nfsd 2234 20 0 0 0 0 S 0 0.0 0:18.89 nfsd 2237 20 0 2360 684 552 S 0 0.1 0:00.59 rpc.mountd 2295 0 -20 65244 5096 2052 S 0 0.5 7:31.04 masterd_core 2305 0 -20 27864 1568 1172 S 0 0.2 0:46.44 masterd_manager 2312 15 -5 36460 2164 1304 S 0 0.2 46:17.24 sysd 2314 0 -20 32356 5708 1196 S 0 0.6 10:06.28 masterd_manager 2320 20 0 92040 6656 2580 S 0 0.7 0:02.82 dagger 2321 30 10 40568 3832 1772 S 0 0.4 9:21.69 python 2322 20 0 76640 3024 1532 S 0 0.3 0:01.30 cryptod 2323 20 0 166m 2124 1436 S 0 0.2 1:48.61 sysdagent 2339 20 0 7212 1268 1088 S 0 0.1 0:00.07 tscat 2340 20 0 71580 1240 1080 S 0 0.1 0:07.09 brdagent 2341 20 0 31780 1256 1092 S 0 0.1 0:07.41 ehmon 2342 20 0 47496 1236 1088 S 0 0.1 0:00.57 chasd

diennea · ‎02-25-2013

Now I cannot come back to 5.0.1 Here the output on 5.0.2 top - 17:55:29 up 3 days, 9:15, 1 user, load average: 7.23, 7.18, 7.23 Tasks: 100 total, 2 running, 98 sleeping, 0 stopped, 0 zombie Cpu(s): 27.1%us, 24.1%sy, 18.8%ni, 28.0%id, 1.8%wa, 0.0%hi, 0.2%si, 0.0%st Mem: 995872k total, 889880k used, 105992k free, 12516k buffers Swap: 2008084k total, 166616k used, 1841468k free, 210132k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2476 20 0 183m 72m 64m S 187 7.4 4340:44 useridd 26581 30 10 56488 16m 4272 R 5 1.7 0:01.23 pan_logdb_index 26589 20 0 4468 1028 800 R 4 0.1 0:00.05 top 1 20 0 1836 556 528 S 0 0.1 0:00.96 init 2 20 0 0 0 0 S 0 0.0 0:00.00 kthreadd 3 RT 0 0 0 0 S 0 0.0 0:01.53 migration/0 4 20 0 0 0 0 S 0 0.0 0:00.07 ksoftirqd/0 5 RT 0 0 0 0 S 0 0.0 0:01.78 migration/1 6 20 0 0 0 0 S 0 0.0 0:00.03 ksoftirqd/1 7 20 0 0 0 0 S 0 0.0 0:13.57 events/0 8 20 0 0 0 0 S 0 0.0 0:13.36 events/1 9 20 0 0 0 0 S 0 0.0 0:00.05 khelper 12 20 0 0 0 0 S 0 0.0 0:00.00 async/mgr 112 20 0 0 0 0 S 0 0.0 0:00.00 sync_supers 114 20 0 0 0 0 S 0 0.0 0:00.00 bdi-default 115 20 0 0 0 0 S 0 0.0 0:02.45 kblockd/0 116 20 0 0 0 0 S 0 0.0 0:01.62 kblockd/1 125 20 0 0 0 0 S 0 0.0 0:00.00 ata/0 126 20 0 0 0 0 S 0 0.0 0:00.00 ata/1 127 20 0 0 0 0 S 0 0.0 0:00.00 ata_aux 132 20 0 0 0 0 S 0 0.0 0:00.00 khubd 135 20 0 0 0 0 S 0 0.0 0:00.00 kseriod 156 20 0 0 0 0 S 0 0.0 0:00.00 rpciod/0 157 20 0 0 0 0 S 0 0.0 0:00.00 rpciod/1 172 20 0 0 0 0 S 0 0.0 11:01.95 kswapd0 173 20 0 0 0 0 S 0 0.0 0:00.00 aio/0 174 20 0 0 0 0 S 0 0.0 0:00.00 aio/1 175 20 0 0 0 0 S 0 0.0 0:00.00 nfsiod 732 20 0 0 0 0 S 0 0.0 0:00.10 octeon-ethernet 760 20 0 0 0 0 S 0 0.0 0:00.00 scsi_eh_0 765 20 0 0 0 0 S 0 0.0 0:00.97 mtdblockd 793 20 0 0 0 0 S 0 0.0 0:00.00 usbhid_resumer 833 20 0 0 0 0 S 0 0.0 0:06.93 kjournald 886 16 -4 1996 440 400 S 0 0.0 0:01.15 udevd 1850 20 0 0 0 0 S 0 0.0 0:00.09 kjournald 1851 20 0 0 0 0 S 0 0.0 0:00.00 kjournald 1963 20 0 0 0 0 S 0 0.0 0:04.58 flush-8:0 2043 20 0 2008 664 576 S 0 0.1 0:00.23 syslogd 2046 20 0 1892 380 328 S 0 0.0 0:00.04 klogd 2055 20 0 1872 332 236 S 0 0.0 0:00.06 irqbalance 2063 rpc 20 0 2084 500 444 S 0 0.1 0:00.00 portmap 2081 20 0 2116 592 588 S 0 0.1 0:00.05 rpc.statd 2150 20 0 6868 672 576 S 0 0.1 0:00.01 sshd 2198 20 0 6804 444 440 S 0 0.0 0:00.00 sshd 2207 20 0 3280 584 580 S 0 0.1 0:00.01 xinetd 2226 20 0 0 0 0 S 0 0.0 0:00.00 lockd 2227 20 0 0 0 0 S 0 0.0 0:19.59 nfsd 2228 20 0 0 0 0 S 0 0.0 0:25.22 nfsd 2229 20 0 0 0 0 S 0 0.0 0:22.94 nfsd 2230 20 0 0 0 0 S 0 0.0 0:25.19 nfsd 2231 20 0 0 0 0 S 0 0.0 0:16.96 nfsd 2232 20 0 0 0 0 S 0 0.0 0:26.38 nfsd 2233 20 0 0 0 0 S 0 0.0 0:23.46 nfsd 2234 20 0 0 0 0 S 0 0.0 0:18.89 nfsd 2237 20 0 2360 684 552 S 0 0.1 0:00.59 rpc.mountd 2295 0 -20 65244 5100 2052 S 0 0.5 7:30.70 masterd_core 2305 0 -20 27864 1568 1172 S 0 0.2 0:46.41 masterd_manager 2312 15 -5 36716 2172 1304 S 0 0.2 46:15.02 sysd 2314 0 -20 32356 5708 1196 S 0 0.6 10:05.93 masterd_manager 2320 20 0 92040 6696 2580 S 0 0.7 0:02.82 dagger 2321 30 10 40568 3832 1772 S 0 0.4 9:21.27 python 2322 20 0 76640 3040 1528 S 0 0.3 0:01.25 cryptod 2323 20 0 166m 2124 1436 S 0 0.2 1:48.51 sysdagent 2339 20 0 7212 1280 1088 S 0 0.1 0:00.07 tscat 2340 20 0 71580 1240 1080 S 0 0.1 0:07.05 brdagent 2341 20 0 31780 1256 1092 S 0 0.1 0:07.38 ehmon

diennea · ‎02-25-2013

Hi, my PA500 management CPU is 100% PAN OS release 5.0.2 (same problem with 5.0.1) If I reboot the firewall, management CPU usage goes down for some days than raise again to 100%

diennea · ‎11-21-2012

After few hours problem disappear. I don't know why. Thanks

Member Since	‎06-29-2012 04:51 AM
Date Last Visited	‎10-29-2019 05:16 AM
Posts	39
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎10-29-2019 05:16 AM

About diennea

Re: Migration from PA-500 to PA-3020

Re: Migration from PA-500 to PA-3020

Re: Migration from PA-500 to PA-3020

Migration from PA-500 to PA-3020

Problem upgrading GlobalProtect

Re: PA-500 CLI and web interface unbearably slow

Re: high management CPU

Re: Schedule a management restart

Re: Schedule a management restart

Re: Schedule a management restart

Re: high management CPU

Re: Schedule a management restart

Re: Migration from PA-500 to PA-3020

Re: Migration from PA-500 to PA-3020

Re: Decryption certificate

Re: Decryption certificate

Re: Decryption certificate

Decryption certificate

Re: DHCP Relay and virtual routers

Re: DHCP Relay and virtual routers

Re: DHCP Relay and virtual routers

Re: DHCP Relay and virtual routers

Re: SSL Decryption Problem

SSL Decryption Problem

Re: DHCP Relay and virtual routers

DHCP Relay and virtual routers

Re: Mgmt Plane Always high CPU

Re: high management CPU

high management CPU

Re: Firefox Error ssl_error_rx_unexpected_new_session_ticket

Unlock your full community experience!

About diennea