About Abdul_Razaq

Abdul_Razaq

Hi @Mudather , Did you find any resolution for this. thanks in advance!

Abdul_Razaq

Hi @nandersen , It is bit late response. i am also looking for a way to do this. have you found a way to do this ? ie, a non-domain core with LDAP connection to AD . Also have you tried via TLS ?

Abdul_Razaq

Hi @c_n0te , Hope you have followed previous steps and configured new IP address and the commit were successfull. If you have permitted IPs configured, make sure your PC IP is permitted and service (https, ssh etc..) are allowed

Abdul_Razaq

Hi @Carracido , As of my understanding, LDAP profile and adding the LDAP server profile to the User-ID Group Mapping configuration is enough for fetching groups. No need of server monitor.

Abdul_Razaq

Hi @allenwarez , By default, if the service start is fine, the GP service should listen on port 4767. In your case it is clear that the service is not started yet, the kernel is stopping it. normally ' spctl kext-consent add PXPZ95SK77' and a reinstall should work along with allowing GP to run ( 'system preferences > security') GP version 5.0.4 is minimum and latest is 5.1.3 (there is no GP version 5.2.x )

Abdul_Razaq

Hi @allenwarez , GP Agent log might give you more details. If the issue is because kernel is not allowing the program to run, restart the mac with command+R to recovery mode. Open terminal and put "spctl kext-consent add PXPZ95SK77". Then reinstall the GP.

Abdul_Razaq

Hi @Sethupathi , By any chance you have reconnected to portal after the config change from 'always ON' to 'On demand'. The client might have old app configuration.

Abdul_Razaq

Hi Community, I have a requirement to have client authentication in globalprotect portal/gateway to have with LDAP first then another profile wich is SAML based. the requirement is to authenticate with SAML profile if LDAP auth fails. But as SAML profile cannot be added in authentication sequence, i cannot take advantage of authentication sequence. multiple entries in client authentication under portal -> authentication doesn't seems to be working as it is not trying for the next one as first entry fails. Their document says it is kind of security policy, so that the order should be more specific to general ( which apparently says the OS type is differentiator and it will not try next entry once a OS match happens). But the same document also says "If you need multiple configurations for one OS, you can further distinguish the configurations by your choice of authentication profile", which is very much confusing. If anybody have any workaround or solution for achieving this, it will be helpful Thanks in advance!

Abdul_Razaq · ‎05-04-2020

Hi Community, Can anybody help here. Is there any way we can make a report per endpoint group in TRAPS TMS implementation. Currently i cannot see any filters while creating a report. For example, if i have endpoint group A,B. Then is there a way i can generate different report for group A and B ? Thanks in advance.

Abdul_Razaq · ‎04-09-2020

Hi @NetworkSupport1Link Looks like the issue is not addressed yet. What if you disable thee curve 25519 ? is it working ?. You can add 25519 as last in the sequence. https://docs.microsoft.com/en-us/powershell/module/tls/disable-tlsecccurve?view=win10-ps

Abdul_Razaq · ‎04-08-2020

Hi Community, Is there any update on feature request #4603 - limit number of concurrent sessions per user for GP. Is it available now or it can be achieved by the scripts only still. Thanks in advance.

Abdul_Razaq · ‎04-08-2020

Hi @Sample.Wu Did you find any solution for this. Thanks in advance

Abdul_Razaq · ‎02-19-2020

Hi @raji_toor , As of my understanding, the image downloaded directly into the panorama and 'upload manually/SCP copied' will go to different partitions. You can try to clear root partition by clearing old logs if you don't want it. and try using direct download or manual upload or SCP copy. As these are going to different partitions, any of the methods might help you.

Abdul_Razaq · ‎02-19-2020

Hi @raji_toor , As @BPry mensioned, you need to keep only the current image and the base image in the box. rest you can delete and free up for making room for the image file(and its base) you are going to upgrade.

Abdul_Razaq · ‎02-19-2020

Hi @Logesh , The error look like you have configured peer identification in palo alto IKE gateway configuration to IP address of peer. but the peer is sending a FQDN. You can check the peer identification config in the remote and local device to make sure those are matching.

Abdul_Razaq · ‎02-19-2020

Hi @aimsnss , is the issue resolved ?. mostly your DNS traffic policy might not be configured for logging, that could be the reason you don't have a traffic log entry. Also, make sure the GP client IP is configured to access your internal DNS(as well as the network reachbilty) as you are using internal resolver IP in the GP configuration.

Abdul_Razaq · ‎02-19-2020

Hi Community, I have an aggregate interface from PA to cisco having 2 physical interfaces, I don't have LLDP or LACP enabled in the aggregate interface (LLDP is not enabled globally as well as in interface level). But I can see that the aggregate interface is up and passing traffic. the strange thing happens is that when I add more than 2 subinterfaces in the aggregate link, the third and later links are not passing traffic. It would be great if someone can explain this behavior. Is it normal or I am missing something?. Thanks in advance.

Abdul_Razaq · ‎01-08-2020

hi @whiskerp , Can you check the RP address for the 5th flow and check whether you have a route in the firewall into the RP pointing to a PIM neighbor.

Abdul_Razaq · ‎11-21-2019

Hi Team, I have a multicast setup. I am able to see that the PIM neighbourship is completed and igmp membership also fine. I can see my traffic in multicast fib with the correct incoming and outgoing interfaces. but the multicast packet is not reaching receiver, I can see a lot of packet drop in counter with detail "packet dropped no route for ip multicast". Any idea what will be the reason for this. Thanks in advance.

Abdul_Razaq · ‎10-21-2019

Hi Team, I have figured out the changes needed to be done in the server having core and console installed. Need to update the new password in the Log On tab on "Endpoint Security Manager" service Need to update account credentials in ESMAppPool under IIS manager -> Application pools. these configuration steps helped me to get the TRAPS in action after service account password change.

Abdul_Razaq · ‎10-21-2019

Hi @BatD , I am seeing these traffic only for third party clients, I am seeing traffic initiated from PA with source udp/4500 to client public IPs (it is blocked by policy ). As it is port 4500, I can make sure that it is because of third party client as GP uses 4501 in tunnel mode. I am wondering what is inside that packets, what PA is trying to send, is it the tunnel initiation? ( even though the policy is denying it, the IPSec connection is fine in responder mode).

Abdul_Razaq · ‎10-20-2019

Hi Team, I am seeing some traffic initiated from GP interface to outside using source port udp/4500 to public IPs of clients( GP uses 4501 and I have xauth configured). Are these traffics are because of GP xauth configuration.. anybody has noticed it before ?. I dont have any Ipsec tunnels configured from this interface. thanks in advance.

Abdul_Razaq · ‎10-20-2019

Hi Team, We have a traps ESM setup running successfully. console and core are installed in one server, But the DB is in another server. We are using windows authentication for login into DB ( ESM is configured with this domain user to login with DB while installing). now we need to change the password for this user. What are the changes I need to do in TRAPS for reflecting the password-change? thanks in advance.

Abdul_Razaq · ‎09-21-2019

Hi @SteveCantwell , @hman , Thanks for the information. I have requested TAC support for the same. Waiting for their verdict.

Abdul_Razaq · ‎09-18-2019

Hi Community. I have configured PA to fetch EDL of type IP addresses from EDL link "https://panwdbl.appspot.com/lists/ettor.txt" for blocking tor. I am able to see that the list is getting populated. But occasionally I am getting below warning while committing other configurations, EDL <name> used in policy has no valid entries I am running PanOS 9.0.3-h3 I am using the same EDL in another firewall (PanOS 8.1.9 ) as well with policy to deny traffic to these IPs. I am able to see traffic hitting this policy have action allow, when I checked the destination IP, it is not there in the list ( Not sure as this is a dynamic list and the IP might have before, but the action should not be allowed). the policy have log at end configured. Can somebody explain the above behaviour. Thanks in advance.

Abdul_Razaq · ‎08-27-2019

Hi Community, Does disabling HA using the master switch ( Device -> High availability -> general -> setup ->enable HA checkbox) will cause the interfaces to go down and up ?. I understand that the interface mac has to be changed from virtual to physical one, does it cause a flap. I have faced an issue that disabling caused aggregate interface to go down, I didn't notice other interfaces (maybe flap is fast enough not to be noticed). Thanks in advance !.

Abdul_Razaq · ‎08-08-2019

Hi Community, I have recently noticed that the email subject field in wildfire submission log is shortened, ie, I am not able to see the full subject name. Is there any specific limit for number of characters in that field ?. Thanks in advance.

Abdul_Razaq · ‎07-22-2019

Hi @feelgood , Hope you have configured the NAT and security rule properly. refer below doc for help. https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping

Abdul_Razaq · ‎07-21-2019

Hi Team, @reaper , @BPry Recently I have come across a scenario that palo alto was dropping TCP SYN packets which have ECN and CWR bits set. upon checking the global counter, i have seen that the drop reason was 'process owner message err, no predict'. anybody have seen this?. PA doesn't support SYN packets with ECN and CWR set ?.. Once I disable this enhancement in windows using the command 'netsh int tcp set global ecncapability=disabled', the session is getting established and the thinks are working fine.

Abdul_Razaq · ‎07-02-2019

Hi @simsim , I was just giving an analogy ( please dont consider Byte or bit difference or interframe gap). i was just conveying that if your actual data is packed to smaller packet size, you need to have overhead for all, all togather matching to link speed. so actual data transferred will be lower. But if you have bigger packet size, the number of packet will be less, you need header for all (header size will be the same regardless of data size). so you can transfer more data at a given time. Usually packet per second will be almost same for one platform for any packet size, which gives more data transfer for bigger packets.

Date Registered	‎11-06-2018 12:48 AM
Date Last Visited	Thursday
Total Messages Posted	92
Total Likes Received	16

Online Status	Offline
Date Last Visited	Thursday

Strata

Prisma

Cortex

About Abdul_Razaq