About emr_1

emr_1 · ‎05-20-2024

I would recommend not use "severity drop" on your command. Here is one example, as described, there are some counter which is warning with packet drops ==== > show counter global name tcp_drop_out_of_wnd Name: tcp_drop_out_of_wnd Value: 0 Severity: Warning Category: tcp Aspect: resource Description: out-of-window packets dropped ====

emr_1 · ‎05-20-2024

The answer for both questions is yes. I'll attach the evidence log that shows combination of 10.1.11-h4 and 11.1.2-h1 (keeps active and passive state) as below. For downgrade, skip works between 11.1 and 10.1.3. For more details see url below. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/downgrade-pan-os/downgrade-a-firewall-to-a-previous-feature-release admin@PA-440-1(active)> show high-availability all Group 10: Mode: Active-Passive Local Information: Version: 1 Mode: Active-Passive State: active (last 19 minutes) Device Information: Model: PA-440 Management IPv4 Address: 192.168.113.5/20 Management IPv6 Address: Jumbo-Frames disabled; MTU 1500 HA1 Control Links Joint Configuration: Link Monitor Interval: 3000 ms Encryption Enabled: no HA1 Control Link Information: IP Address: 192.168.113.5/20; Gateway: 192.168.127.254 MAC Address: 8c:36:7a:00:f8:ec Interface: management Link State: Up; Setting: 1Gb/s-full Key Imported : no Election Option Information: Priority: 100 Preemptive: no Promotion Hold Interval: 2000 ms Hello Message Interval: 8000 ms Heartbeat Ping Interval: 2000 ms Max # of Flaps: 3 Preemption Hold Interval: 1 min Monitor Fail Hold Up Interval: 0 ms Addon Master Hold Up Interval: 500 ms Active-Passive Mode: Passive Link State: shutdown Monitor Fail Hold Down Interval: 1 min Version Information: Build Release: 10.1.11-h4 URL Database: 20240520.20121 Application Content: 8850-8748 IOT Content: 128-502 Anti-Virus: 4823-5341 Threat Content: 8850-8748 VPN Client Software: Not Installed Global Protect Client Software: 6.2.2 Plugin Information: DLP: 1.0.8 Version Compatibility: Software Version: Mismatch Application Content Compatibility: Match IOT Content Compatibility: Match Anti-Virus Compatibility: Match Threat Content Compatibility: Match VPN Client Software Compatibility: Match Global Protect Client Software Compatibility: Match Plugin Information: DLP: Compat Match State Synchronization: User-disabled Peer Information: Connection status: up Version: 1 Mode: Active-Passive State: passive (last 37 seconds) Last suspended state reason: User requested Device Information: Model: PA-440 Management IPv4 Address: 192.168.113.6/20 Management IPv6 Address: Jumbo-Frames disabled; MTU 1500 HA1 Control Link Information: IP Address: 192.168.113.6 MAC Address: 8c:36:7a:00:f8:ce Connection up; Primary HA1 link Election Option Information: Priority: 101 Preemptive: no Version Information: Build Release: 11.1.2-h1 URL Database: 0000.00.00.000 Application Content: 8850-8748 IOT Content: 128-502 Anti-Virus: 4823-5341 Threat Content: 8850-8748 VPN Client Software: Not Installed Global Protect Client Software: 6.2.2 Plugin Information: DLP: 5.0.1 Initial Monitor Hold inactive; Allow Network/Links to Settle: Link and path monitoring failures honored Link Monitoring Information: Enabled: yes Failure condition: any No link monitoring groups Path Monitoring Information: Enabled: yes Failure condition: any Virtual-Wire Groups: No Virtual-Wire path monitoring groups VLAN Groups: No VLAN path monitoring groups Virtual-Router Groups: No Virtual-Router path monitoring groups Configuration Synchronization: Enabled: yes Running Configuration: not synchronized Out-of-sync Reason: Version mismatch admin@PA-440-1(active)>

emr_1 · ‎05-20-2024

I described to upgrade by each minor version like 9.1->10.0->10.1 as "legacy" https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path

emr_1 · ‎04-12-2024

Even I don't know this is cosmetic issue or not, I could find the way to show TID 95187. Try following: 1. create sample profile from CLI. sample command is as below # set profiles vulnerability "sampleconfig" threat-exception 95187 action reset-both 2. go back to your GUI. you can reuse "sampleconfig" profile or delete it if you don't need, then edit your existing profile with TID 95187 Even I could configure it, I still curious this protect my GP Gateway (hope this is cosmetic issue)

emr_1 · ‎04-12-2024

Hi, The question is related to following vulnerability: https://security.paloaltonetworks.com/CVE-2024-3400 In this it said "Recommended Mitigation: Customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 95187 (introduced in Applications and Threats content version 8833-8682)." However, when I update content signature to the latest ( which is 8833-8682 ), and then try to create new vulnerability profile with specifying 95187 only, it does not shows me 95187. With ID range, the result is as below I'm sure there is ID 95187 because I can check via CLI. admin@PA-410> show system info | match app-version app-version: 8833-8682 admin@PA-410> show threat id 95187 This signature detects malicious payload in HTTPS request. critical Unknown https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention admin@PA-410> NOTE: I can replicate this condition with other platforms too. How can I create this vulnerability profile for mitigation?

emr_1 · ‎04-03-2024

The thing only I know is that 8.4 is planning to be released on the week of April 15. Even I don't know about 8.3.1, I guess it was planning to be released in late March and slide to behind in some reason.

emr_1 · ‎03-29-2024

Hmm...for me, sequence is as below 1. make successful login to CSP and/or LiveCommunity 2. open new tab on my Chrome and access to top page of panopto 3. select Partner on next page 4. browser automatically redirect to somewhere, auth in background (I believe processing SAML), and afterward top page is displayed. I don't see anything like your page. Even I'm not sure this is correct way, how about open a admin ticket?

emr_1 · ‎03-29-2024

I am member of partner and I can access to it. How about top page of panopto? https://paloaltonetworks.hosted.panopto.com/Panopto/Pages/Home.aspx

emr_1 · ‎03-18-2024

How about cache? FYI:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPeYCAW

emr_1 · ‎03-17-2024

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008XKOCA2 FYI : The new KB posted which related to this issue.

emr_1 · ‎03-13-2024

@kiwi Thanks for reply, but I couldn't get well. (I understand about 3rd party component policy) I copy&paste sample screenshot as below. We generally does not call the transceivers on the list as "3rd party component", isn't it? OR Do you mean you are ready to ship PAN branded transceivers, thus no more Finisar/Amphenol/etc are supported even they were listed on previous matrix?

emr_1 · ‎03-11-2024

Hello Palo Alto Networks, I wonder why you hide Manufacturer Part Number of SFPs. There are two points I want to ask. ## DOC 810-000077 https://live.paloaltonetworks.com/t5/operations-documentation/hw-accessory-cross-reference-810-000077-0be-updated-on-01-30/ta-p/63422 I have previously downloaded 810-000077-0BC.pdf on my PC. If I compare to the latest file which is 810-000077-0BE, "Manufacturer Part Number" column is gone. Why? ## DOC 810-000096 https://live.paloaltonetworks.com/t5/operations-documentation/updated-on-08-18-2020-document-810-000096-00m-ref-transceiver/ta-p/227987 The article is completely gone. The attached file on this article also had Manufacturer Part Number. (I have 810-000096-0AJ.pdf) In addition, there are few Knowledge base which point above link. e.g) https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boFQCAY https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000bq4ZCAQ Why did you delete it? === No more info available for Manufacturer Part Number??

emr_1 · ‎03-03-2024

We see same issue in several customer's environments. As far as I know, PAN will plan to fix the issue within 8.3.1 and 8.4.

emr_1 · ‎02-28-2024

Yes, you can skip installing 11.1.0 (base image). I put sample CLI output for you. Upgrading from 10.1.11-h5 to 11.1.2 directly. admin@PA-VM> show system info | match sw-version sw-version: 10.1.11-h5 admin@PA-VM> request system software info Version Size Released on Downloaded ------------------------------------------------------------------------- 11.1.2 586MB 2024/02/25 22:54:18 yes 11.1.1 559MB 2023/12/26 10:10:40 no 11.1.0 1179MB 2023/11/02 12:02:59 yes 11.1.0-h2 439MB 2024/01/07 16:52:41 no 11.0.3 519MB 2023/11/06 10:01:53 no 11.0.3-h5 519MB 2024/02/22 12:13:02 no 11.0.3-h3 519MB 2024/01/15 05:40:41 no 11.0.2-h3 497MB 2024/01/10 12:21:40 no 11.0.2-h2 497MB 2023/09/21 12:00:27 no 11.0.2-h1 497MB 2023/08/16 14:25:42 no 11.0.2 497MB 2023/06/28 10:13:04 no 11.0.1 492MB 2023/03/29 15:05:25 no 11.0.1-h3 493MB 2024/01/06 14:50:22 no 11.0.1-h2 493MB 2023/05/30 13:11:06 no 11.0.0 1037MB 2022/11/17 04:45:28 no 11.0.0-h2 293MB 2023/12/28 09:47:33 no 11.0.0-h1 293MB 2023/11/06 17:10:24 no 10.2.8 642MB 2024/02/12 17:02:12 no 10.2.7-h3 591MB 2023/12/18 09:45:48 no 10.2.7 563MB 2023/11/09 07:06:33 no 10.2.6-h1 563MB 2024/01/04 11:28:40 no 10.2.6 563MB 2023/09/27 08:55:35 no 10.2.5 575MB 2023/08/17 08:41:56 no 10.2.4-h10 553MB 2024/01/02 17:08:48 no 10.2.4-h4 553MB 2023/07/27 11:01:55 no 10.2.4-h3 551MB 2023/07/05 09:58:19 no 10.2.4-h2 502MB 2023/05/16 12:19:44 no 10.2.4 582MB 2023/03/30 09:25:44 no 10.2.3-h12 569MB 2024/02/27 12:06:08 no 10.2.3-h11 566MB 2024/01/02 10:46:58 no 10.2.3-h9 566MB 2023/11/07 03:33:38 no 10.2.3-h4 566MB 2023/02/13 14:51:11 no 10.2.3-h2 565MB 2022/12/13 10:27:27 no 10.2.3 545MB 2022/09/29 11:26:49 no 10.2.2-h1 1010MB 2022/06/28 10:12:10 no 10.2.2 528MB 2022/06/07 10:21:50 no 10.2.2-h4 527MB 2024/01/04 07:59:36 no 10.2.2-h2 527MB 2022/08/18 09:06:37 no 10.2.1 522MB 2022/04/18 13:11:04 no 10.2.1-h1 522MB 2024/01/03 20:02:59 no 10.2.0 1010MB 2022/02/27 15:32:20 no 10.2.0-h2 303MB 2024/01/04 15:23:21 no 10.1.12 518MB 2024/01/25 03:54:51 no 10.1.11 490MB 2023/09/25 13:30:08 no 10.1.11-h5 517MB 2024/01/23 07:13:02 yes 10.1.11-h4 517MB 2023/12/14 08:48:16 no 10.1.11-h1 490MB 2023/11/02 01:39:57 no 10.1.10-h5 476MB 2023/12/29 20:12:21 no 10.1.10 471MB 2023/05/04 12:34:33 no 10.1.10-h2 476MB 2023/08/03 04:03:27 no 10.1.10-h1 475MB 2023/07/05 09:30:43 no 10.1.9-h8 471MB 2023/12/27 06:04:56 no 10.1.9-h3 471MB 2023/04/24 10:26:12 no 10.1.9 471MB 2023/02/05 15:26:57 no 10.1.9-h1 471MB 2023/03/07 08:57:13 no 10.1.8-h7 467MB 2023/12/26 09:38:40 no 10.1.8-h6 467MB 2023/11/10 11:08:03 no 10.1.8-h2 467MB 2022/12/19 13:12:16 no 10.1.8 461MB 2022/10/20 12:52:05 no 10.1.7-h1 467MB 2023/12/29 10:43:13 no 10.1.7 461MB 2022/09/12 14:40:59 no 10.1.6-h8 467MB 2023/12/26 08:27:07 no 10.1.6 459MB 2022/05/24 12:45:57 no 10.1.6-h7 467MB 2023/11/09 10:08:59 no 10.1.6-h6 459MB 2022/08/09 15:48:38 no 10.1.6-h3 459MB 2022/06/21 08:11:09 no 10.1.5 457MB 2022/03/24 17:15:57 no 10.1.5-h4 465MB 2023/12/26 07:08:46 no 10.1.5-h3 465MB 2023/11/13 13:16:08 no 10.1.5-h2 457MB 2022/04/25 10:59:44 no 10.1.5-h1 456MB 2022/04/06 22:37:17 no 10.1.4 406MB 2021/12/22 11:50:58 no 10.1.4-h6 415MB 2023/12/26 04:06:43 no 10.1.4-h4 407MB 2022/02/25 09:44:02 no 10.1.3-h3 413MB 2023/12/26 03:10:51 no 10.1.3-h2 412MB 2023/11/09 09:55:22 no 10.1.3 356MB 2021/10/26 18:51:53 no 10.1.2 353MB 2021/08/16 22:44:28 no 10.1.1 297MB 2021/07/21 09:33:46 no 10.1.0 917MB 2021/06/02 04:16:22 yes ..........snip.......... admin@PA-VM> debug swm status Partition State Version -------------------------------------------------------------------------------- sysroot0 RUNNING-ACTIVE 10.1.11-h5 sysroot1 REVERTABLE None maint READY 10.1.11-h5 admin@PA-VM> request system software install version 11.1.2 Executing this command will install a new version of software. It will not take effect until system is restarted. Do you want to continue? (y or n) Software install job enqueued with jobid 6. Run 'show jobs id 6' to monitor its status. Please reboot the device after the installation is done. 6 admin@PA-VM> show jobs id 6 Enqueued Dequeued ID Type Status Result Completed ------------------------------------------------------------------------------------------------------------------------------ 2024/02/29 13:18:51 13:18:51 6 SWInstall FIN OK 13:23:05 Warnings: Details:Software installation successfully completed. Please reboot to switch to the new version. admin@PA-VM> debug swm status Partition State Version -------------------------------------------------------------------------------- sysroot0 RUNNING-ACTIVE 10.1.11-h5 sysroot1 PENDING-CHANGE 11.1.2 maint READY 11.1.2 admin@PA-VM> request restart system ..........RESTARTING.......... admin@PA-VM> show jobs all Enqueued Dequeued ID PositionInQ Type Status Result Completed ------------------------------------------------------------------------------------------------------------------------------------------ 2024/02/29 13:29:38 13:29:58 2 AutoCom FIN OK 13:31:28 admin@PA-VM> show system info | match sw-version sw-version: 11.1.2 admin@PA-VM> debug swm status Partition State Version -------------------------------------------------------------------------------- sysroot0 REVERTABLE 10.1.11-h5 sysroot1 RUNNING-ACTIVE 11.1.2 maint READY 11.1.2 admin@PA-VM>

emr_1 · ‎02-28-2024

Here is links you are looking for: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/management-features/skip-software-version-upgrade https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-release-notes/features-introduced-in-pan-os/management-features Your understanding is correct. If you use legacy way to upgrade, you need to follow the steps as below: (describe this for comparison purpose) 1. download 10.2.0 (base image) and 10.2.x (latest) ** system is running on 10.1.x 2. install 10.2.x and reboot the system 3. download 11.0.0 (base image) and 11.0.x (latest) 4. install 11.0.x and reboot the system 5. download 11.1.0 (base image) and 11.1.x (latest) 6. install 11.1.x and reboot the system With new feature, you can done by only two steps: 1. download 11.1.0 (base image) and 11.1.x (latest) ** system is running on 10.1.x 2. install 11.1.x and reboot the system You don't need any technique or preparation (I mean commands) for it. Just download and install, then reboot.

Member Since	‎05-10-2010 06:49 PM
Date Last Visited	‎12-03-2024 04:29 PM
Posts	353
Total Likes Received	117

Online Status	Offline
Date Last Visited	‎12-03-2024 04:29 PM

About emr_1

Re: CLI: setting and unsetting log forwarding

Re: Sonicwall Firewall v6.5.4 migrate to PaloAlto Next Generation Firewall

Re: Minimize log size

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: CVE ID

Re: How to disable this warning message, or move it to notifications?

Re: PAN-OS 10.2.11 Device -> Setup page missing

Re: request sc3 reset API

Re: The required '11.1.0' base image must be loaded before this image can be loaded

Re: request sc3 reset API

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

Re: Error: Total number of profiles (76) exceeds platform capacity (75)

Re: Where does it show which Agent Config applied to a specific users' Global Protect session

Re: TID 95187 is not on my signature list

Re: what does "SWITCH" in hardware architecture mean?

Re: any solution to keep tracking user IP mapping?

Re: any solution to keep tracking user IP mapping?

Re: [need help]can't see new incoming logs after upgrading M-100 into 8.1.12

Nominated Discussion: What does "SWITCH" in hardware architecture mean?

Nominated Discussion: How to Change Forward Decrypt Trust Certificate

Re: Unable to find the reason for packet drop

Re: Upgrade PAN OS from 10.1 to 11.1

Re: Upgrade PAN OS from 10.1 to 11.1

Re: TID 95187 is not on my signature list

TID 95187 is not on my signature list

Re: cytray.exe "bad image" errors following Agent update

Re: Panopto Still Available ?

Re: Panopto Still Available ?

Re: tshoot firewall

Re: cytray.exe "bad image" errors following Agent update

Re: Looking for Manufacturer Part Number Information

Looking for Manufacturer Part Number Information

Re: cytray.exe "bad image" errors following Agent update

Re: Upgrade PAN OS from 10.1 to 11.1

Re: Upgrade PAN OS from 10.1 to 11.1

Nebula Beta

Unlock your full community experience!

About emr_1