About Brandon_Wertz

I agree, changing the IP fixed the problem at hand but didn't shed any light on why it was happening.  Will ask tac about the outbound NAT configuration and see what they say.   ... View more

It seems everything is leading over to the Agent-ID. I'll begin the setup next week. Thanks everyone. ... View more

Very good. Thank you for posting this information! ... View more

@Brandon_Wertz,   I think you nailed my reaction on all of these "PAN-OS 8.1.0 is real bad; Palo should pull the release; this killed my production network". Palo Alto did not come on premise and force you to upgrade to 8.1.0, Palo Alto didn't stop supplying updates to other software versions, they didn't release hardware that only runs 8.1.0 (unlike 8.0), and Palo Alto didn't automatically install 8.1.0 to anyone's firewall.  I agree that Palo Alto should, and could, tone down the marketing around 8.1.0 until its actually hit recommended status. There are defiantly mistakes that they've made in that regard. There shouldn't have been as much noise surrounding the 8.1.0 release, the SMB over VPN issues experianced by users of the Beta channel should have been included in the release notes, as it was already noticed by the time 8.1.0 was offically released, and it should have been clear in all communication that it wasn't recommended you actually install it on production equipment.    In the end though it comes down to the decision that you made as an admin. You choose to run 8.1.0, you made the decision to run new code, you made the decision to prioritize features over stability, you failed to QA the code with your configuration to verify it didn't effect your production network. YOU caused an outage or a degradation of services because you installed 8.1.0 on your production equipment without validating it worked for you and your company.         ... View more

In today's example, I needed to add log-forwarding profiles and threat profile groups to rules that had been imported from the migration tool:   Powershell: I declare a few variables $panoramaIP = $apiKey = $deviceGroup =   I run two "get" calls to obtain the rules that are missing one or both items:   $noLog = invoke-restmethod -URI "https://$panoramaIP/api/?key=$apiKey&type=config&action=get&xpath=/config/devices/entry/device-group/entry[@name='$deviceGroup']/pre-rulebase/security/rules/entry[not(log-setting)]"   $noProfile = invoke-restmethod -URI "https://$panoramaIP/api/?key=$apiKey&type=config&action=get&xpath=/config/devices/entry/device-group/entry[@name='$deviceGroup']/pre-rulebase/security/rules/entry[not(profile-setting/group)]"   I dig a little deeper in my x-path to make future commands shorter   Then for each policy in the lists, i use set calls   for log forwarding:   invoke-restmethod -URI "https://$panoramaIP/api/?key=$apiKey&type=config&action=get&xpath=/config/devices/entry/device-group/entry[@name='$deviceGroup']/pre-rulebase/security/rules/entry[@name='$($policy.name)']&element=<log-setting>Log-Forwarding-Profile</log-setting>"   for profile group: invoke-restmethod -URI "https://$panoramaIP/api/?key=$apiKey&type=config&action=get&xpath=/config/devices/entry/device-group/entry[@name='$deviceGroup']/pre-rulebase/security/rules/entry[@name='$($policy.name)']&element=<profile-setting><group><member>Profile_Group</member></group></profile-setting>"   obviously these are only snippits of a longer script.  I imagine with the approriate tweaks these xpaths and commands would work for a firewall. ... View more

Thanks so much for this information ... View more

@SThatipelly, Not sure you are going to get a super helpful answer. The fact of the mater is it's super easy to gather the number of sessions that are active, and the number of sessions active per zone. It's a lot harder to break that down; you can get the number of decrypted sessions per zone, but once you have that number it's next to impossible to determine what traffic was actually encrytped versus what traffic was not.    A very quick solution would be to utilize the 'ACC' and the 'Network Activity' tab with the 'Application Usage' widget and set an application filter to just SSL traffic for the last 15 minutes and keep track of that. This would give you a rough estimate of what your session rate looked like for encrypted traffic; but keep in mind that the firewall is able to identify certain applications regardless of the traffic being encrypted. This would only give you a very rough estimate to start with.  ... View more

Figured out why, I didn't have any 'Templates' configured on the panorama.  Once I configured one I was able to apply the syslog profile to the log forwarding profile.  Thanks all.  ... View more

After my discussions with palo alto TAC they have mentioned that we can configure the User ID on a single domain with other child domains only so we cannot integrate 2 completely different domains...     ... View more

@DPoppleton, I would probably just ensure that 445, 137, 139 are blocked to the untrust interface. I wouldn't even do this by app-id unless you need those ports open for something else to function correctly. As @Brandon_Wertz already pointed out, this shouldn't be allowed by your configuration anyways.  ... View more

Probably the closest thing to MSP from palo would be "GPCS."   I've never heard of them actually managing a customer's FW environment.  On the resident engineer, yeah it's more of an architecture / deployment / product SME.  They would / do perform daily support tasks though related to their responsibilities in a customer company.  They're a Palo employee, but daily tasks and responsibilities are agreed upon between Palo and the customer prior to the customer engagement. ... View more

Thank you everybody for your input.   My problem is now solve. In my case, 8.1 was not the culprit.   Here are my final configuration and working great going through the anti-spam cloud service in both directions. Line with the (MODIFIED) are the corrections to my original configuration.  To find out what was wrong, I had created an any-to-any temporary (5 minutes max) rule with the risk (i know). So I got the information in the trafic log. Logging is not enabled in the default 2 security rules.    As a documentation, my physical configuration is like that:   My MX records points to the ANTISPAM-CLOUD service.   INBOUND EMAILS ---> ANTISPAM-CLOUD ---> FW ---> MAIL-SERVER (Trueted Zone( MAIL-SERVER (Trusted Zone) ---> FW ---> ANTISPAM-CLOUD ---> OUTBOUD EMAILS   I have the following NAT rule for outgoing mails. src-zone : Servers-Zone dst-zone : Internet-Zone dst-interface : Internet1/1 src-addr : PRV-MAIL-SERVER dest-addr : outbound-mail-to antispam solution (MODIFIED) Service : any (MODIFIED) Src-translation: static-ip: PUB-MAIL-SERVER, bidirectional : no (Bidirectional=NO) and the following NAT rule for then incoming mails src-zone : Internet-Zone dst-zone : Internet-Zone (MODIFIED) dst-interface : Internet1/1 (MODIFIED) src-addr : ANTISPAM-ADDR-GROUP (MODIFIED) dest-addr : PUB-Mail-Server (MODIFIED) Service : any (MODIFIED) Src-translation: static-ip: PRV-MAIL-SERVER, bidirectional : no (Bidirectoional=NO) The Security Rules are (Outgoing email): src Zone : Servers-Zone src Address : PRV-MAIL-SERVER dst Zone : Internet-Zone dst-Addr : outbound-mail-to antispam solution (MODIFIED to go through the ANTISPAM) application : smtp and Service : application-default Action : Allow The Security Rules are (Incoming email): src Zone : Internet-Zone src Address : ANTISPAM-ADDR_GROUP dst Zone : Server-Zone dst-Addr : PUB-MAIL-SERVER (MODIFIED) application : smtp and Service : application-default Action : Allow   Thank you again, Michel ... View more

Ugh.   Thanks! ... View more

Hello, I would try a p[rint job from within the same zone and see if the speed changes, e.g. faster or the same. This would be an indication of potential slow downs caused by the firewall. I also have a similar setup but the print servers are remote and honestly we havent had nay complaints. Perhaps the users are just used to the slower printing?   Regards, ... View more