About TomYoung

I can't find a PANW doc, but there are a few community posts which state that URL categories in the security policy only work with HTTP and HTTPS.  https://live.paloaltonetworks.com/t5/general-topics/custom-url-category-with-non-http-and-https-port/td-p/350774 https://live.paloaltonetworks.com/t5/general-topics/security-policy-using-wildcard-destinations-and-non-http-https/td-p/284726 So, I think the issues stem from trying to apply URL filtering to SFTP.  SFTP is not FTP over TLS.  So, there will be no URL in the packet.   On a related issue, "On Palo Alto Networks devices, PAN-DB URL Filtering is applied on 2 major protocols: HTTP and HTTPS (SSL)." https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRZCA0 At least that doc specifically states the required apps.  However, it is URL filtering in security profiles, not URL categories in the security policy.   You could try an address group of FQDN objects.  I think that is what @OtakarKlier meant.  Those will get resolved to IP addresses, but it should work.   ... View more

This would save you lots of time, but requires 2 Panoramas -> https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/set-up-panorama/install-content-and-software-updates-for-panorama/install-updates-automatically-for-panorama-without-an-internet-connection.html.   I wonder if you could do similar things on the NGFW?  [Edit.]  It looks like you cannot specify an SCP Server Profile or Dynamic Update source on the NGFW.   [Edit2.]  Or you could manually update the files to 1 Panorama if all files have to be checked in to an air gap environment.  The Panorama would dynamically push them out to the firewalls.  You could even use an SCP server if that helps you automate the upload. ... View more

It sounds like you want the traffic to go out interface 1 and come in interface 3, correct?  Please confirm and I can show you what to fix.  Also, do you have 2 virtual routers? ... View more

Cool idea!  Just like the GitHub code on HTTP response codes for visibility.   This configuration works for Type 8 and Type 0:   tyoung@fdslcofw01# show | match 4400 set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to value 0 set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to context icmp-rsp-code set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to negate no set threats vulnerability 44000 signature standard icmp-rsp-code order-free yes set threats vulnerability 44000 signature standard icmp-rsp-code scope protocol-data-unit set threats vulnerability 44000 default-action alert set threats vulnerability 44000 threatname "ICMP Type 0" set threats vulnerability 44000 severity informational set threats vulnerability 44000 direction both set threats vulnerability 44000 affected-host client yes set threats vulnerability 44000 affected-host server yes set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match pattern 8 set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match context icmp-req-data set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match negate no set threats vulnerability 44008 signature standard icmp-req-data order-free yes set threats vulnerability 44008 signature standard icmp-req-data scope protocol-data-unit set threats vulnerability 44008 default-action alert set threats vulnerability 44008 threatname "ICMP Type 8" set threats vulnerability 44008 severity informational set threats vulnerability 44008 direction both set threats vulnerability 44008 affected-host client yes set threats vulnerability 44008 affected-host server yes set profiles vulnerability Internal-VP threat-exception 44008 action default set profiles vulnerability Internal-VP threat-exception 44008 packet-capture disable set profiles vulnerability Internal-VP threat-exception 44000 action default set profiles vulnerability Internal-VP threat-exception 44000 packet-capture disable [edit] tyoung@fdslcofw01# exit Exiting configuration mode tyoung@fdslcofw01> show bad-custom-signature bad performance custom signature list: TID: 44008, Vsys 1, Context: icmp-req-data, Pattern: 8   However, I did get the following commit warning:       Warning: one or more custom signatures have big performance impact.      Please see details in CLI "show bad-custom-signature"   You can see the command output above.   There is one strange behavior.  I enabled the signatures in 1 VP, but it logs for all.  See step 4 in https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/custom-application-and-threat-signatures/create-a-custom-threat-signature.html#id47dc678c-114e-4e57-a4ad-a5ed6962d770.     ... View more

That's disappointing.  It looks like we had a DNS error at one point. Is this a single firewall or HA pair? ... View more

Check for errors under Monitor > Logs > System.  Maybe their is an authentication timeout or something. ... View more

Thanks @VishnuPS, This was my last post.   "This line (6th from bottom) looks like your issue. "curl error: Could not resolve host: s0000.urlcloud.paloaltonetworks.com" Can you run the command 'ping host s0000.urlcloud.paloaltonetworks.com'? This will test DNS. The source address used will be your management interface. Could you also run the command 'debug dataplane internal vif route 250' to verify that you do not have any service routes installed? The output should be blank. If not, please post." Could you please run those commands? Thanks! ... View more

Hi @VishnuPS,   Did you see my last post?  I think those commands will give us more insight to the issue.   Thanks! ... View more

This line (6th from bottom) looks like your issue.   mp devsrv.log 2021-08-22 08:35:55 2021-08-22 08:35:55.365 +0530 curl error: Could not resolve host: s0000.urlcloud.paloaltonetworks.com Can you run the command "ping host s0000.urlcloud.paloaltonetworks.com"?  This will test DNS.  The source address used will be your management interface.  Could you also run the command "debug dataplane internal vif route 250" to verify that you do not have any service routes installed?  The output should be blank.  If not, please post. ... View more

Interesting.  PAN-DB should update every 5 minutes.  Did the issue, 16 hours later, correct itself? What does Monitor > Logs > System ( subtype eq url-filtering ) show? Did you mean the "show url-cloud status" command? Since you see a cloud server, it sounds like the status of the cloud connection is "connected", could you confirm? If you are connected and still do not have the latest version, you can manually request a download -> https://docs-new.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/troubleshoot-url-filtering/problems-activating-pan-db.html, and see what happens. If you are not connected, go here -> https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/troubleshoot-url-filtering/pan-db-cloud-connectivity-issues.html.   ... View more

This post has long been solved, but for future onlookers this table is awesome to see what use cases and protocols can be used for MFA support.  https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table.html   ... View more

On MacOS (very much like Linux) I use the command "netstat -r | grep tun" to see the routes to utun1 (on my laptop).  That lets me know that the OS has installed the routes.  If not, check the GP gateway configuration.   The process is probably very similar in Linux, although the tunnel interface may be different. ... View more

Excellent point.  It also makes sense that you cannot source a ping from the data interfaces on the standby since the IP addresses are active on the active.  So, the standby never sends out a ping which is why it is not logged. ... View more