About soporteseguridad

Hi,   We are expecting problem with PA identifying apps. We have sessions in port 13000 being identified as play-station network. These sessions are not related to Pstation.   On the another hand, we also have sessions in port 80 being identified as unknown-tcp.   why PA is idenfitying like this?? how can we solve this app problem??   ... View more

Hi,   We are having problems with Oracle sessions because a offloading sessions. we have solved this problem rising timeout for this app. I would like to know if we create a custom app, this offload process is still working over this custom app?   https://live.paloaltonetworks.com/t5/Management-Articles/How-Does-the-Device-Manage-Offloaded-Session/ta-p/61278 ... View more

Hi,   We have a PA-5050 with PaNoS 7.0.7, we are expecting that there are moments during the day when the traffic increases that there is a outage for several sessions, but the sessions are still very low for this PA-5050. And we dont know why some sessions are not being established.   We would like to discard if this is caused for PA. Looking the PA interface. We have an ae with 4 ports. We see packet drops in this ae1, the packets dropped are incresing all the time. On the another hand, if we check all the interfaces (ethernet1/21 ethernet1/22 ethernet1/23 ethernet1/24) bonding in this ae, we dont see any errors.     show interface ae1 -------------------------------------------------------------------------------- Name: ae1, ID: 48 Link status: Runtime link speed/duplex/state: [n/a]/[n/a]/up Configured link speed/duplex/state: auto/auto/auto MAC address: Port MAC address 00 Aggregate group members: 4 ethernet1/21 ethernet1/22 ethernet1/23 ethernet1/24 Operation mode: layer3 Untagged sub-interface support: no -------------------------------------------------------------------------------- Name: ae1, ID: 48 Operation mode: layer3 Interface management profile: N/A Service configured: LACP Zone: N/A, virtual system: vsys1 Adjust TCP MSS: no -------------------------------------------------------------------------------- Hardware interface counters read from CPU: -------------------------------------------------------------------------------- bytes received 817930387942 bytes transmitted 796893216522 packets received 1797090261 packets transmitted 1569474090 receive incoming errors 0 receive discarded 0 receive errors 64162355 packets dropped 0 -------------------------------------------------------------------------------- Logical interface counters read from CPU: -------------------------------------------------------------------------------- bytes received 20819118 bytes transmitted 6130932 packets received 98682 packets transmitted 49443 receive errors 0 packets dropped 49325 packets dropped by flow state check 0   ---------------------------------------     show interface ethernet1/21 -------------------------------------------------------------------------------- Name: ethernet1/21, ID: 36 Link status: Runtime link speed/duplex/state: 10000/full/up Configured link speed/duplex/state: auto/auto/auto MAC address: Port MAC address 00:1 Aggregate group : ae1 Operation mode: layer3 -------------------------------------------------------------------------------- Physical port counters read from MAC: -------------------------------------------------------------------------------- rx-broadcast 2382266 rx-bytes 2428164611097 rx-multicast 1316048 rx-unicast 2213305474 tx-broadcast 1849 tx-bytes 1736956163089 tx-multicast 12326 tx-unicast 1653417852 -------------------------------------------------------------------------------- Hardware interface counters read from CPU: -------------------------------------------------------------------------------- bytes received 0 bytes transmitted 0 packets received 0 packets transmitted 0 receive incoming errors 0 receive discarded 1 receive errors 0 packets dropped 0   why we can see these errores in ae interface?? why these erros are not shoed in ethernet interface in this ae??? ... View more

Hi,   We have several computers in our network using this proxy: proxy1.eu.webscanningservice.com This domain changes IP each 15-20minutes. So when this domain changes the Ip we can reach the proxy from our computers. So i have several doubts: 1)PA detects when a domain changes the IP and update the FQDN database?? or only FQDN refresh is done each 30minutes???  2) What would it be the best way to create a rule with a FQDN host which changes IP each little time????   Thanks a lot ... View more

hi,   We have a cluster PA-2020 with PanOS 5.0.16. I just looed into EoS version, and this version doest have support since last november. Please, can we upgrade this PA to any higher version??? which is the recommend for this PA-2020?? we dont want to lose performace going higher. ... View more

Hi,   We are expecting several issues with user identificatiom. We see connections identifying users but suddently the connections stop identifying.    I attach an screenshot   ... View more

HI,   We are establishing RDP sessions through Globalprotect. These RDP sessions are closed, we went into this link: https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/globalprotect-features/rdp-connection-to-a-remote-client   We changed this value for "User Switch Tunnel Rename Timeout" to the maximum permitted (600 seconds), but its not enough. We would like to have unlimited time for RDP. How can configure this???     ... View more

Hi,   We realised our PA in version 7.0.6 is having any issue with the traffic. We see many traffic being dropped by DENY all rule (the last rule in the rule set). Looking in application we see "non-syn-tcp" in all the connections.    These denies connections always ocurrs each 30 minutes. For example: 4.01pm, 4.31pm, 5.01pm, 5.31pm.       we have disabled tcp syn reject in global, but its configured in zones too. why is happening this???? its quite weird each 30 minutes we see these denies. ... View more

Hi,   We are testing GProtect 2.3.2 version and its not working fine. Debug GP client shows "WINHTTP CALLBACK_STATUS_FLAG_CERT_CN_INVALID".   The certificate is issued with the Common Name clientvpn.xxx.xxx, and this is the address of the portal.  If instead of the DNS name of the portal, we put the IP address, the client warns that the CN of the certificate does not match, but allows to establish the connection.     how can we solve this problem?? ... View more

Hi,   We have a PA-5000 with 2 HDDs. One of them had an error and we asked for RMA. We have received 2 HDD for replacement.If the new HDD has the same part-number as the old HDD working , we wil only add a new HDD but if the model is different we have to add both new HDDs and delete the old ones-   Please, what is the procedure to add both HDD in a PA5000??? which is the best way to do this HDD change?     ... View more