About BPry

What rule is the traffic actually hitting as it stands, and where is the allow rule in corelation within your lists of security policies? It sounds like you are hitting a pretty strict deny rule, as if this was a consumer version of Skype then it will fall back to port 80/443.   ... View more

Completely agree with that. It doesnt look like Palo Alto is all that concerned with fixing it however. ... View more

Sorry, I knew I should have had my normal amount of coffee today. There's this nice little load button that I wasn't pressing; once I pushed that I was able to make the changes that I needed to. Is it friday yet 🙂 ... View more

All three started correctly and is still giving the same error.  ... View more

They all appear to be running 56625 56626 56627 \bprya@vpro-panmm-01:~$ ps aux | grep 56625 | grep -v grep minemeld 56625 0.0 1.0 216048 22212 ? Sl 12:13 0:04 /opt/minemeld/engine/0.9.22/bin/python /opt/minemeld/engine/current/bin/mm-run /opt/minemeld/local/config \bprya@vpro-panmm-01:~$ ps aux | grep 56626 | grep -v grep minemeld 56626 0.0 1.3 232640 27304 ? Sl 12:13 0:00 /opt/minemeld/engine/0.9.22/bin/python /opt/minemeld/engine/current/bin/mm-traced /opt/minemeld/local/config/traced.yml \bprya@vpro-panmm-01:~$ ps aux | grep 56627 | grep -v grep minemeld 56627 0.0 0.9 55980 19904 ? S 12:13 0:02 /opt/minemeld/engine/0.9.22/bin/python /opt/minemeld/engine/current/bin/gunicorn -w 1 -b 127.0.0.1:5000 --access-logfile - --error-logfile - -k gevent minemeld.flask:app ... View more

I don't see anything in the output that says ERROR. I've attached a screenshot of the actual error.  ... View more

minemeld-engine RUNNING pid 56625, uptime 0:01:01 minemeld-traced RUNNING pid 56626, uptime 0:01:01 minemeld-web RUNNING pid 56627, uptime 0:01:01 I just checked and the problem still persists.  ... View more

@K12PaloAlto personally we chose to continue to use the ASA simply as a VPN gateway and moved all firewall functions over the the Palo Alto. If you already have the equipment maintaining the AnyConnect license (if it isn't perpetual) is very cheap to do; and if your ASA is only going to provide VPN then you can get away with a much smaller unit. The GlobalProtect client for most of our users was 'good enough', however those that did complain brought up valid reasons to continue to use AnyConnect.  ... View more

To the best of my knowledge, if you are using an EBL then you will simply 'deny' the connections from being made. I don't believe that PA has a 'denied' responce page in the context of denying hosts from the network, you can only get that with application response pages. It might be a better option to look into rolling out ad-blocking via group policy. There are plenty of guides that you can follow and it doesn't take long at all, you also get the added benefit of disabling it when the user wants to access a site that would have otherwise denied access if it couldn't reach it's ad servers.  ... View more

@jmenon I've seen this same issue even with Palo Alto IPSEC site-to-site tunnels and after opening a case with TAC they never actually gave me a firm answer to anything. Just that it was a bug and would be fixed, but I haven't actually seen anything in recent release notes to indicate that the issue was ever addressed. ... View more

I'm not sure why you couldn't do the exact same thing on the Palo Alto? If you were running a analog modem previously into the console port then you do the same thing with the Palo Alto and you will have out of band access to the PA's CLI. Alternatively I imagine that if you were okay with dialup like speeds you could plug into the management port and give yourself GUI access the same way.  ... View more

@jvalentine thanks for the info! For some reason I can't remember I thought that MindMeld was a licensed product.  ... View more

@jvalentine don't you need additonal licensing to run MindMeld? I thought that was the case but looking into it a little bit now I can't actually see anything that references a license for the product.  ... View more

Most XML editors will make very slight changes to the formatting that they may or may not actually show inline with the document. I'm not sure why you would try and do this large of a change directly from XML to be honest with you. There will also be much more than just that thread to edit, as when you remove the subinterface from the interface configuration any reference to that interface would also need to be altered to reflect the new sub-interface before it ever accepted the configuration; and again you would need to make sure the formating is just right otherwise it will reject the file.    In this situation I would just do it through the GUI instead of taking so much time to edit the XML config directly. 1) Create the sub interface 2) Change the policies away from the exsisting sub-interface and move them to the new one. Attempt to delete the sub-interface and verify the config, it should list anything that hasn't been altered to reflect the new interface before it allows you to actually commit the changes.  ... View more