About MatthewSabin

MatthewSabin · ‎04-01-2024

This seems short sighted and fairly easy to have Expedition test. Expedition knows what tags are referenced in the dynamic group, and what tags the address object has assigned and can make that calculation. How do I propose a change/improvement to Expedition?

MatthewSabin · ‎11-04-2022

Back in 9.x we feel like the HA peers had no trouble passing LSVPN from active to passive when an HA failover event occurred. Now in 10.1 we're seeing about half of our sites fail to bring up the tunnels when HA moves from active to passive. I've been unable to find clear documentation on what to expect in an HA event as far as LSVPN is concerned. I'm guessing it's related to authentication-cookie expirations or a failure of the active to pass the cookie to the passive or something like that. Can anyone help me figure out what to check to predict whether a site will be able to roll LSVPN in an HA event? Cookie lifetime or whatever?

MatthewSabin · ‎01-13-2022

Will 10.0.x clients not be able to get authenticated (or renew certificates) until they're upgraded?

MatthewSabin · ‎09-24-2021

The image appears in my search in the software updates area on the support portal - you do need to be a Paloalto customer and I presume must be eligible to use the image in order to see it in the portal.

MatthewSabin · ‎11-03-2020

Thanks for the tip, but it turns out that my problem wasn't about syntax but method. Pasting all of the parts of a certificate into the configuration and comitting doesn't actually "install" a certificate, or so I've learned. Rather than pasting it in, TAC informs me that I must exit configuration mode and import the certificate as below: scp import certificate source-ip <scp server IP> remote-port <scp server port> from <user>@<scp server>:<path><filename> format <pem|pkcs12> [passphrase <pass phrase>] certificate-name <name> Whe the certificate is imported, that invalid syntax line magically materializes in the show output.

MatthewSabin · ‎10-21-2020

We'll need a little more detail to give you any help. In the meantime, take a look at this thread: https://live.paloaltonetworks.com/t5/general-topics/globalprotect-the-server-certificate-is-invalid/td-p/193204/jump-to/first-unread-message --Matthew

MatthewSabin · ‎10-19-2020

I have successfully loaded my device certificate and a CA certificate from the CLI - took some seraching for format of the certificate strings, but they're in there now. One problem. In a firewall I have previously set up I show (in set format) the certificate stanza: set shared certificate wanroot subject-hash ffffffff set shared certificate wanroot issuer-hash ffffffff set shared certificate wanroot not-valid-before "May 23 02:36:33 2020 GMT" set shared certificate wanroot issuer /CN=wanroot set shared certificate wanroot not-valid-after "May 18 02:36:33 2040 GMT" set shared certificate wanroot common-name wanroot set shared certificate wanroot expiry-epoch 2220921393 set shared certificate wanroot ca yes set shared certificate wanroot subject /CN=wanroot set shared certificate wanroot public-key "-----BEGIN CERTIFICATE-----[blahblahblah]-----END CERTIFICATE-----" set shared certificate wanroot algorithm EC I get an error entering the line "set shared certificate wanroot ca yes" - Invalid syntax. What is the correct way to declare a certificate a CA certificate from the CLI? --Matthew

MatthewSabin · ‎12-13-2017

We put it in lab last week - no issues to report. We'll start testing in the production environment after the holidays.

MatthewSabin · ‎05-19-2017

I'll revive this question - as the answers didn't actually relate. The Cisco ASA packet tracer allows you to propose a hypothetical flow and runs it through the engine as if it were real. Evaluating the NAT and route dicisions which would likely apply in addition to the policy/ACL allow/deny logic. It was very helpful to see if your configured configuration should pass traffic you are planning for prior to the actual traffic arriving.

MatthewSabin · ‎05-18-2017

Thankyou chris.russell for this one, we've been pulling our hair out trying to build an XML file "template" This will make our configuration push script much easier to build.

MatthewSabin · ‎04-13-2017

I'm about 2-months in, and I'm still looking for what I need to know. What I most want is the "How to think Palo Alto" guide - the biggest picture of how the parts fit together, and the minute details of what little "other-guy" process or method doesn't work here. I'll publish it myself once I think I have it 😉

MatthewSabin · ‎03-31-2017

i'll eat my crow now... Problem solved: Bad cable/ethernet jack on upstream router. All successful connections correlate with events where a coworker was forcing the lab traffic over a different link. His timing just made my troubleshooting harder. Layer 1 sure gets in the way when you're think 4 through 7.

MatthewSabin · ‎03-28-2017

I got my SE on the case and while studying packet-captures it suddenly seemed like the communication was great until the packets got big. We wondered if it could be an MTU problem. I put a laptop in the PA220's place and ran through the connections at MTU 1500 - AOK. Put the laptop in the client's place and had to drop down to 1400 to get the transfers to go. We couldn't find anywhere in the PA220 where MTU was set below default (1500?) but when we turned on jumbo-frames and set the GlobalMTU at jumbo-default, and rebooted, all flows pass properly. Yay, but really?!

MatthewSabin · ‎03-21-2017

Is there a better way than a screen shot? Here's the ruleset I have, only NetAdmin and NTP work at this time.

MatthewSabin · ‎03-20-2017

Sorry, I confused the thread there. There are three processes which my IoT device preforms: NTP, FTP, HTTPS NTP: get the time (obviously I suppose) - this works perfectly, UDP out, UDP in session times out, repeat FTP: check for updates, download and install them automagically - the check works, the GET to pull down update fails HTTPS: send telemetry to the cloud (the function we've installed the thingh to perform) - the client hello and key negotiation work fine, firewall stops passing as soon as encryption is engaged.

Member Since	‎03-15-2017 03:23 PM
Date Last Visited	‎04-18-2024 04:48 PM
Posts	24
Total Likes Received	9

Online Status	Offline
Date Last Visited	‎04-18-2024 04:48 PM

About MatthewSabin

Re: Clarification on what is considered and "unused" object.

HA and LSVPN in 10.1

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

Re: How to deploy the Palo Alto Firewall in GNS3

Re: Certificate ca status from the CLI

Re: Gateway <name> The server Certificate is invalid

Certificate ca status from the CLI

Re: Any issues not documented on version 8.0.6?

Re: PA equivalent of ASA packet tracer?

Re: Starting with Palo Alto Networks - What I wish I had known...

Re: PA equivalent of ASA packet tracer?

Re: Certificate ca status from the CLI

Re: Starting with Palo Alto Networks - What I wish I had known...

Re: Starting with Palo Alto Networks - What I wish I had known...

Re: TCP-RST-FROM-CLIENT

Re: Migration from HA pair PA-3220 running PanOS 9.1.16 to HA pair of PA-1420 running 11.0.2

Re: Migration from HA pair PA-3220 running PanOS 9.1.16 to HA pair of PA-1420 running 11.0.2

Re: How to merge multiples confing to one config

Re: How to onboard palo in to panorama

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

Re: Clarification on what is considered and "unused" object.

HA and LSVPN in 10.1

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

Re: How to deploy the Palo Alto Firewall in GNS3

Re: Certificate ca status from the CLI

Re: Gateway <name> The server Certificate is invalid

Certificate ca status from the CLI

Re: Any issues not documented on version 8.0.6?

Re: PA equivalent of ASA packet tracer?

Re: Starting with Palo Alto Networks - What I wish I had known...

Re: Starting with Palo Alto Networks - What I wish I had known...

Re: TCP-RST-FROM-CLIENT

Re: TCP-RST-FROM-CLIENT

Re: TCP-RST-FROM-CLIENT

Re: TCP-RST-FROM-CLIENT

Unlock your full community experience!

About MatthewSabin