About MichaelMelone

Hi Vince, it was the  June 2021 Cumulative Update for Windows Server ... View more

Hi Pete,   We were able to fix this by upgrading the windows server with the 2021-06 (june) standalone update.  After patch was installed and a reboot, the agent was able to connect to all of the updated domain controllers that recently got the same patch over the weekend.   Hope this helps.  ... View more

I never found the issue exactly, but I'll be working with this again shortly at my new role and will try to leave an update here.  ... View more

I'm having an issue where GP HIPS appear to expire, rendering all my rules useless and the client gets blocked eveywhere I have the HIP profile enabled. It happens after an hour of connectivity and its not always consistent. It kills long term ssh/rdp sessions and it does not seem to be related to idle timeout (3hr) or max time out (12hr).   Will decreasing the check time help?  ... View more

Couldnt log in with default creds of admin/minemeld. This worked for me after a fresh install ansible style on ubuntu 18.04.     I Followed: $ sudo apt update $ sudo apt upgrade $ sudo apt install -y gcc git python-minimal python2.7-dev libffi-dev libssl-dev make $ wget https://bootstrap.pypa.io/get-pip.py $ sudo -H python get-pip.py $ sudo -H pip install ansible $ git clone https://github.com/PaloAltoNetworks/minemeld-ansible.git $ cd minemeld-ansible $ ansible-playbook -K -i 127.0.0.1, local.yml $ usermod -a -G minemeld <your user> # add your user to minemeld group, useful for development   I tried this fix as noted by drewdown and it works!    sudo service minemeld stop sudo -H -u minemeld /opt/minemeld/engine/current/bin/pip install pip==9.0.3 sudo service minemeld start Thanks!! ... View more

Did you open udp port 4501 on the host firewall of the host running the GP client? Only with that port open on the host will you see the authentication prompt pop up from the GP client. I had to do this for SSH auth policy. The service in the auth policy will be the TCP RDP port.  ... View more

Are you talking about address resolutions in the logs in the monitor tab or FQDN objects in a security policy?  If you set the DNS server for the firewall, it will resolve addresses in the monitor tab logs against the DNS server set in the Device Setup config area.  ... View more

Let us know what happens.    Decryption method will need to change since the certificate information in TLS1.3 is hidden. There was some breif talk at ignite18 about it. I am interested to see what comes of it.  ... View more

Thanks for that explaination @reaper ... View more

I believe this can be done not setting a log action on a security policy, but enabling the log forwarding option.  Typically i have local logs on the firewall as well as the copy send to panorama. I believe the checkbox for "log session start or end" controls the local logging while the fowarding option will do panorama or syslog.  ... View more

I was informed by some project managers that this is a limiatation of the current implementation of panorama and objects vs template settings.  ... View more

 @Mike.ship and @nbilal   Thanks for the good information sharing and sorry for my pervious long-winded response.  ... View more

@Mike.ship I also have the problem with being able to have an overall shared Cert Profile object tied to EDL objects.  When the shared box is checkec on a shared EDL object, I cannot reference the Cert Profile, even with the cert profile pushed to the device template. This is using panorama.  The shared cert profiles can only be used within a template. For example, a Cert Profile created as shared in Tempalte "ABC" cannot be referenced by a shared EDL object. In order for the EDL object to reference the Cert Profile, the EDL must be in ABC location.  A "shared" EDL in a device group related to the template where the the shared Cert profile lives cannot see the cert profile even though the Cert Profile is shared. Only a non shared EDL can see the Cert Profile.   This makes me believe shared template objects dont necessarily mean they are able to be seen by shared Device Group Objects.  It makes me believe that EDL objects can only reference a cert profile that already lives on the device via it's template.  It's been slightly confusing when configuring EDLs on panos8 using panorama and getting those lists/cert profiles to work accross all devices. I'm ending up having to make 3 seperate EDLs of the same list for my 3 differeny vSYSs of one device. Those vSYSs device groups cannot see my Shared cert profile in the template of the devices where the 3 vSYSs are.  Maybe I'm configuring things wrong or that is just how it's designed.  ... View more