About torm

torm · ‎10-03-2014

Hi Tom, Thanks for your replay. I was not able to add the log collector of the passive Panorama through the web-gui, as it didn't show up under "device log forwarding" tab. Using the CLI I was able to add the collector to the collector group with the command "set log-collector-group group_name logfwd-setting collectors serialnumber", and successfully commit the changes to Panorama. However, the collector group commit fails, because the log collector of the passive Panorama is not connected to the active. Screen dump is from the active Panorama. The status is the same on the passive, only that it's the other collector that's connected. Any ideas? Regards, Tor

torm · ‎10-03-2014

Hi, I'm having a problem with adding the log collectors in a Panorama M-100 HA setup. I have two M-100 appliances, both in mixed mode. HA is configured and is working as expected. The problem is that I cannot get M-100 #1 to connect to the log collector on M-100 #2 and vice versa. (see attached photo) I'm currently running 6.0.2, and both devices are on the same subnet, so there should not be any network issue. Is this a supported setup, or/and am I doing something wrong here? - Tor

torm · ‎09-30-2014

Sly_Cooper : Have you been able to make vulnerability signatures (regex) for this? I'm looking to do the same thing, and if you have something to share, it would be great!

torm · ‎09-26-2014

If you're just going to do it manually from the CLI, you can just go to configure mode and use the following command "set rulebase captive-portal rules MY_CP_Policy action no-captive-portal" (command will vary a bit if you have enabled vsys on your device). Then trigger a commit. If you are going to use the API, you could easily find the restapi url using the API-browser at https://firewallIIP/api It will be somehting like this: /api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/captive-portal/rules/entry[@name='MY_CP_Policy']/action/member[@name='no-captive-portal']

torm · ‎09-26-2014

I'm seeing the same behaviour in our botnet report. Mulitiple users repeatedly visiting supposedly malicious URLs. All URLs seem to be related to advertisement or cnd. Running pan-db 2014.09.25.451. We have a open case with TAC regarding this. Will let you know how it goes.

torm · ‎09-24-2014

The app-id "unknown-udp" can be used to allow/block UDP traffic that did not match any other application signature. That does not mean all UDP traffic. If you want to allow all UDP traffic,you should create a service object containing the port range 1-65535.

torm · ‎08-25-2014

Have you been able to resolve this? I'm also getting the "unsupported command" message when running operation commands with the API. I'm running 6.0.4 on the firewall.

torm · ‎08-25-2014

Have you been able to resolve this? I'm currently working with a project where I'm running the same challenge. I need to add ts-agents to the Panorama configuration as a new servers are installed and remove/disable the agents when the servers are offline. Have you figured out a good way to do this? I would really appreciate if anyone could share their experiences with this.

torm · ‎08-25-2014

I'm currently working with a project where I'm running into the same issue. I need to add ts-agents to the Panorama configuration as a new servers are installed and remove/disable the agents when the servers are offline. Have you figured out a good way to do this? I would really appreciate if anyone could share their experiences with this. I suppose it would be possible to write a script using the API to do this.

torm · ‎06-17-2014

Thanks for your reply! Are able to authenticate to the portal using bot username/password and computer/client certificate? Or are you using just username/password for the portal? Read through the admin guide one more time, and it seems like I got it wrong, and that you donæt need a certificate profile on the portal for pre-logon after all. Is this correct? "After authentication succeeds, the portal pushes the client configuration to the agent along with a cookie that will be used for portal authentication to receive a configuration refresh. Then, when a client system attempts to connect in pre-logon mode, it will use cookie to authenticate to the portal and receive its pre-logon client configuration."

torm · ‎06-12-2014

For inbound decryption, the certificate needs to match the certificate on the web-server. For outbound decryption (SSL Forward Proxy), the certificate on the PA should be a sub-ordinate CA signed be your internal CA. You can also use a self-signed CA-certificate, but then this needs to be distributed to your clients as a trusted root ca. You can get more info from this document: How to Implement SSL Decryption

torm · ‎06-12-2014

Hi, We are running Global Protect with pre-logon. The GP Portal needs to allow users to login from "clean" computers without machine certificates, and at the same time allow pre-logon user(and other users) to authenticate with machine certificate. This has in 5.0 been done by using a certificate profile with the username field set to "none". This was working fine in 5.0, but after upgrading to 6.0 I get a "valid certificate is required" when accessing the GP portal page through a web-browser. I found the following article describing change in default behavior from 4.1 to 5.0 due to implementation of pre-logon. GP Portal No Longer Prompting for Client Certificates Following PAN-OS v5.0.x Upgrade Has this been changed again in 6.0? How can I get a Global Protect Portal to support both user/password and machine certificate authentication in 6.0? - Tor

torm · ‎04-15-2014

You can actually follow the following article and get an e-mail when it's updated. Which it should be when a new version of the agent is released. Software Release Notices: GlobalProtect Agent Bundle Just click Follow, and then check the "Email Watches" button.

torm · ‎04-15-2014

No, we still see the issue from time to time. Restarting the management-server and web-server seem to fix the issue temporarily, but it's not a permanent fix. You could try these commands: debug software restart web-server. debug software restart management-server. We probably need to submit a support case and have TAC take a closer look. Please, let me know if you get it resolved on your installation.

torm · ‎12-04-2013

I have a problem with a Panorama M-100 running 5.1.4, where sessions in the web-gui seems to time out before they have reached the "idle timeout" configured under Panorama/Setup/Management/Authentication Settings. What happens is that after being inactive for a few minutes (10-20 min), I do no longer get any data when navigating to a new menu item. Hitting F5 to refresh the page takes me to the login page. When I log back in, I can still see the previous session under "Logged in Admins" on the dashboard. We have tried increasing the idle timeout to 120 minutes, but it doesn't make any difference. Has anyone seen anything similar? Is there other timeout values that can be configured somewhere?

Member Since	‎12-09-2010 11:53 PM
Date Last Visited	‎11-24-2020 09:12 AM
Posts	90
Total Likes Received	16

Online Status	Offline
Date Last Visited	‎11-24-2020 09:12 AM

About torm

Re: How to Configure the Management Interface IP via API

Re: UserID instances

Re: Exporting log files from terminal server agent

Exporting log files from terminal server agent

Re: OSPF between virtual routers

Re: User-ID integration with a Samba domain?

Re: Global protect with DHCP client on WAN interface

Re: Regex for custom vulnerability signature - help needed

Regex for custom vulnerability signature - help needed

Re: PANORAMA CHANGE HARDWARE

Re: UserID instances

Re: Complex User-ID Scenario... Ideas? Solutions?

Re: Mass static route migration

Re: Limitted logging storage with Panorama Virtual Appliance?

Re: NAT Translation to web server in 4.1.2 when WAN in DHCP Client

Global Protect "Single Sign on" with Windows Hello on Windows 10

Old KB nomenclator in new live community portal

Re: API test url category

Re: group mapping

Re: Config (XML) import to device, using Panorama

Re: Panorama M-100 HA - Adding log collectors in mixed mode

Panorama M-100 HA - Adding log collectors in mixed mode

Re: Java version detection and blocking old version

Re: Manage policies using CLI from a computer

Re: malware??

Re: Does "Unknown-udp" app allow any UDP Packets?

Re: API test url category

Re: API and Useragents

Re: Dynamic TS-Agent Configuration

Re: Global Protect Portal with Certificate Profile - client certificate required after upgrading to 6.0

Re: SSL Decryption Certificate

Global Protect Portal with Certificate Profile - client certificate required after upgrading to 6.0

Re: Global Protect Client

Re: Panorama M-100 GUI timeout

Panorama M-100 GUI timeout

Unlock your full community experience!

About torm