About Brandon_Wertz

@WJLennon wrote: There is such rich data stored in this tool, is there way to generate a network diagram? I need to have up-to-date network diagrams for SOX and PCI audit every year.  It would be awesome to have a diagram generated that I could review/update and then hand over to auditors. It would also be helpful during production issues to quick overviews of my systems. The firewall (strata) platform will not natively diagram at your network.  However, a new feature (license) IoT Security might give you a diagram of sorts you could look into that.  Though I'm not exactly sure even that will give you what you're looking for. ... View more

@MichaelSeddon wrote:   ...but then after timeout period set in User Identification Timeout they remain connected without a username and therefore will have no access...   After the user-id timeout, they stay connected?  Connected to what?  The WiFi network or the known user for the device stays in the firewall?   After the user-id timeout the ip to user-id mapping should be removed from the firewall.  Depending on the hardware platform there's a MP and DP.  So check there.   if you're reporting that the user-id timeout is being reached, but expecting the iPad to be disconnected from the WiFi network, that will not happen.  The firewall user-id timeout will have no bearing on being removed from the WiFi network. ... View more

@BigPalo wrote: We tried to install version 6.2.3 and now the issue is happening each 10 minutes(its even worse 🙂   Its strange because there is only a group of user having this problem but not pattern in them. Well that sucks.  My only recommendation would be to collect GP dump level logs from the client right after the client disconnects then reconnects again.  Then collect a TSF from the FW after the client has reconnected.  Then provide both of these to TAC for their review.  I would do this for both software versions.  That should be enough for TAC to get to RCA. ... View more

How do users authenticate?  SAML?  I know this says MacOS, but I've heard this applies to Windows as well.  I don't think this is fixed in 6.0.X, I'm not sure if this applies to 6.1.X.  I know that this is fixed in 6.2.2+:           ... View more

Yeah I'm skipping 11.0 all together.  Still have most on 10.1.X with only 3400s running 10.2.  I'll be pushing our 10.1.X to 10.2.X here in October.  Then ridding 10.2.X until EOS around Jun-25 just before EOS in Aug.  Hopefully by then 11.1.X will be stable for an enterprise at which point I'll upgrade 110+ firewalls to 11.1.X.   It's a real balancing act trying to find the "right" stable code, but we usually run older code, we hit too many service impacting bugs.  (We actually hit a MD5 hash collision on a commit once.  2 URL profiles ended up having the same MD5 hash upon a commit.  That's how unlucky we are)  ... View more

@TomYoung  -- Did you mean 11.0 has been out for 18 months? My past 11(ish) years of running Palo I don't deploy any code that isn't at least a .6+ on the patched version and I really prefer to be .8  Every single time I've deployed code/hardware running below that we've hit a system impacting bug...EVERY single time.  (Since 6.0)   We recently (6 months ago) deployed 3410s running 10.2.6 and had a HA/BGP bug that wasn't fixed until 10.2.8 I believe.  (We were able to get a special hotfix version for 10.2.7.     If it's new code and new hardware I wait until the .8 now.   About a year ago I tried upgrading from 10.1.5 to 10.1.9+...Palo changed how the firewall responded to ARPs.  IMO this should have been a major release modification, but Palo did it under a minor fix.  It took almost 12 months and months long engineering engagement to identify why traffic was failing when we were upgrading.       ... View more

@drewdown wrote: We have a specific rule to allow github based on PAN EDL of github v4/v6 addresses.  Git works over port 22 but not over 443 with the policy below.  I want to allow git over 443 on the policy below but not clear on the best way to do it.   Do I need to specify service as ports 22 and 443?       Your screenshot is calling out to unique "git" applications.  You have the "parent" for github, but are using a subordinate app for "git" not sure if that's something you intended?  Your rule looks right, but I'm not certain how those EDLs correlate to the Apps you're calling out.   The one thing to mention if that you probably need SSL decrypt for this rule to work correctly.     ... View more

@jeffrowan wrote: Hello,   I'm planning to remove some older Juniper MX routers from the network edge and move the BGP peer configuration to an Active/Passive pair of 5410s.  There are two ISPs.  For now I'm just hoping to replicate the Juniper setup on the PAs.  Right now the PAs statically route traffc to the Juniper where the BGP peers are configured.   I want to make sure I have all the necessary settings replicated and figure out if I can pre-configure the BGP peers on the PA before cutting over, without breaking the current routing.  If anyone has done a similar transition with BGP and has any suggestions, it would be much appreciated.   Thanks! Setting BGP up in Palo...less is more.  When you start to configure export/import/redistribution profiles means the firewall will do only what you configure.  If you configure none of this then Palo will share everything.   Take the time to review all areas of the BGP config.  There is 10+ areas availble when setting BGP up, so don't overlook all the config options.   Also be sure to enable ECMP if your 5410 will be connecting to 2 upstream or downstream routers at the same time (and you want both to be active/active) ... View more

@inSync-MarkValpreda wrote: Trying to see what might be going on with our PA-1410 after we upgraded to 11.0.2-h4 from 11.0.2-h1. We have tons of tickets for slow GP connections since that upgrade a few weeks back. We have a 1gb link and average usage is <100mb.   Users will connect to GP, go to the file server, go to open an Excel file and you'll see Excel saying it is opening a file and watch the percentage go up. When it works, it can take 20-30 seconds to open a 1Mb file. Watching the GP adapter in Windows task manager will never see usage more than 25mbit. There are other times when the file will stop opening altogether. Go back to the folder and it will not refresh. Thinking it might have been our file server, moved some files to a known good server and had the same results. This does not happen internally, only when GP is in the mix.   When this is happening, I try and go into the web GUI of the PA-1410 (across GP) and a lot of time it will not come up. Happens across different browsers and different machines. I get the login screen, and then just a yellow screen with a spinning progress meter in the browser. Go to a jump box internally, and I can get to the GUI. I check to see if there is something getting triggered in the threat monitor, but there is nothing. Management and Data Plane CPU are <2% when I do finally get in.   In my GP to internal security rule I have 'Disable Server Response Inspection' ticked, and for testing have None for the Profile Type under Profile Setting.   Did an upgrade to 11.0.3-h10 last night with no change in speed. While I never did any speed tests before, I don't think it was ever this slow previously. Work from home users are getting really frustrated.   Do have an open support case but hoping some fresh eyes might help. Unless there's some mandatory feature you need in 11.0 my recommendation would be to downgrade to 10.2.X and see if that improves the user experience.  (I think 10.2.8h4 is the current preferred version...10.2.9h1 has an issue with GP speed related to CVE-2024-3400)...--edit--  Just saw that 11.0 is the minimum support version for the 1400.   My recommendation would be similar to @BPry.  You're in a tough spot.  IMO, non of the newer code is ready for production deployments, but maybe pushing ahead to 11.1 would be a better option than staying on 11.0? ... View more

@nhutvt2 wrote: Thanks TomYoung. What about versions 11.x.x? Can you refer me to the best current version? I will upgrade my device to the latest versions as recommended. If you are deploying this to a production firewall environment I wouldn't run anything beyond 10.2.X.  IMO 11.0, 11.1 and 11.2 are not ready for production environments yet. ... View more

@Sanjay_Ramaiah wrote: Thank you both for the help 🙂 So this will not even let the Portal authentication attempt as well.   If you're wanting to block GP VPN access from these regions then I would use the region as the source and your GP portal/gateway IPs as the destination with a deny action.  No need to call out any specific application.  Doing this will prevent anyone from that IP space associated with that geographic region from reaching your environment.  ... View more

@Greg.Herbert wrote: I have a scenario where we have a data diode transmitting over fiber to an interface on our PA220R (sfp 100fx). The difficulty is that the PA considers the interface as 'down' because of the nature of the data diode, the diode only sends to the PA over this fiber but will not receive any data from the PA by design. Does anyone know a way to hard code the interface/sfp to be 'up/on' and receive the traffic coming over the fiber?  I don't know of a way to force the interface up in Palo, but can you cheat it and connect the diode to a media converter and from the MC connect the PA220?  Or place a switch in-between the diode and the 220 (with the diode and 220 on the same VLAN?) ... View more

Specifically to accomplish what @reaper is mentioning in the Source or Destination tab you can select the country in the "Region" section of the address object:     ... View more

More than likely your experience here:   is because you didn't have ECMP enabled.  The setting is in your VR setup:   ... View more

@O.ELHANCHI wrote: I am trying to extend the VLAN from main site to branch site using a combination of GRE and IPSEC.   Below is a quick representation of the architecture, the objective is to enable remote communications between the main and the branch sites for all devices within VLAN-1.        I am aware that PA does not natively provide L2 tunnels, and VXLAN would be the more appropriate solution for this kind of need, but right now just wondering if this is even possible with only 2 PA firewalls ?    What i've achieved so far is a ping from 172.28.89.252 to 172.28.89.254 and vice-versa, which is a good start, but whenever i try to route towards 172.28.88.250 through the GRE or IPSEC tunnel, i either get a TTL exceeded indicating a loop somewhere, or no response at all.    I'm also exploring other avenues at the same time such as redistributing static routes with OSPF or BGP over IPSEC, but to no avail so far.    Any insight would definitely be greatly appreciated !        To me this would really be reliant upon the 2 independent networks and how the PA would route to those networks.   The branch fw would have a route that points 172.28.88.0/23 to eth 2/1 and a route for 172.28.88.0/23 to eth1/1 and vice versa at the main location.  You will want ECMP on both firewalls as well.   At this point it would be "luck" as to the path the packet took from the firewall.     I don't really think this scenario would functionally work very well, but it could get you what you wanted. ... View more