About mike406

mike406 · ‎01-25-2019

I don't follow you. I don't have access to each end, I only have access to my end. I know the external IP and the local subnets of the other end. The other end is generally not a PA firewall. Can you give an example of what should be set for IPsec Tunnel -> Tunnel Monitor -> Destination IP ?

mike406 · ‎01-24-2019

Is it possible to monitor VPN tunnels using an internal source IP on my tunnel interface and the external IP of the other system? I won't always have control/access to the other side of the tunnel, I may only know the local subnet(s) and the external IP.

mike406 · ‎01-24-2019

I am getting ready to do a failover test. Runnig a pair of PA-5220s in HA Active/Passive. I see posts asking about what happens with IPSec VPN connections, but they are a few years old. Just want to confirm that with 8.0 the failover is still seamless and should not affect IPSec VPNs...?

mike406 · ‎10-29-2018

Just curious. The recommended QUIC rules set the action to 'deny', but the first rule is for service udp 80/443 any application. Is there a reason this is a 'deny' and not a 'drop'? Reference HOW TO BLOCK QUIC PROTOCOL https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClarCAC What a difference a Deny makes https://live.paloaltonetworks.com/t5/Community-Blog/What-a-difference-a-Deny-makes/ba-p/188811

mike406 · ‎09-24-2018

How does the dns-wildfire threat category work? I've seen a log entry, but there isn't any traffic to the sinkhole IP. The action is sinkhole and reported as generic:malicious.domain1. I have confirmed that sinkhole does work for regular threat category dns and is reported as Suspicious DNS Query (generic:malicious.domain2).

mike406 · ‎07-27-2018

I am trying to make a more meaningful executive style report for user activity and web browsing. Currently the 'User Activity' report has columns which are not availble when generating a custom report; estimated browse time, count, bytes, etc. If I could create custom reports using these fields and filter or set thresholds I could remove a lot of extraneous information - advertisements, 1 count hits, less than 60 second browse time, less than 1MB bytes, etc. and the report would become a lot shorter and easier to digest. Also, the ability to generate 'user activity' reports when using a group would be very useful. Currently group reports are aggregate only and I would like to be able to show each user's activity that is a member of the group. Are there ways to achieve this that I am not seeing?

mike406 · ‎07-05-2018

Any idea when 8.1 will become recommended?

mike406 · ‎07-03-2018

I am considering upgrading from 8.0.x to 8.1.x, but this issue seems like it might be a show stopper. In 8.1.x known issue PAN-89471 "Firewalls reboot because the userid process restarts too often due to a socket binding failure that causes a memory leak. Workaround: Terminate the process that is using port 5007." This seems to read "userid causes your firewall to reboot" Can someone explain this issue and the likelihood of the memory leak causing a reboot? Are there certain/specific use-cases where this is more likely to happen? Mike

mike406 · ‎05-29-2018

Just downloaded the tgz file. Any way to verify download? Hashes?

mike406 · ‎04-10-2018

I have been using 1G UTP and it's working. No synchronization issues or anything like that, but it depends on your setup. Make sure to read the posts in this thread and the configuration guide and if you're still not sure consult with tech. support or your sales SE.

mike406 · ‎03-29-2018

I think I have a solution. I created a bogus auth_profile with the domain set to a non-existant name and the allow list populated with only a non-matching bogus user. This seems to work.

mike406 · ‎03-29-2018

Does anyone have a running list of service accounts used/needed for best practices? User-ID (per domain or per domain trust) LDAP profile (per domain for Group Mappings) What else?

mike406 · ‎03-29-2018

I think scheduling might help, but it's not really what I'm after. I need to be able to enable/disable a local user account to allow/deny login to the firewall to perform administration tasks.

mike406 · ‎03-28-2018

Is it possible to disable a user (local account)? I don't see this option in the web gui, but thought it might be something that can be done using the cli. I need to be able to allow access for specific reasons at specific times and disable access when not needed. Changing the user's password each time is the only other option I can think of so far.

mike406 · ‎02-08-2018

I've got the web gui configured for now. Had to gen a new CSR and make sure to include SANs for web gui, etc. Next step is to configure GlobalProtect with the cert.

Member Since	‎12-19-2017 11:58 AM
Date Last Visited	‎05-24-2019 11:24 AM
Posts	36

Online Status	Offline
Date Last Visited	‎05-24-2019 11:24 AM

About mike406

Re: CONFIG logs and syslog

Re: CONFIG logs and syslog

Re: Granular URL Monitoring

Re: Granular URL Monitoring

Granular URL Monitoring

Re: VPN remote peer with a LAN address

Re: VPN remote peer with a LAN address

VPN remote peer with a LAN address

Re: Disable SIP ALG on non-standard port 10060

Re: Block TLD and Security Profiles in Monitor and Log Details

Re: Tunnel monitoring using internal src to external dst?

Tunnel monitoring using internal src to external dst?

8.0 HA Failover and IPSec VPNs

QUIC deny vs drop

Sinkhole dns-wildfire

Missing fields in custom reports that would be useful

Re: PAN-89471 userid causes firewall to reboot ?

PAN-89471 userid causes firewall to reboot ?

Verify download?

Re: PA-5220 HA Config Ethernet or Crossover Cables?

Re: Disable User

List of Service Accounts

Re: Disable User

Disable User

Re: SSL CSR SAN Multiple Uses

Unlock your full community experience!

About mike406