About pulukas

The basic information that Palo Alto does provide can be found by searching in the Threat Vault. https://threatvault.paloaltonetworks.com/ This document shows how to get more detailed information after seeing what is available from Palo Alto. How to Find Virus Details if Not Available in the Threat Vault ... View more

I've been looking for an official answer on how the information from AV feeds back into Wildfire and the answer seems to be it does not.  Wildfire is viewed as an early warning behavioral analysis and the verdicts from this are currently remaining in place.  The feeling is that the AV signatures will catch the file anyway so there is no need to feed the information back into Wildfire. I don't think I like that answer.  But I do understand that creating that feedback process and re-evaluation on issues like Havex are just an investment of time PA is not making right now. ... View more

You can force the sync from the secondary cli using this command. request high-availability sync-to-remote running-config I doubt this is the issue but it can confirm what you want to confirm. I would try to schedule a reboot of both nodes in turn after a sync confirmed.  If the issue is still present I would open a case. ... View more

Thanks for sharing the issue and solution. ... View more

Logging is handled by the log receiver. > debug software restart log-receiver You can check statistics here to see which are not working. >debug log-receiver statistics ... View more

The situation you have seems very odd.  The logs clearly show many successful sessions on the same hosts and port and you have this one session where only the initial http get request is present without any complete tcp handshake. Obviously, the rest of the sessions worked as expected and completed and this odd session is indeed incomplete. Is there a chance of any of the following: Congestion on the server where it might not respond to some requests Congestion on the link to the server where requests may be dropped On the client side what is the behavior for this type of failed session?  Is the next successful session just a retry of the previous incomplete one? ... View more

mackwage wrote: Thanks for your input! In this firewall, we do not have any rules which have an application specified along with service ANY. We do however have several rules which list an application with service "application-default". Is it faster processing wise to explicitly list the port as oppose to app default? I don't have any direct experience with that situation.  I would assume that it would only affect your target traffic if one of the default application ports overlapped with your delayed traffic. ... View more

If you want to keep v-wire mode and don't want to convert to L3 or L2, your other option is to create and insert another v-wire for this traffic. You will choose which router in your environment will link these two routing zones.  Then place another v-wire on the line where this traffic must transit from that router to one of the two zones.  This way one side of the new v-wire is live-tr and the other side is eduroam-tr.  You can use these same zones on the new v-wire. Now you can add the access rules you desire between the zones. ... View more

I would take a look at the rules and organization.  One of the things I've seen that can affect initial session setup time is the number of rules that are application only with the "any" port selection. These rules should always be towards the bottom of the rule base. The most specific rules with specified ports and applications should be at the top. What happens with application and any rules is that PanOS essentially holds on that rule while the traffic is coming through and makes sure that the application is not a match before moving on to the next rule for checks.  If there are a number of these "any" port rules each one does the check and passes on and the time delay can add up. ... View more

Thanks for the updates and troubleshooting.  I did  suspect this would be a platform issue and not the PanOS version based on the history of the 2000 series. I hope you can get some back end discounts for an upgrade as a loyal customer. ... View more

I agree with Hardik that frequently incomplete handshakes are the result of asymmetrical routing. Please run a trace route on both the source and destination towards each other and see if the path is the same. You can also use the pcap utility to capture more detailed information on the issue. How to Capture Traffic (PCAP) Hitting a Specific Rule ... View more

In your situation I would use a layer 3 deploy. I also have not seen any pure layer 2 deploys.  It seems that v-wire is the way to go with a true layer 2 insertion. ... View more

These conversion tools are only available to partner companies not end-users. ... View more