About emr_1

emr_1 · ‎12-18-2024

Even I don't see such issue, if I can't find why and who uninstall GP app, I would protect it from uninstallation by password: https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-new-features/new-features-released-in-gp-app/uninstall-option-globalprotect-windows To try to figure out who uninstall GP app, you might able to find any hint from event viewer. FYI: https://www.prajwaldesai.com/find-who-uninstalled-application-from-server/

emr_1 · ‎12-18-2024

From the keyword "pre rules", I guess you are using Panorama, and also you are configuring new security rule directly to PAN device (PA-xxx). If so, you need to configure new rule on panorama, not on PAN device. Here is brief diagram how security rule works when you are using panorama. In addition to above, you can't add/edit/delete rules which are pushed from panorama on PAN device. Hope this helps you.

emr_1 · ‎12-17-2024

Just wondering it is not caused by GP because I can see some post outside the palo alto https://www.google.com/search?q=18.2+mail+problem I would recommend you to narrow down little more.

emr_1 · ‎12-09-2024

If my understanding is correct, you can't create new legacy mode with latest pan-os. If you need lagacy mode environment, I believe you need to prepare very old image with lagacy mode and then keep upgrading it 'til the latest. https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/panorama-overview/panorama-models Legacy mode ( ESXi and vCloud Air only )—In this mode, the Panorama virtual appliance receives and stores firewall logs without using a local Log Collector (see Deploy Panorama Virtual Appliances in Legacy Mode with Local Log Collection). By default, the virtual appliance in Legacy mode has one disk partition for all data. Approximately 11GB of the partition is allocated to log storage. If you need more local log storage, you can add one virtual disk of up to 8TB on ESXi 5.5 and later versions or on vCloud Air. Earlier ESXi versions support one virtual disk of up to 2TB. If you need more than 8TB, you can mount the virtual appliance in Legacy mode to an NFS datastore but only on the ESXi server, not in vCloud Air. This mode is only available if your Panorama virtual appliance is in Legacy mode on upgrade to PAN-OS 10.0. On upgrade to PAN-OS 9.0 and later releases, Legacy mode is no longer available if you change to any other mode. If you change your Panorama virtual appliance from Legacy mode to one of the available modes, you will no longer be able to change back into Legacy mode.

emr_1 · ‎12-08-2024

The answer is "yes, you need subscription". Here is information about it: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-overview/about-globalprotect-licenses section: "Split tunneling based on destination domain, client process, and video streaming application" If you can specify destination by "IP address" instead of "domain", I believe you don't need subscription.

emr_1 · ‎12-04-2024

> configure # delete rulebase security rules "TESTING2" log-setting

emr_1 · ‎12-02-2024

I believe sonicwall is not supported. It's not in this list: https://live.paloaltonetworks.com/t5/expedition-articles/expedition-supported-3rd-party-vendor-matrix/ta-p/336922

emr_1 · ‎11-18-2024

You can customize log format. Even there is no document for recent version, refer to 10.0 is enough to understand. FYI: https://docs.paloaltonetworks.com/resources/cef For each log field, another doc is useful. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions

emr_1 · ‎10-17-2024

Oh,okay...then you don't need this license. Just delete it from CLI First, type in question mark to list all license files on your platform delete license key ? Then type in specific file name delete license key <name> Sample: ==== > delete license key ? GlobalProtect_Gateway_2024_05_31.key 2024/08/01 01:57:21 0.3K Logging_Service_2022_08_09.key 2023/12/19 15:52:21 0.3K PAN_DB_URL_Filtering_2023_05_18.key 2023/12/19 15:52:21 0.3K > delete license key Logging_Service_2022_08_09.key ====

emr_1 · ‎10-17-2024

You mean even you are not purchasing Logging Service, your platform has Logging Service license? If you are surely you are not using Logging Service, you can ignore it. (but you will keep receiving alert everyday) If you are using Logging Service for other service, for example; you have Prisma Access, activated Logging Service license will be applied to all devices under same CSP. You need to check internally. If your devices are under control of ASC (Authorized Support Center), ask them. Possibly ASC mistakenly activate their Logging Service and applies to your devices (same logic as above)

emr_1 · ‎10-17-2024

lcaas is Logging Service. You can check your license via CLI with following command : request license info Here is sample output from my lab > request license info License entry: Feature: Logging Service Description: LAB Serial: xxxxxxxx Authcode: Issued: December 18, 2023 Expires: January 05, 2025 <<< I believe this field should be 2024/10/30 on your platform Expired?: no Log Storage TB: 1 If you already have renewed Logging Service on the cloud, please fetch the latest. CLI is "request license fetch"

emr_1 · ‎10-10-2024

https://security.paloaltonetworks.com/PAN-SA-2024-0010 This is not related to PAN-OS (FW/panorama) https://security.paloaltonetworks.com/CVE-2024-9468 This is related to PAN-OS, however, since your platform is PA-5060 and it reaches end-of-life and last supported platform is 8.1, you can not get any information/update for it. I believe nobody knows the answer. FYI https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates

emr_1 · ‎10-01-2024

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000g1umCAA KB is available here. In addition to above, there is no way to stop your pointed message by configuration. Only way is to downgrade GP agent, though you need to take care of EoL for GP v6.0 https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary

emr_1 · ‎09-10-2024

KB is available now. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000Tp7JCAS Resolution The issue will be addressed in the upcoming releases. As a workaround, use one the following options. Uninstall DLP plugin under GUI: Device > Plugin. Downgrade PAN-OS to 10.2.10 or older.

emr_1 · ‎09-10-2024

At first, this doc is helpful. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api/use-the-cli-to-find-xml-api-syntax Here is my test result 1) Check API syntax admin@PA-5410> debug cli on admin@PA-5410> request sc3 reset (container-tag: sc3 container-tag: reset pop-tag: pop-tag:) ((eol-matched: . #t) (confirmation-message: . WARNING: executing this command will reset SC3 state on this device. You will need to re-onboard the system (using an authkey). Do you want to continue?) (context-inserted-at-end-p: . #f)) WARNING: executing this command will reset SC3 state on this device. You will need to re-onboard the system (using an authkey). Do you want to continue? (y or n) <request cmd="op" cookie="8284738022950153" uid="1001"><operations><request><sc3><reset/></sc3></request></operations></request> 2024-09-11 09:56:19 <response status="success"><msg>SC3 has been reset! You need to restart mgmtsrvr to reinit SC3.</msg></response> SC3 has been reset! You need to restart mgmtsrvr to reinit SC3. admin@PA-5410> admin@PA-5410> debug software restart process management-server (container-tag: sdebuoftware container-tag: restart leaf-tag: process value: management-server pop-tag: pop-tag:) ((eol-matched: . #t) (context-inserted-at-end-p: . #f)) <request cmd="op" cookie="1502434451239817" uid="1001"><operations><debug><software><restart><process>management-server</process></restart></software></debug></operations></request> 2024-09-11 09:53:22 #f admin@PA-5410> 2) Check same command by curl. Looks this worked on my platform (PA-5410 v11.1.4) curl --insecure -X POST "https://<my firewall IP>/api/?type=op&cmd=<request><sc3><reset/></sc3></request>&key=<my api key>" curl --insecure -X POST "https://<my firewall IP>/api/?type=op&cmd=<debug><software><restart><process>management-server</process></restart></software></debug>&key=<my api key>"

Member Since	‎05-10-2010 06:49 PM
Date Last Visited	‎01-09-2025 12:51 AM
Posts	359
Total Likes Received	120

Online Status	Offline
Date Last Visited	‎01-09-2025 12:51 AM

About emr_1

Re: GlobalProtect app being automatically uninstalled as PC moves from one LAN to another LAN

Re: Difference between Rulebase Security Rules and security policy in CLI

Re: compatibility issue between GP and IOS18.2

Re: Panorama moving to LEGACY MODE

Re: GP - Split Tunneling

Re: CLI: setting and unsetting log forwarding

Re: Sonicwall Firewall v6.5.4 migrate to PaloAlto Next Generation Firewall

Re: Minimize log size

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: compatibility issue between GP and IOS18.2

Re: GP - Split Tunneling

Re: The required '11.1.0' base image must be loaded before this image can be loaded

Re: request sc3 reset API

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

Re: TID 95187 is not on my signature list

Re: what does "SWITCH" in hardware architecture mean?

Re: any solution to keep tracking user IP mapping?

Re: any solution to keep tracking user IP mapping?

Re: [need help]can't see new incoming logs after upgrading M-100 into 8.1.12

Nominated Discussion: What does "SWITCH" in hardware architecture mean?

Nominated Discussion: How to Change Forward Decrypt Trust Certificate

Re: GlobalProtect app being automatically uninstalled as PC moves from one LAN to another LAN

Re: Difference between Rulebase Security Rules and security policy in CLI

Re: compatibility issue between GP and IOS18.2

Re: Panorama moving to LEGACY MODE

Re: GP - Split Tunneling

Re: CLI: setting and unsetting log forwarding

Re: Sonicwall Firewall v6.5.4 migrate to PaloAlto Next Generation Firewall

Re: Minimize log size

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: CVE ID

Re: How to disable this warning message, or move it to notifications?

Re: PAN-OS 10.2.11 Device -> Setup page missing

Re: request sc3 reset API

Nebula Beta

Unlock your full community experience!

About emr_1