About jesuscano

Hi,   We were checking the GP users in PA and we realise that the "Private IP Address" for some users is 0.0.0.0. Another users have the correct private range (10.90.x.x). VPN is working fine but i would like to know why PA assigns 0.0.0.0 ... View more

Hi,   We have a VPN between PA and cisco router. THE VPN is UP but we are having a strange behaviour with Phase1 lifetime. WHen the lifetime phase1 expired (24hour), the phase1 goes down in CISCO side, and we need to renegotiate pahse1 in order to get up again. These are the events:   2020-03-02 12:05:13 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 1.1.1.1[500]-2.2.2.2[500] cookie:92d6267d5c224c97:fead51a58acac9ee <==== 2020-03-02 12:05:13 [INFO]: ====> PHASE-1 SA DELETED <==== ====> Deleted SA: 1.1.1.1[500]-2.2.2.2[500] cookie:92d6267d5c224c97:fead51a58acac9ee <==== 2020-03-02 12:05:13 [PROTO_ERR]: Informational exchange received from unknown peer. 2020-03-02 12:05:13 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:17 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:23 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:27 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:33 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:37 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:43 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:47 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:52 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:57 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:58 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS RESPONDER, MAIN MODE <====   WE have DPD enabled with defaulte paramethers, Do you have any idea about this issue in phase1 ... View more

HI,   We have a alarm about ocuppation in root partition. I tried to delete any files to release memory but there is not any "big files", no cores, no pcaps, just some logs.   So how can i release memory for this partition? whats is a alarm value for this root?   Filesystem Size Used Avail Use% Mounted on /dev/md3 3.8G 3.3G 314M 92% / /dev/md5 7.6G 4.6G 2.6G 64% /opt/pancfg /dev/md6 3.8G 2.3G 1.4G 63% /opt/panrepo tmpfs 2.0G 210M 1.8G 11% /dev/shm ... View more

Hi,   Im having an issue upgrading PA. Im starting to think this is a config deployment issue. We have a cluster Active/passive. This FWs are connected to CISCO nexus. Both FWs are in differents datacenter. The FWs are in 8.0.13 and we are trying to upgrade to 8.1.10. The issue is that when we upgrade the passive node to 8.1.10 the VirtualWires (ae interfaces) are not getting up in nexus, we can see the VW OK in FW. And if we failover to the passive node upgraded we lost the service. This is the interface/Vw config:     ethernet1/5 68 1000/full/up  ethernet1/6 69 1000/full/up  ethernet1/7 70 10000/full/up  ethernet1/8 71 10000/full/up  ethernet1/9 72 1000/full/up  ethernet1/10 73 1000/full/up    ae1 16 1 vr:default 0 N/A ae1.110 128 1 untrust vr:default 110 1.1.1.1/24 ae1.111 129 1 untrust vr:default 111 2.2.2.2/24 ae1.112 142 1 untrust vr:default 112 3.3.3.3/24 ae1.170 133 1 trust vr:default 113 4.4.4.4/24 ae2 17 1 vw-in vwire:ae3 0 N/A ae3 18 1 vw-out vwire:ae2 0 N/A   aggregation groups: 3 ae1 members: ethernet1/7 ethernet1/8 ae2 members: ethernet1/9 ethernet1/10 ae3 members: ethernet1/5 ethernet1/6 Is there any limitation with ae interfaces in Virtualwire Palo Alto?. We can see the interfaces OK in Palo ALto, but in nexus the interfaces are down.    any idea?    ... View more

Hi,   I wanted to comment an upgrade issue that its making me crazy. We have a cluster A/P in 8.0.8, these devices are in diferents datacenter. We have tried to upgrade this cluster 2 times with no success. We upgrade the passive unit to 8.1.10 and everything is ok, but when we do the failover in order to put the upgrade node as active, all the VirtualWires interfaces are not working. We have 2 LACPs in VW in this PAlo Alto. So when the node is active in 8.1.10 the 4 VirtualWires interface stio working. Interfaces look UP. But we dont see any traffic.   Any known issue with 8.1.x and VirtualWire issue? any advice or action plan. We opened a TAC case but not a great help 😞 ... View more

Hi,   We just realised that our ESM shows "agnet service status changes": Disconnected->Unlicensed". But we have a current licenses. How can tshoot this issue?     ... View more

Hi,   I have a question related to Wildfire: We need wildfire statistics during the year 2019, inspected files, files with malware, files with grayware and files with pishing. Is there any way to collect this info? from PA or wildfire web? I can not find it 😞 ... View more

HI,   We have a VPN from PA to Oracle cloud. We realised that this VPN goes down each 8 hours and it takes so long to renegotiate. From Oracle side tells this: "  early November, OCI implemented enhancements to IKE, including support for additional DH groups and support for IKEv2. Consequently, the IKE proposal payload from OCI can exceed 1500 bytes. Due to this implementation, it is possible that the proposals become fragmented and some CPEs may reject them. Consequently, you will want to check your CPE's WAN interface and assess whether or not fragmented packets are accepted. If they are not, we encourage you to allow fragmented packets on that interface and let us know whether or not that resolves the problem. We will now await your reply regarding this matter."   So its there any action that we can perform in PA? ... View more

We have a legitime application which is running a script. This script and the chain is detected by traps as threat. So we would like to configure an exception for this     cmd.exe --> cscript //E:JScript //nologo "C:\ProgramData\signature\sign.bat"   So its possible to add this exception? where it can be configured? We want to do the exception in this script. ... View more

Hi,   We have a legitime application which is running a script. This script and the chain is detected by traps as threat. So we would like to configure an exception for this     cmd.exe --> cscript //E:JScript //nologo "C:\ProgramData\signature\sign.bat"   So its possible to add this exception? where it can be configured? ... View more

Hi, we are trying to generate a new elf-signed certificate in Panorama and we receive this error: Failed to insert certificate into configuration. Failed to find beginning of certificate. Make sure certificate starts with BEGIN CERTIFICATE tag.   This is the certificate and the error:       Why are we receiving this error?   ... View more

Hi,   Im trying to configure a log-link web with the character "?" in the middle but the PA is deleting this character "?" Do you know if there is any way to put the question mark character "?" in the URL   for example this: set deviceconfig system log-link VirusTotal.Dst url  https://www.virustotal.com/en?/ip-address/ {dst}/information ... View more

WE have configured OSPF between a Palo Alto firewall and the CORE to which it is physically connected, within this CORE there are several VRFs that interconnect with the firewall (VRF1, VRF2, VRF3). Is there a way to filter the default route in the Palo Alto firewall so that it is only sent to the interface that interconnects with the VRF2 in the CORE? ... View more

We are launching the Microsoft AIP (Azure Information Protection) solution to encrypt documents, etc. The point is that this is working from the office, but when we are with Globalprotect (with the tunnel up) the PC is hung (not only when trying to encrypt an email or a Word document, but simply by going to Outlook and put us on an already protected email). In the Firewall I have not seen anything, if the client hangs I understand that it is something local to the PC. If we stop the PANGPS Service works correctly.     ... View more

Hi,   We just upgraded from 8.0.11 to 8.1.7. And in this new version 8.1.7 the CPU MGMT is high (90-100%). I attach the top output:   what is "pan_task"? its consuming lot of CPU. Any bug related to this in 8.1.7?   show system resources top - 16:11:02 up 2:06, 2 users, load average: 5.21, 5.52, 5.58 Tasks: 161 total, 6 running, 155 sleeping, 0 stopped, 0 zombie Cpu(s): 65.7%us, 1.2%sy, 5.7%ni, 27.2%id, 0.1%wa, 0.0%hi, 0.1%si, 0.0%st Mem: 4119472k total, 3498192k used, 621280k free, 59756k buffers Swap: 2008088k total, 888k used, 2007200k free, 1628128k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 3318 20 0 74712 35m 8424 R 100.0 0.9 124:55.50 pan_task 3320 20 0 49940 10m 8360 R 100.0 0.3 124:55.80 pan_task 3322 20 0 49984 11m 8448 R 100.0 0.3 124:55.46 pan_task 3319 20 0 49940 10m 8304 R 99.4 0.3 124:55.79 pan_task 3321 20 0 50112 10m 8272 R 99.4 0.3 124:55.59 pan_task 2996 20 0 40220 5376 3876 S 5.7 0.1 0:32.50 ehmon 3562 20 0 553m 209m 127m S 1.9 5.2 1:20.35 useridd 11059 20 0 17984 7036 1900 R 1.9 0.2 0:00.04 top 1 20 0 3212 736 688 S 0.0 0.0 0:00.30 init 2 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd 3 20 0 0 0 0 S 0.0 0.0 0:01.66 ksoftirqd/0 5 0 -20 0 0 0 S 0.0 0.0 0:00.00 kworker/0:0H 7 RT 0 0 0 0 S 0.0 0.0 0:00.08 migration/0     ... View more