About TomYoung

TomYoung · ‎08-24-2021

Thanks @VishnuPS, This was my last post. "This line (6th from bottom) looks like your issue. "curl error: Could not resolve host: s0000.urlcloud.paloaltonetworks.com" Can you run the command 'ping host s0000.urlcloud.paloaltonetworks.com'? This will test DNS. The source address used will be your management interface. Could you also run the command 'debug dataplane internal vif route 250' to verify that you do not have any service routes installed? The output should be blank. If not, please post." Could you please run those commands? Thanks!

TomYoung · ‎08-23-2021

Hi @VishnuPS, Did you see my last post? I think those commands will give us more insight to the issue. Thanks!

TomYoung · ‎08-23-2021

This line (6th from bottom) looks like your issue. mp devsrv.log 2021-08-22 08:35:55 2021-08-22 08:35:55.365 +0530 curl error: Could not resolve host: s0000.urlcloud.paloaltonetworks.com Can you run the command "ping host s0000.urlcloud.paloaltonetworks.com"? This will test DNS. The source address used will be your management interface. Could you also run the command "debug dataplane internal vif route 250" to verify that you do not have any service routes installed? The output should be blank. If not, please post.

TomYoung · ‎08-22-2021

Interesting. PAN-DB should update every 5 minutes. Did the issue, 16 hours later, correct itself? What does Monitor > Logs > System ( subtype eq url-filtering ) show? Did you mean the "show url-cloud status" command? Since you see a cloud server, it sounds like the status of the cloud connection is "connected", could you confirm? If you are connected and still do not have the latest version, you can manually request a download -> https://docs-new.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/troubleshoot-url-filtering/problems-activating-pan-db.html, and see what happens. If you are not connected, go here -> https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/troubleshoot-url-filtering/pan-db-cloud-connectivity-issues.html.

TomYoung · ‎08-21-2021

This post has long been solved, but for future onlookers this table is awesome to see what use cases and protocols can be used for MFA support. https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table.html

TomYoung · ‎08-21-2021

On MacOS (very much like Linux) I use the command "netstat -r | grep tun" to see the routes to utun1 (on my laptop). That lets me know that the OS has installed the routes. If not, check the GP gateway configuration. The process is probably very similar in Linux, although the tunnel interface may be different.

TomYoung · ‎08-21-2021

Excellent point. It also makes sense that you cannot source a ping from the data interfaces on the standby since the IP addresses are active on the active. So, the standby never sends out a ping which is why it is not logged.

TomYoung · ‎08-21-2021

Excellent responses! I think @SebRupik's point was that if you set the output format to set, then you can see the proper syntax for configuration. Another excellent CLI option is to use the context sensitive help "?" to see what options are available. You can view sections of the config such as "show network dhcp". myfirewall# show ? address address address-group address-group application application application-filter application-filter application-group application-group application-tag application-tag authentication-object authentication-object captive-portal captive-portal cloud-identity-engine cloud-identity-engine device-object device-object ...

TomYoung · ‎08-19-2021

Yes, it has been done many times as long as the latency is fine. PANW unofficially recommends 20ms or better between firewalls. Customers have reported it works fine with 80-120ms. Check out this video starting at 1 hour 15 minutes. Bandwidth should also be considered. https://www.youtube.com/watch?v=4hFQypgOAGk&t=4665s

TomYoung · ‎08-19-2021

You are not getting ping responses and the neighbor is not up. These are the root issues. You should see the traffic, permit or deny, in the Monitor tab. This traffic should be allowed by the intrazone-default rule. Have you configured that rule to log at session end?

TomYoung · ‎08-17-2021

Great question. SFTP actually uses SSH for encryption. App-ID recognizes it as SSH. However, it is not FTP over SSH. The protocol is different. If PANW added the SFTP protocol to AV, it could be scanned if SSH Proxy were configured.

TomYoung · ‎08-15-2021

I have had no problem deleting unused objects in Expedition. I have done it many times. Start with the groups first. If my memory serves me correctly, when I delete an unused group, I do a refresh (bottom right) and the member objects then show up as unused.

TomYoung · ‎09-04-2020

You are THE MAN! This answer should be marked as the solution. I love clearing all commit errors. It should be emphasized more in best practices.

TomYoung · ‎01-15-2020

Expedition can make changes directly on the firewall. It has been a while since I have done it, but I believe you add the device under Devices and make the changes under your project > Export > API Output Manager. You should know the difference between Atomic and SubAtomic changes. You could also use "show | match <object-name>" in configuration mode (set format) and see where it is used in the configuration. If the only line is the address object, it is not used. You could also delete the object. If it is used, you will get an error right away. If not, the delete will be accepted in the candidate configuration. UPDATE: I saw this on Reddit, and it works. Select all the objects. (This may not be quick depending upon the number of objects.) Select Delete and Yes. All unused objects are deleted. All used objects produce an error and are kept. Use Device > Config Audit to see which objects were deleted. Once Expedition is setup, that is the quickest and easiest.

TomYoung · ‎11-25-2019

Thank you, sir.

Member Since	‎11-15-2017 11:37 PM
Date Last Visited	‎01-21-2026 09:42 AM
Posts	1,556
Total Likes Received	602

Online Status	Offline
Date Last Visited	‎01-21-2026 09:42 AM

Unlock your full community experience!

About TomYoung