About Brandon_Wertz

With it being EOL, there's really not much to do.  You're only going to have 2 options; pay for PS to migrate the config or do it yourself, working through any config hiccups.  All that said the expedition download is still out there.  Not sure if it's still functional.  While the tool might be EOL, if it's available for download and still works I'd suggest still using it: https://live.paloaltonetworks.com/t5/expedition/ct-p/migration_tool      ... View more

@shoot0267 -- You shouldn't need decryption for things like "base" apps to show up.  Even undecrypted traffic the SNI is seen, and "signal-base" should be showing up in traffic logs.  There's probably an issue with legit signal traffic not matching the app-id correctly, it's probably best to open a support case so the app-id matches. ... View more

@OtakarKlier wrote: Hello, What you are seeing is correct. Since the decryption is not happening, the PAN cannot determine the proper application, hence just ssl/443.   Regards, I would agree, but then why would Palo have APP-IDs for signal other than the base if decryption is needed, yet decryption for signal isn't a viable option? ... View more

@OtakarKlier -- OPs issue is the secondary/passive FW isn't being seen by PAN in AWS.  The passive firewall using a service route on the DP.  The issue is since he's using an inline data port and the DP is down in a passive state the service route won't work.  (I think this is his issue) ... View more

@Ramesh wrote: I need assistance integrating Palo Alto firewalls in an Active/Passive HA setup with Panorama. Below is an overview of the setup:   At customer sites, we have Palo Alto firewalls configured in Active/Passive HA mode, and they are currently managed locally. We are now planning to integrate them with Panorama, which is hosted in the AWS cloud. An IPSec tunnel has been established between AWS and the customer sites for this purpose.   Since the management subnet at the sites does not have a route to reach Panorama in AWS, I have configured a dedicated dataplane interface solely for Panorama communication. I have also modified the service route to use this dataplane interface instead of the default management interface.   However, because this dataplane interface is not active on the passive firewall, the passive firewall is unable to communicate with Panorama and appears as “disconnected” in Panorama.   To onboard the firewalls into Panorama, we need to import the existing firewall configuration into Panorama and then push the configuration back to the devices. Since the passive firewall is in a disconnected state, we are unable to perform this operation.   Is there a recommended workaround to address this situation? Firewall model: PA 440 Software version: 11.1.4 In the HA setup, there's an option that allows the interfaces to be in an "UP" / online state.  I'm not sure but that might be enough to bring the dataplane port up for the service route to work. ... View more

@459768405 wrote: Dear all:           I have a question about search security policys. We have lots of security policys on our pa ngfw. some of them use a address group as a source& destination condition, some are not. The content of address-group may be a range or a subnet, but now I want to search security policys that relate a pariticular address, this address maybe contain in one or more address-group, and I also want to add some filter conditions such as action, source zone, destiontion zone,and so on, how can I do this? I try to write a filter like (source/member contains '1.1.1.1'), but it doesn't work..   Best Wishes @OtakarKlier  mentioned the 2 best ways to find objects, the first one in policy and the second being the "Global Find."  Depending on your use case one might be more efficient than the other.     The Global Find, is a more complete search as it will show objects that simply exist that might not be used in policy. ... View more

Can you share a screenshot from the GUI of what eth 1/2 look like?  Also can show the GUI of your vwire?  PAN-OS is weird, in some instances it'll let you delete something that can create a weird situation that an object may be gone, but the thing referencing the object still thinks it's there.  It's possible you might have unintentionally removed/deleted an object from use somewhere else & now that somewhere else is holding onto that object.  If this is the case you're better off reverting your config and starting over. ... View more

@salvador.meza wrote: I found a flow chart on the PAN portal earlier this that showed the customer's path to receiving support for both Direct and Partner Enabled, but I can't find it anymore. Have you seen it? Yeah, not sure what exactly you're looking for.  Can you share more details about what you're wanting to know?  In general I dislike the practice of going through a 3rd party for support, but in Palo's case it might be better to have initial triage go through a partner, if that 3rd party is going to be more responsive and have more technical expertise in their frontline support.   You'll want to be careful though in how escalations work.  If the partner can't fix your issue escalation to Palo TAC might have you rework all those initial steps.  Just make sure you know what type of support you're getting yourself into. ... View more

@apiche1 wrote: Bump for an old thread, however I found more relevant information. 1.) 3rd Gen firewalls (PA-800s, PA-3200s, PA-5200s) did NOT come with the Device Certificate. You have to fetch it using the OTP method (from Device Certificate in Support Portal). "request certificate fetch otp ##############################" 2.) Run the "request logging-service-forwarding status" If you are missing the Logging Service Certificate (see screenshot), then run "request logging-service-forwarding customerinfo fetch" 3.) Port TCP/444 has to be open for the firewall to fetch server certificate when doing the "request logging-service-forwarding customerinfo fetch" command (see screenshot) I found this helpful trying to get IoT Security working on a PA-3220. We were not seeing any devices make it to the IoT dashboard until the Device Certificate and the Logging Server Certificate was fetched successfully. GL, trying to stand-up IoT.  I've been evaluating it at my company for ~6ish months.  We did finally get it added to our ELA.  It seems like a great feature, but still has a lot of quirks we're working through with them. ... View more

@AndreaB wrote: Hello,   it is a few months that we have an issue on Webex call beetween two users (not on Webex meetings). Basically after a while the video call quality starts to decrease during a direct call on Webex beetween two users.    We already disabled SIP ALG without experiencing any quality improvement on video calls.   By configuring monitoring on QoS we also found out that the used bandwith during those calls are a lot lower than the available bandwith.    We also took a traffic capture, but for my current knowledge on Video/VOIP protocols i can't find a visible issue on this session. I m wondering if maybe applying an application override policy on SIP could help.   Do you have any suggestion?   I attached the traffic capture and logs   Thanks and Regards @AndreaB my suggestion for your problem would be similar to the recent WebEx issue post.   I would first create an IP based rule that allowed "any application" over service "any" to the known Cisco WebEx IP networks.  Then after 2-4 weeks review the applications that matched the rule and create an application based rule above your IP (L3) based rule.  Following the suggested method above will be a much easier way of troubleshooting.  Only do this of course following your internal approval processes for allowing traffic through your firewall.   You mentioned video quality degrading, if the issue is the actual video and not voice I don't think doing anything to the SIP application (Disabling ALG) will have anything to do with video quality.   You can use these 2 links to help identify the the ports/protocols/IPs are for the services you're using, but ultimately just opening it up by IP then narrowing it down to Palo Alto App-ID will be far easier than trying to look into what port/protocol isn't being allowed.   https://help.webex.com/en-us/article/WBX000028782/Network-Requirements-for-Webex-Services#id_134132 https://help.webex.com/en-us/article/b2exve/Port-Reference-Information-for-Webex-Calling   ... View more

@JeanPaul222 wrote: Hello, We are planning to migrate from a Fortinet firewall to a Palo Alto Networks firewall. As this is my first time handling such a migration, I would greatly appreciate guidance from an expert on the step-by-step actions required.   NGFW  Palo Alto used to have a production called the "migration tool" or newly called "expedition."  This tool would essentially take a competitors (Cisco / Checkpoint / Fortinet) rule base in it's native format and convert it to native PAN-OS.  Unfortunately it looks like Palo Alto discontinued that product back in January of this year.   This live article describes alternatives, but really there doesn't appear to be any free ones.  The way it's written I don't think SCM is a direct replacement to expedition as I don't think SCM will ingest a competitor's config and output a PAN-OS config.  With that said it looks like it's either a figure it out yourself or pay a VAR to assist with the migration.   https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 ... View more

@SebastianHermes wrote: Hi Matlat, we are experiencing the same issue. How could you solve it ?  My company used to have WebEx as our primary meeting platform. We really didn't have any issues, outside of the one off user complaints.  WebEx uses a bunch of different applications from a list of different IP networks.   I would first create an IP based rule that allowed "any application" over service "any" to the known Cisco WebEx IP networks.  Then after 2-4 weeks review the applications that matched the rule and create an application based rule above your IP (L3) based rule.  What I suspect is going on is you're probably not allowing the "stun" application or some other media based application which is causing your audio issues.  Following the suggested method above will be a much easier way of troubleshooting.  Only do this of course following your internal approval processes for allowing traffic through your firewall. ... View more

@AY_FASAR wrote: Hi,   Is there a command to check if a tunnel went down on a specific time and why it happened. I have a tunnel set-up to a 3rd party where they keep monitoring some of their servers. They inform me that they receive alarms every hour that the endpoint is down and its not coming back up for about 15 min. I cant see anything obvious. I have done show vpn flow name ...  but I cant see any error there. is there any other logs that I could check to see those disconnections that 3rd party mentioning and if I can get any clue from the output why the tunnels going down.   If you look in the GUI logs, (system) and filter on type of "VPN" (I think.) that should give you the logs you're looking for.  I would also add time stamps filters with a "geq" (after - greater than equal to) & "leq" (before - less than equal to) for the time period you had VPN issues.  You can look through the logs and find errors much easier that way. ... View more

@rolinger wrote: We have a spirent connected directly to a PA-5450 to do load testing on the 100Gb ports.  The PA5400 has two NC cards (Slot 1 & 2) and then 4 DPC cards (slot 3-6).  The docs show that NC1 is logically mapped to DPC3, and NC2 is mapped to DPC4.  But there is virtually no mention of slots 5 and 6.  Are they auto assigned or do we have to manually map them to NC1 vs NC2?  Any insights on Slots 5 and 6 is appreciated.   Spirent Port 1 <-- 100Gb --> FW eth1/25 (Trust Zone) Spirent Port 2 <-- 100Gb --> Fw eth2/26 (Untrust Zone). QSFP28-CWDM4 optics being used   There is a single bi-directional policy SRC: trust/untrust  Dst: trust/untrust - with any/any/any across the board, no threat/virus/security applied to the policy, just straight throughput traffic at the moment.   At the moment we are only able to get 53Gb of stateful connections through the FW during load testing.  Are there any other FW configurations I need to be aware of or should consider to get the loads up to the 100Gb capacity?  Or any specifics we need to tweak in the test itself?     I don't have anything specific to point out to help get you to a better throughput, only to point out you might want to consider the type of data you're pushing through the box and also turn off DSRI to help create better throughput.  I would think you'd get a better throughput rate with UDP vice TCP also packet size of the traffic will also impact throughput performance.     It's probably going to be in your best interest to reach out to your account SE and walk through this with them as they'll be the best resource to work with you on what you're trying to accomplish. ... View more

@S.Ramesh960545 wrote: PA-5450   I need to enable the AI ​​Access feature, then the PAN OS requirement must be PANOS version 11.2.2-h1. Currently PAN OS uses 10.2.9-h1, then I checked in portal Preferred it is still 11.1.6-h3. Please confirm to Palo Alto best practice, which OS version should I upgrade to enable AI Access? Need to, or want to?  If you're doing this on a production environment I'd wait at least until there's a preferred version of 11.2.X before going to 11.2 on a production environment.  ... View more