About BPry

I just noticed that sorry; most of my equipment we don't keep logs going back multiple days like that execpt for on the DO PA-200s. I couldn't actually configure it to list by the date on the report; I would have assumed that sorting by date would have put things in chronological order but I guess not.  ... View more

https://indeni.com/how-to-export-palo-alto-networks-firewalls/   That's probably the easiest way to read things if you don't want to read through the XML, it also gives you some decent sorting options.  ... View more

Where are you trying to generate this report and what database are you running the query against?  ... View more

What are you using for the sort by field. IF you want it to sort by date then you will need to enter that before generating the report.  ... View more

Just generate the report with the query (filetype eq swf) and it will include only the swf file type instead of searching for swf across the whole filename  ... View more

As others have stated it all depends on how much space you've allocated for logging data. Depening on our traffic flow on our main unit I can have 1-2 days of logging, or I can get just a few hours of logs depending on the amount of traffic flowing through.  ... View more

The filetype has dropped the '.' on the name. So you'll see 'pdf' in the logs instead of '.pdf'  ... View more

Session offloading? To do it temporarly you can use set session offload no with the cli, to make it persitant (otherwise it goes away with a commit or reboot) you would need to run set deviceconfig setting session offload no. Just change either command to a 'yes' to get it back.  *Keep in mind that this will use a lot more resources than normal, make sure that it actually handles the additonal resources before you turn offload off.    ...sorry didn't read the whole 'only for citrix' part. I believe that session offloading is either an all or nothing deal, I don't believe you can set it to not offload for specific applicaitons. You are either offloading or you are not.    ... View more

The only thing that the ASAs TCP randomization feature is doing is randomizing the client side ISN number so that it isn't sequential. I don't believe that the ISN number is sequential on the Palo Alto equipment either if I remember from past wiresharks. You might want to try getting a ticket opened and waiting for their response; we can try calling in @reaper as well, but this is more of a support case question in my mind.  ... View more

I imagine that you guys were used to running the legacy Cisco VPN client; pretty much everyone has started to follow this same method.  ... View more

Doing the manual install this evening might be best; looking at your settings the emrgency update 641 would give you a chance to see if it installs correctly tomorrow morning, if it not let us know.  ... View more

@jdprovine This page might get you what you need to know: LINK. Take a look at the Network tab under IPSec Crypto and you'll see that the default key (the one I believe reaper referenced) uses ases-128-cbc and 3des with sha1 authentication.      ... View more

Link change is telling you that something changed in the link that the Palo Alto noticed. I'll include a screenshot of mine but usually these are occompanied by a Down message unless it's your first time plugging that port into the device.  Looking at it I would actually think to look at your speed and duplex settings on the equipment that these ports are plugged into; it looks like your switch may be having a hard time auto-negotiating that information.  ... View more

It looks like everything is connecting and downloading just fine but it simply didn't install the 640 update. Try to manually initiate the install on the Passive firewall and see if it was simply a hiccup with the install on the Passive unit. If it installs fine manually then I would wait until the next update and see if it happens again, if it doesn't than it was likely just a fluke.    ... View more

@jdprovine can you expand by what you mean by 'key'?  ... View more