About TommieVanHove

TommieVanHove · ‎04-15-2019

HI. thanks for this clear explanation. it is basically what I was hoping for. as this explains why the recommendation is now to install base images. in which case I'll modify my own procedures as well. for non production installs/new installs I'll probably keep skipping the base image install. purely because there is no impact if it goes wrong. and new installs tend to have a fairly empty disk. (especially vm's as if it goes wrong it's possible to fairly quickly make a new vm.) for production environments. due to risk of impact I'll have to install the base image. jsut to be on the safe side. it does extend the maintenance window needed to do it. however I prefer having to request a maintenance window of 2+ hours and having no impact then requesting a 1hour window but breaking a cluster member and causing possible impact/higher risk of impact)

TommieVanHove · ‎04-13-2019

Hello Jeremy. thanks for the feedback. so far I've also done it a few times. each time with new setups( eg upgrading before the firewalls are in production environments) still wonder why the pan best practices guide now says to install the base image as recommended. but possibly this is of course to cover their bases. it only has to go wrong once to have a unhappy customer claiming PAn documentation is bad.

TommieVanHove · ‎04-13-2019

hello hshawn. I know you have to download the base image. my question was not if it's possible and how. more a discussing if anybody had bad experiences doing it. (there probably is a reason why PAN now recommends installing the base image) the example you gave I think you made a typo perhaps. as I don't believe it is possible installing 8.1.x without installing 8.1.0 but seeing as you don't mention any bad experiences I assume you've done upgrades without installing the base image before with no problems. so that means I'm not the only one doing it. and so far no bad experiences as well. thx

TommieVanHove · ‎04-13-2019

I doubt gcm will work with all the devices on your list. eg. gcm is newer. and ssg devices are EOL and very old. new features have stopped releasing on them a while ago(and even the longest supported models are end of support beginning 2020 I believe) but support of GCM will also be mainly dependant on software/os as well. so it's hard to just say yes checkpoint will support gcm. (fyi I believe checkpoint software versions currently still supported( eg. r77.30 and up) all support gcm.) for ipsec vpn as I see it there are 2 scenarios: either you also manage the remote side hardware. in which case you can upgrade the devices to support gcm yourself. or have to determine via the device documentation if gcm is supported) or this is done by a 3rd party and then you need to ask them if their devices support gcm. GCM has more performance and is more secure(if implemented correctly) however that does not mean that CBC is totally insecure. on the flipside GCM usually requires a bit more mem/cpu to do. so if your pa or the remote hardware is already barely running with highcpu/mem all teh time. it may also be a reason to not use GCM. eg. party a might say yes: because they have an r80.20 checkpoint that is correctly sized party b might say no: because the are running r75 checkpoint(EOS) and don't want to upgrade party c might say yes but we don't do it: because they are running r80.20 but they have an undersized firewall running 95% mem all the time.

TommieVanHove · ‎04-12-2019

Hello. so slowly but surely I'm upgrading a large number of palo alto's from versions 7.1.x to eventualy version 8.1.6( or higher) In my palo alto training. and from some upgrades done before of pavm100 specifically. I always loved the fact that you can basically skip the install of a base image(though not recommended) I don't like to do it with x.0.y version. as the .0 versions usually introduce new features. but 8.0 to 8.1x I don't see a major issue) however my upgrade procedure has been: from 7.1.x --> install version 8.0.0 from 8.0.0 --> download 8.1.0 and 8.1.x but install directly 8.1.x I know palo alto recommends always installing the base image. however I would like to know what peoples real experiences are (with skipping base images, not going to the latest patch, etc) am I dodging bullets so far( had no issues yet) or do more people ignore this recommended part? if we really want to follow all best practices it would be: 7.1.x to latest 7.1.y 7.1.y to 8.0.0. 8.0.0 to latest 8.0.x 8.0.x to 8.1.0 8.1.0 to latest 8.1.x --> with a palo alto vm-100 add in a 3-5 more reboots between 7.1.y and 8.0.0 because you need to expand the memory, upgrade, shutdown, add a 60gb disk, copy disk, shutdown, remove old disk) So just wanted to know. who does what when upgrading palo alto's? --> always install baseimage every time? --> always upgrade to latest patchrelease before upgrade --> differnces between pa-vm and hardware appliances? Thanks. and keep it friendly please.

TommieVanHove · ‎03-08-2019

Can you provide a bit more info? i'm assuming the traffic being allowed is not actually hitting that policy rule in the logs? also just to clarify: you have 1 rule: containing a address group object. and 2 dynamic lists. not 2 sepearate rules? Mind sharing the EDL url's? also if the EDL uses url's, domains. make sure when to see if in monitoring tab the traffic being allowe dyou can resolve the url( checkbox at bottom of the page)

TommieVanHove · ‎03-07-2019

if I understand your question correct. yes: tail follow yes "log" one thing I dislike of palo is that they had to make all comands their own syntax.

TommieVanHove · ‎03-01-2019

was looking up running panorama in legacy mode for 8.1 recently. as I have a fairly similar but not completely identical issue. however mine is an upgrade from 7.1 so I don't ned to deploy from the ova. however as I came to understand it. if you configure the vm with an 81gb disk and no additional 2tb disk for the initial setup. the panorama will be forced in legacy mode. using 11gb of the 81gb disk. after initial config you can I believe add a disk( say your 200gb disk) and follow the guide to add disks to vm and enable them for logging. adding this disk will not magically convert the appliance to panorama mode as I believe this has to be initiated manually from cli. (so you should stay in legacy mode) so I would try this. however I'm not sure if this works when starting from the OVA image. However I would think so as running in legacy mode is currently the only way to not being forced to use 2tb as minimum log. (which was the issue for my upgrade as our customer was not willing/able to jump from a 34GB logdisk to 2TB) panorama in legacy mode indeed only support logging to 1 disk: if the vm has 1 disk it uses 11gb on the system disk if you configure an additional disk for the vm and allow logging to that said disk it will forego using the 11gb on the system disk and just log all to the extra dedicated disk( ranging from 11gb to 8tb)

TommieVanHove · ‎01-21-2019

I was planning to. Thank you for checking and the support as well. my plan is to report this to paloalto. but for our custoemr the fastest solution will be to make a change on AD

TommieVanHove · ‎01-21-2019

good to know the * filter only returns users with attribute set. according to various documenation about msNPAllowDialin if the attribute is not configured teh value should either be: Not Set --> unlickely as that would fall under * or an empty stirng: " " --> might be this one. any way long story short: with the current palo alto it will not be possible to create custom groups based on user attributes that are case sensitive. as palo does a "to lowercase" on it's query. I believe all Boolean type attributes are case sensitive in AD( and these are I believe the only ones that are case sensitive). so note: building custom groups based on Boolean attributes will not be possible in palo alto.

TommieVanHove · ‎01-11-2019

and an update from my part as well. I did some extra tests myself(after letting the problem rest for a while) and strangely if I create a custom group with following filter: (msNPAllowDialin=*) I get a few users in the group. including my 2 testusers. however when I try (msNPAllowDialin=true) I get an empty group. starting to think I may need to ask the ppl managing the AD to give me some more info. as according to my logic creating a filter with (msNPAllowDialin=*) should basically give me a list of ALL users as the attribute only has 3 possible values: Not Set, True, False

TommieVanHove · ‎01-11-2019

Hello. I'm currently working on a setup involving Global protect for teleworking. the company has users who are allowed to connect remotely with their id, and users who aren't. the decision for this is based on a user-attribute: msNPAllowDialin (of type boolean) --> if set to allow --> useer should be able to logon to GP portal/gateway if set to deny --> user is not allowed to connect remotely This seems to be possible to implement via custom group under user identification. with an ldap filter (msNPAllowDialin=true) however I can't seem to get it to work and can't find much documentation how to troubleshoot this on a palo alto. (without access to teh AD environment) I'm fairly certain the issue is with the custom group. ldap test when I have all or a specific group configured in allow list: both my testusers( 1 with the attribute to allow, the other with deny) can logon. both via test command cli. or via GP portal. however as soon as i change the allow list to the custom group I configured( teleworkers) both CLI test and gp login fail. cli command states this is because the user is not in the allowlist. --> custom group issue. my question: does anybody have experience with this? or perhaps a great resource where I can brush up on how to configure these custom groups? if not I'm also looking for cli commands that can aid me in troubleshooting this apart from testing ldap authentication. as currently I'm not even sure if I can use the msNPAllowDialin attribute --> are some attributes not usable in ldap filter and is this one of them? And yes I have played a bit with the ldap filter: so trying TRUE, true, etc I've already done. unless AD uses other values for boolean? any help would be greatly appreciated. thanks in advance

TommieVanHove · ‎10-02-2018

Hello. thank you for the info. as stated upgrading was not an option so I had to go with option 2. however the info I got for this was incorrect as the customer was running 7.1.x not 7.0. for what it's worth. going from 7.1 to 8.0.13 the only errors I got were related to HA interfaces. pa5220 has dedicated ha1-a and ha1-b interfaces for ha1. so I had to remove the old (dedicated port for ha1 configuration) same with ha2 --> had to manually define a new port to be ha2 as pa5220 standard uses a HSCI slot for ha2. once I had corrected those 2 minor issues I got no more errors/warnings during commit. so all in all a lot less hassle then what I was expecting to get.

TommieVanHove · ‎09-30-2018

hello. we have a replacement of a palo alto coming up. the actual migration is I believe from a 3050 model running pan-os 7.0.12 and the config needs to be migrated to a pa 5220 (whic I believe can't run pan-os 7.x but comes with 8.0.0 minimum. due to security reasons I'm not able to take teh existing config. install it on a lab devic, upgrade that device to get a decent 8.x config. and upgrading the production device to 8.x first is also not an option. is there another way to get the config to a 8.x? as just export, import of config will nog work is not recommended. I read about the migration tool. however: version 3.3 does not support pan-os 8 currently. (but I read someone using a 7.1 config from teh tool which would load on a 8.0.0 device. I am running the tool on a vmware player to test. however I can upload a config. and then download that again. but I can't seem to find (nor in guide) where I can configure it that i upload a 7.0.13 config. and download a 7.1.0 config from it. so I'm missing that part of information/knowledge. any ideas?

TommieVanHove · ‎09-26-2018

Hello. I would like to enable some packet captures on certain threats and was wondering if anyone has tested if there is an impact on the mgmt plane cpu when enabling extra pcaps? I know enabling packet capture has an impact on cpu. however I would think the impact woudl be mainly(or exclusively) on the data plane cpu; reason I ask is I currently have a pa-2000 series on which I may need to enable a few extra packet captures of threats over an extended period of time. the pa-2000 has an astmatic hamster for a mgmt cpu and is already overloaded. If anyone has tested this or a definitive answer I would appreciate it. if not I'll test this out myself however I can't do it right now due to currently not having access to a lab environment to test this. regards

Member Since	‎09-05-2018 02:12 AM
Date Last Visited	‎04-23-2024 04:17 AM
Posts	34
Total Likes Received	6

Online Status	Offline
Date Last Visited	‎04-23-2024 04:17 AM

About TommieVanHove

Device certificate advisory when firewall doesn't use the mgmt interface for these connections

Re: Data redistribution: mappings learned via agentless user-id are okay, mappings via globalprotect(type GP) not redistributed

Data redistribution: mappings learned via agentless user-id are okay, mappings via globalprotect(type GP) not redistributed

Configuring decryption, some gray categories and experiences

Re: HA1/HA2 speed recommendations for a PA5200 series setup (A/P)

HA1/HA2 speed recommendations for a PA5200 series setup (A/P)

Re: new CA Sectigo(formerly Comodo) not trusted

new CA Sectigo(formerly Comodo) not trusted

expedition installer fails, browsing to ip address gives me default ubuntu apache

Re: Override in URL Filtering is not working

Re: new CA Sectigo(formerly Comodo) not trusted

new CA Sectigo(formerly Comodo) not trusted

Re: custom groups using ldap-filter/query to use with GlobalProtect

Re: custom groups using ldap-filter/query to use with GlobalProtect

Re: migrating config from 7.0.12 to 8.x.x

Re: Experiences with skipping the base image.

Re: Experiences with skipping the base image.

Re: Experiences with skipping the base image.

Re: VPN IPSec gcm or cbc cypher types

Experiences with skipping the base image.

Re: Rule with Deny action Allowing traffic

Re: Is there an equivalent to "tail -f log" or viewing the last x log messages?

Re: Panorama 8.1 VM on ESXi in Legacy Mode

Re: custom groups using ldap-filter/query to use with GlobalProtect

Re: custom groups using ldap-filter/query to use with GlobalProtect

Re: custom groups using ldap-filter/query to use with GlobalProtect

custom groups using ldap-filter/query to use with GlobalProtect

Re: migrating config from 7.0.12 to 8.x.x

migrating config from 7.0.12 to 8.x.x

threat packet captures impact on cpu

Unlock your full community experience!

About TommieVanHove