This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About User_333
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About User_333
23Posts
0Likes
1Solution
Last Visited
User
Activity
User
Profile
Latest posts by User_333
| Subject | Views | Posted |
|---|---|---|
| 3086 | 03-09-2018 02:57 PM | |
| 3094 | 03-09-2018 01:45 PM | |
| 2050 | 06-16-2017 04:12 AM | |
| 1264 | 11-07-2013 01:19 AM | |
| 2905 | 07-06-2012 02:46 PM | |
| 1333 | 07-02-2012 07:19 AM | |
| 1374 | 07-02-2012 05:59 AM | |
| 3709 | 02-23-2012 01:00 PM | |
| 3621 | 02-14-2012 11:43 PM | |
| 4224 | 02-14-2012 12:15 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 5 Likes | |||
| 1 Like | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 02-10-2011 02:59 AM |
| Date Last Visited | |
| Posts | 23 |
03-09-2018
02:57 PM
In vWire, packets will (according to documentation) always leave the same box which received the packet. If the other box is responsible for L7 processing the packet will be sent trough HA3 to the other box for L7 processing. After this, it is either blocked or sent back to the first box trough HA3 which will send it out the other side of the vWire. In no case (bugs excluded), a "vWire"-packet will leave the data interface on the other box. With this, it is guaranteed Paloalto wont generate a loop since it behaves like a cable. Sorry, currently no clue why this could be happened.
... View more
03-09-2018
01:45 PM
ASA did no failover/split-brain during this change?
... View more
06-16-2017
04:12 AM
Moving an Object (at least Address, Service, Region Objects) from a device Group to "Shared" is possible trough the GUI the follow way: - Navigate to Objects -> Address - Choose Device Group which contains Object - Select the Address (could also be more than one at the time) - Click on "move" at the bottom (next to add/del) - Popup will be there to choose the new Device Group or "shared" I never tested to move from "shared" to a device group, but i think it should work. Important: You will get an error if you move e.g. a device group to shared if not all objects within this device group are already shared. Works with Panorama 7.1
... View more
11-07-2013
01:19 AM
Hello I made a CSR. Got my Cert and did the stuff mentioned in the "how to chained certificate", Copied the intermediate on top of my cert. but the PA-500 did not accept it. okey i tried it without the intermediate cert text - and it worked. Request is gone and now there is a valid cert. but now when i try to open the captivePortal Response page i get a Cert error. logicaly because of the missing intermediate part. is there a way to put the intermediate to the allready valid cert? or do i have to make a new request?
... View more
07-06-2012
02:46 PM
If your side gets this "timeouts" log entries it would be interesting to see what the logs on the other side are (if its possible to get them).
... View more
07-02-2012
07:19 AM
Seems the second last commit was failed and a NAT Rule from there was the issue. Changing the NAT IP pool from x.x.x.0/26 to x.x.x.1 solved the issue (on a new rule from the second last commit). Since i am using "dynamic-ip-and-port", having just one ip is no big deal. But i am still asking me, why I am not able to define a /24 network as IP Pool. I am even more confused if i am looking at other NAT rules which have a /26 network as IP Pool. So, this shouldn't be a problem. Is there somewhere a limit for IP Pool addresses?
... View more
07-02-2012
05:59 AM
After updating Policy and Nat Rules, I got the follow commit errors: - Error: Error: Error updating NAT IP pools - Error: response from cfgpush.s1.dp1.comm.cfg-dp: Error updating NAT IP pools This error still occurs if i disable (or even delete) the newly added rules. Since i did a commit ~10min before, i am sure, i didn't changed anything else. So, i am looking for an advanced command which gives me more info (which object causes this error). Hope somebody can help me.
... View more
02-23-2012
01:00 PM
Yes, it's definitely not needed to INSTALL 4.1.0 in front of a upgrade to 4.1.2. The only requirement is a downloaded 4.1.0 Firmware. This is described in the Admin Guide (Page 38) too: You must have a base image downloaded before you can install an update version. For example, you must have 4.1.0 downloaded (not installed) before you can upgrade your 3.1.9 device to 4.1.4.
... View more
02-14-2012
11:43 PM
Looking at Wikipedia isn't always helpful. E.g. if you are looking for allowing icmp-echo-requests, the app don't contain icmp or echo, it's the ping app. So I am looking for TCP-9000. Wikipedia shows me three entries and the third one (SqueezeCenter) is the one I am looking for. Applipedia don't contains something with "Squeeze" which leads me to the question: Is this app supported or is their just a different name? It seems, without testing you will never find out.
... View more
02-14-2012
12:15 AM
Hello Sometimes I just get the TCP ports for firewall configuration changes. Since the configuration on the Paloalto should based on the AppID's rather than TCP ports, is there a way to search for AppID's which are using a defines TCP Port (eg. tcp-9000)? Since every App has a "Standard Ports" Attribute, the Information are there, but it seems neither the Firewall GUI itself nor on the Applipedia ( http://apps.paloaltonetworks.com/applipedia/ ) supports such a filtering possibility. Is there another way?
... View more
02-13-2012
07:15 AM
As described, we have some VPN tunnels which allows any traffic (Proxy IDs 0.0.0.0/0). With this, we have a GRE-Like Encrypted tunnel. With VPN, there are always a lot of NAT configuration which could be wrong. Since the administrators on most of our remote sites aren't big companies, there usually don't have big knowledge in special NAT configurations. So, they are sometimes wrong and on a Zyxel (or similar) firewall, it is not easy to debug. Sometimes they even struggle on the routing part. An easy way to find configuration issues on the remote firewall (if you don't have access to it), is looking at the traffic which is coming from this VPN. Routing Issues -> No Traffic at all NAT issues -> Traffic with wrong source/destination IP If you can do a filter on outgoing interfaces, it's also an easy way to check if my NAT is correct. As described, I am looking for traffic which is not as expected. So, i am not able to filter it based on IP information. And for a setup like "each VPN has its own zone" (so I can filter based on Zone) the Paloalto doesn't support that much zones as we have tunnels.
... View more
02-09-2012
04:41 AM
Hi I am looking for a way doing a packet capture (or Debug Flow) with a filter based on a defined VPN Connection. The only thing I found, was a filter like "debug dataplane packet-diag set filter match ingress-interface tunnel" but with this I am not able to filter just one VPN Connection (eg tunnel.100). It seems, this command doesn't support sub-interfaces. Filtering based on src-/dst-address is not possible since we sometimes use GRE like VPN's (both sides of Phase2 ProxyID's are 0.0.0.0/0) and I want to check if src-/dst-IP are the right ones. Also, filtering based on zone is not possible since all our vpn tunnels are in the same zone (firewall doesn't support that many zones as we have tunnel interfaces)
... View more
02-08-2012
12:15 AM
Isn't it possible to upgrade directly to 4.1.2? Why is this intermediate step to 4.1.0 needed?
... View more
01-09-2012
06:34 AM
I am trying to create some reports based on the "Threat Summary Log"-Database. Unfortunately, I am not able to create a report which shows me just the blocked threats. If I use the "Threat Log"-Database, the report works fine (but to short time period), so I think the action is not stored in the Summary-Database. Can I change this behavior and add the action to the Summary Log?
... View more
11-10-2011
04:31 AM
Hi To block a webpage like Facebook, I have the follow two possibilities. 1) Block it by the Url Filter 2) Block it by the AppID Since the URL Filter just looks at the URL and no other content. Access to Facebook will only be blocked if I try to access it by "www.facebok.com". But access via " http://translate.googleusercontent.com/translate_c?hl=de&rurl=translate.google.ch&sl=de&tl=en&u=http://www.facebook.com/&usg=ALkJrhh_Iem_Ly3suOQ6H0aOBboI4hw4wg " will not recognize it as the Facebook URL --> no blocking If I use the AppID to block Facebook, I am expecting even blocking this Google translate URL since the content is still Facebook. But this isn't the case. I don't get any Facebook app in my traffic log. So, what is the exact difference between URL Filtering and AppID's (for "Website"-AppID's) and how can I block all this even if the user uses Google translate?
... View more
Contact Me
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks