About SARowe_NZ

SARowe_NZ · ‎11-12-2019

Thanks Steve!

SARowe_NZ · ‎11-11-2019

PANOS 8.1 Hi all - I have ongoing issues with trying to control downloading of files from CDNs. An easy example is .cab files used by Microsoft Office templates. When you download a template it goes off to a page off: templatesmetadata.office.net, but the actual file is stored in an Akamai cache. I have a policy matching a custom URL category, allowing that (I've also tried *.office.net), URL. This policy has no file blocking profile. This does not seem to work. However, if I exclude *.office.net from decryption it works around the issue and allows the download. I don't understand why it would match for the no-decrypt policy, but not the URL category policy. What is the correct and manageable way to allow downloads from CDNs where the container URL is known and trusted? Thanks, Shannon

SARowe_NZ · ‎09-29-2019

Hey all, I'm trying to get the config from a Cisco ISR 3925 into Expedition. It has picked up the services, but basically nothing else. I particularly want the objects, ip nat statements and acl's. I've tried the config from "show run" and "more system:running-config". What am I missing? Thanks, Shannon

SARowe_NZ · ‎06-17-2019

For others benefit it looks like this may be related to a network adapter driver "feature" called NS Offload. We'd originally eliminated this as it occurred on both wired and wireless connections, but through trial and error I've found that disabling this feature seems to have an immediate impact and resolves the performance issues. It seems this feature is on both the wireless and wired NIC. Tried latest/different drivers but issue persists. There is not much documentation on it: https://www.intel.com/content/www/us/en/support/articles/000005585/network-and-i-o/wireless-networking.html My assumption is it is causing the issue when traffic is "offloaded" from the tunnel adapter to the real physical adapter. The 4G adapter does not have this feature which is why it was a non-issue when connecting the VPN over 4G.

SARowe_NZ · ‎06-17-2019

Hey, Thanks for taking the time to think through this and provide such detailed responses - I certainly appreciate it. 1) Differences in matching security policies. Does all of the traffic match the same security rule? Is the server response insepction enabled on one policy but not the other? If multiple policies for the different users are bing hit, do they have the same threat profile? SR: All traffic matches the same security policy.I actually tried creating a security policy with no filtering and DSRI enabled (I even created a custom app with app-override to bypass L7 processing). Same result, so does not seem to be related to filtering or traffic processing through the policy engine. 2) Decryption Policies: Does the traffic match the same decryption policies? SR: There is no decryption turned on in this scenario. 3) Different agent settings getting applied based on source location, and therefore the client behaves differently? SR: Single portal/gateway so all clients get the same agent settings I've logged a TAC case and will see what they say. Suspect I could be in for the long haul with this one... Thanks again.

SARowe_NZ · ‎06-16-2019

Hi, No, it is a full tunnel. I did test with split tunnel, and creating host routes in the tunnel to the affected servers (this should ensure it checks that before the local network) but the result is the same. Note: even if this were the issue, the local network on the wired/wireless networks is not the same as the server network so it should not check these first. Thanks, Shannon

SARowe_NZ · ‎06-13-2019

Hi, It is slow performance over GP VPN, but seems very specific to smb traffic. Other traffic is fine. Overlapping subnets is not an issue in this case - the local network is different to the server subnet where the smb traffic is delivered from. It is consistently slow over both wired and wireless networks (as the underlying internet), but, interestingly, 4G / cellular data does not have the same issue. I don't know how to explain that, as the wired and wireless networks we have tested with have no apparent commonality, they are all completely separate. Thanks, Shannon

SARowe_NZ · ‎06-13-2019

Hi hcao, Just wondering if you found a solution to this? We seem to be having the same issue but am unable to diagnose the root cause. Thanks, Shannon

SARowe_NZ · ‎05-16-2019

I've been getting this as well. Your suggestion definitely allowed me to start MariaDB and log in to the GUI, thanks; but seems Expedition is corrupted "Remote Exception" with no additional detail as soon as I log in, and much of the dashboard and all of the Internal Checks is broken. Thanks anyway, looks like I'll have to rebuilt.

SARowe_NZ · ‎02-25-2019

Hi thanks for replying - I've made sure we're using the system account, not a service account. I've logged it with TAC and will update here if I get a resolution.

SARowe_NZ · ‎02-25-2019

Hey did you get this fixed? I'm having the same issue. Thanks! Shannon

SARowe_NZ · ‎07-09-2018

Hi, Since upgrade to PANOS 8.1.2 RADIUS (for firewall administration) tries to connect to the IPv6 address of the Microsoft NPS server: 2018-07-10 09:33:14.305 +1200 debug: pan_make_radius_request_buf(pan_authd_radius_prot.c:384): RADIUS request type: PAP 2018-07-10 09:33:14.307 +1200 Warning: _handle_nas_ip(pan_authd_radius_prot.c:114): fe80::d6f4:beff:fec3:8beb%eth0: pan device nas IPv6 not found 2018-07-10 09:33:14.307 +1200 debug: pan_make_radius_request_buf(pan_authd_radius_prot.c:436): Optional attribute NAS-IP "fe80::d6f4:beff:fec3:8beb%eth0" is not in request, which is ok since NAS-Identifier "RADIUS-FirewallAdmins" is in it 2018-07-10 09:33:14.307 +1200 debug: _create_rw_sock(pan_authd_conn_mgmt.c:1446): create a UDP socket: 13 2018-07-10 09:33:14.307 +1200 Error: _create_rw_sock(pan_authd_conn_mgmt.c:1490): Retry 1: connect to server 2402:9900:311:1244:5003:9543:48d4:2af3:1812: errno=101(Network is unreachable) 2018-07-10 09:33:15.308 +1200 Error: _create_rw_sock(pan_authd_conn_mgmt.c:1490): Retry 2: connect to server 2402:9900:311:1244:5003:9543:48d4:2af3:1812: errno=101(Network is unreachable) 2018-07-10 09:33:16.309 +1200 Error: _create_rw_sock(pan_authd_conn_mgmt.c:1490): Retry 3: connect to server 2402:9900:311:1244:5003:9543:48d4:2af3:1812: errno=101(Network is unreachable) 2018-07-10 09:33:17.310 +1200 Error: _create_rw_sock(pan_authd_conn_mgmt.c:1497): reached max number of retries (3) to connect to server 2402:9900:311:1244:5003:9543:48d4:2af3:1812 The result is the request times out as the server does not respond on IPv6. I can't see how to stop this behaviour, or what is causing it. Note: If I change the RADIUS profile to an IP address, rather than a FQDN it works fine. If I perform a ping of the FQDN, from the MGT interface on the PAN, it resolves correctly to the IPv4 address so it does not seem to be a DNS issue. Note: We have not configured granular service routes, all services use the MGT interface. Any ideas what is causing this, and how I can stop it trying to use IPv6? Cheers, Shannon

SARowe_NZ · ‎03-25-2018

Hi, Sorry I think a bit more clarity is required. If NAT-T is required, but not enabled, the ipsec/phase2 should not stand up at all and your users wouldn't be able to get at anything (not simply RDP). NAT-T should impact the establishment of your new tunnels, I don't see how (short of a very unusual bug) that it would affect encap traffic inside another tunnel. Did the new tunnels fully establish? Could users access services over the new tunnel? Were services other than RDP affected on the other (historical) tunnels? Have you done a config audit and compared the last known working config, to the new config to verify that that was the only change? Are all your tunnels using static peer IP addressing, or are some of them configured as dynamic? Thanks, Shannon

SARowe_NZ · ‎03-25-2018

If you traceroute and look at the associated session, can you see it egressing on the ISP1 interface, with the SNAT address of your new IP? If so, I think it sounds like the Internet does not have a route back to your new IP. Either your ISP will need to advertise this on your behalf, or you are using BGP. If the latter, have you added the new IP into your export statements for BGP and can you confirm it is being advertised (you can see this from the BGP RIP under network > routers)? Cheers, Shannon

SARowe_NZ · ‎01-18-2018

Perfect thank you! Suprised those articles did not come up in my searches.

Member Since	‎03-21-2017 04:29 PM
Date Last Visited	‎04-04-2024 03:51 PM
Posts	80
Total Likes Received	11

Online Status	Offline
Date Last Visited	‎04-04-2024 03:51 PM

About SARowe_NZ

Re: XQL Query: Looking at Multiple Events

Re: XQL Query: Looking at Multiple Events

Re: XQL Query: Looking at Multiple Events

Re: XQL Query: Looking at Multiple Events

XQL Query: Looking at Multiple Events

Re: Detect where a process has been killed

Re: Detect where a process has been killed

Detect where a process has been killed

Re: VRRP with Cisco router LAN interface

Re: Errors - ROOT CA authority untrusted / invalid

XQL Query: Looking at Multiple Events

Re: Errors - ROOT CA authority untrusted / invalid

Re: Errors - ROOT CA authority untrusted / invalid

Re: FTP (SCP) Error

Re: Unable to resolve FQDN after upgrading PAN OS to 10.1.5 - " ping: unknown host FQDN"

Re: XQL Query: Looking at Multiple Events

Re: XQL Query: Looking at Multiple Events

Re: Detect where a process has been killed

Re: No "Apps Seen" / Policy Optimizer data on Panorama

Re: No "Apps Seen" / Policy Optimizer data on Panorama

Re: Allow downloading from Akamai or other CDNs

Allow downloading from Akamai or other CDNs

Cisco ISR to PAN

Re: Slow accessing file shares using Global Protect VPN client

Re: Slow accessing file shares using Global Protect VPN client

Re: Slow accessing file shares using Global Protect VPN client

Re: Slow accessing file shares using Global Protect VPN client

Re: Slow accessing file shares using Global Protect VPN client

Re: Incorrect User or Password from GUI

Re: Crednetial Phishing Agent Permissions

Re: Crednetial Phishing Agent Permissions

PANOS 8.1.2 RADIUS / IPv6

Re: nat-t not enabled on vpn tunnel has impact on other tunnels

Re: I've bought 1 more public IP range but cannot use it

Re: site-to-site VPN / no "IKE Info"

Unlock your full community experience!

About SARowe_NZ