About LukeBullimore

Hey @Raido_Rattameister   I thought the purpose of the device config bundle was to intentionally push a blank config, so that you wouldn't get any duplicate issues when trying to push the Panorama config?   Are you saying that "Export" option instead of "Push & Commit" for device config bundle, then load device state gets around this? But then surely Panorama would still be out of sync so when you try to push to device group/template commits will fail due to duplicates etc?     ... View more

Hey @Raido_Rattameister   When you add HA pair firewalls into Panorama, you need to disable HA config synchronisation during the process.   At present it seems @josggf's configuration isn't committable (or by the sounds of it), so won't be able to do the commit to enable config sync 😉   I had this exact same problem before - so speaking from past experiences here 😛 ... View more

Hey @josggf   Did you save and export a named config backup from both the active and passive before starting the Panorama work? If so, I would disable Panorama policies, objects, templates etc, load those configs and start from scratch.   If you didn't make any manual backups, your best bet is to revert to a previous configuration version. (Device -> Setup -> Load Configuration Version) and start from scratch.   As for why it failed in the first place; it's hard to say but I would definitely follow the below instructions. It sounds as though there may have been an issue with the device config bundle stage.   https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management   Cheers, Luke. ... View more

Totally agreeing with what @BPry said. If the device is constantly rebooting something has definitely gone wrong.   However, something to note though @David7660, the authentication process is one of the last processes that finishes starting up after the firewall reboots. Meaning, although the GUI is operational etc, you may not be able to log in for another 5 more minutes.  ... View more

Hey @tstores31   You were pretty much on the right track with what you said. When you go to "shodan.io" it uses HTTP. The firewall can do a "man in the middle attack" on this HTTP session and present the URL block page.   On the Google Search result for shodan.io, the URL is https://. Without SSL decryption, the firewall cannot do a MiTM attack on the SSL site to present the block page, however access to the site can still be blocked as per your URL filtering configuration.   To conclude, if you want to present block pages for SSL sites - you will need to configure SSL decryption.   Cheers, Luke.   ... View more

Yep that is completely my bad @Remo. You can't use NEQ for an IP address filter, only for filter types where "eq" is appropriate.   e.g ( zone.dst eq test) = neq would be valid there.   My bad! To negate IP addresses use notin ... View more

Hey @Jamesy   My only thoughts are going to be the scripting options using the Msiexec - but I don't think disabling the app or disconnecting is possible entirely through a script. I've been reading the below documentation and it doesn't look to be possible.   https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-clients/deploy-agent-settings-transparently/deploy-agent-settings-to-windows-clients/deploy-scripts-using-msiexec   https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-clients/deploy-agent-settings-transparently/customizable-agent-settings#idd39ecf6d-6771-4ee3-a4d1-2ba5bbbad1bc   https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-clients/deploy-agent-settings-transparently/customizable-agent-settings/script-deployment-options#iddd0437db-f9c7-4c13-b49a-e8c044d57ca8   https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-clients/deploy-agent-settings-transparently/deploy-agent-settings-to-windows-clients/windows-os-batch-script-examples#id917d79e2-32af-456a-82bc-aecfa187fa11 ... View more

Hey @MPI-AE   "neq" is definitely a valid operator, perhaps you're hitting some GUI bug?   e.g.   (addr.dst neq 8.8.8.8)   As an alternative, you can use the exclamation mark e.g.   !(addr.dst eq 8.8.8.8) ... View more

Hey @Jamesy   If you set your connect method to "on-demand" -  instead of having to disable the app there would literally be a disconnect button 😉 Sounds pretty simple to me! ... View more

Hey @Bruno_Alipio   Thanks for your response! In our particular issue, this was failing because a lot of our logs included IPv6 and Expedition does not currently support IPv6 for ML.  Many thanks to Albert for looking at it with us 🙂   Cheers, Luke. ... View more