Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About User_333
About User_333
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
User
Activity
User
Profile
Latest posts by User_333
| Subject | Views | Posted |
|---|---|---|
| 948 | 03-09-2018 02:57 PM | |
| 956 | 03-09-2018 01:45 PM | |
| 919 | 06-16-2017 04:12 AM | |
| 401 | 11-07-2013 01:19 AM | |
| 690 | 07-06-2012 02:46 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 5 | |||
| 1 | |||
| 2 |
User Badges
Public Statistics
| Date Registered | 02-10-2011 02:59 AM |
| Date Last Visited | |
| Total Messages Posted | 23 |
03-09-2018
02:57 PM
In vWire, packets will (according to documentation) always leave the same box which received the packet. If the other box is responsible for L7 processing the packet will be sent trough HA3 to the other box for L7 processing. After this, it is either blocked or sent back to the first box trough HA3 which will send it out the other side of the vWire. In no case (bugs excluded), a "vWire"-packet will leave the data interface on the other box. With this, it is guaranteed Paloalto wont generate a loop since it behaves like a cable. Sorry, currently no clue why this could be happened.
... View more
03-09-2018
01:45 PM
ASA did no failover/split-brain during this change?
... View more
06-16-2017
04:12 AM
Moving an Object (at least Address, Service, Region Objects) from a device Group to "Shared" is possible trough the GUI the follow way: - Navigate to Objects -> Address - Choose Device Group which contains Object - Select the Address (could also be more than one at the time) - Click on "move" at the bottom (next to add/del) - Popup will be there to choose the new Device Group or "shared" I never tested to move from "shared" to a device group, but i think it should work. Important: You will get an error if you move e.g. a device group to shared if not all objects within this device group are already shared. Works with Panorama 7.1
... View more
11-07-2013
01:19 AM
Hello I made a CSR. Got my Cert and did the stuff mentioned in the "how to chained certificate", Copied the intermediate on top of my cert. but the PA-500 did not accept it. okey i tried it without the intermediate cert text - and it worked. Request is gone and now there is a valid cert. but now when i try to open the captivePortal Response page i get a Cert error. logicaly because of the missing intermediate part. is there a way to put the intermediate to the allready valid cert? or do i have to make a new request?
... View more
07-06-2012
02:46 PM
If your side gets this "timeouts" log entries it would be interesting to see what the logs on the other side are (if its possible to get them).
... View more
07-02-2012
07:19 AM
Seems the second last commit was failed and a NAT Rule from there was the issue. Changing the NAT IP pool from x.x.x.0/26 to x.x.x.1 solved the issue (on a new rule from the second last commit). Since i am using "dynamic-ip-and-port", having just one ip is no big deal. But i am still asking me, why I am not able to define a /24 network as IP Pool. I am even more confused if i am looking at other NAT rules which have a /26 network as IP Pool. So, this shouldn't be a problem. Is there somewhere a limit for IP Pool addresses?
... View more
07-02-2012
05:59 AM
After updating Policy and Nat Rules, I got the follow commit errors: - Error: Error: Error updating NAT IP pools - Error: response from cfgpush.s1.dp1.comm.cfg-dp: Error updating NAT IP pools This error still occurs if i disable (or even delete) the newly added rules. Since i did a commit ~10min before, i am sure, i didn't changed anything else. So, i am looking for an advanced command which gives me more info (which object causes this error). Hope somebody can help me.
... View more
02-23-2012
01:00 PM
Yes, it's definitely not needed to INSTALL 4.1.0 in front of a upgrade to 4.1.2. The only requirement is a downloaded 4.1.0 Firmware. This is described in the Admin Guide (Page 38) too: You must have a base image downloaded before you can install an update version. For example, you must have 4.1.0 downloaded (not installed) before you can upgrade your 3.1.9 device to 4.1.4.
... View more
02-14-2012
11:43 PM
Looking at Wikipedia isn't always helpful. E.g. if you are looking for allowing icmp-echo-requests, the app don't contain icmp or echo, it's the ping app. So I am looking for TCP-9000. Wikipedia shows me three entries and the third one (SqueezeCenter) is the one I am looking for. Applipedia don't contains something with "Squeeze" which leads me to the question: Is this app supported or is their just a different name? It seems, without testing you will never find out.
... View more
02-14-2012
12:15 AM
Hello Sometimes I just get the TCP ports for firewall configuration changes. Since the configuration on the Paloalto should based on the AppID's rather than TCP ports, is there a way to search for AppID's which are using a defines TCP Port (eg. tcp-9000)? Since every App has a "Standard Ports" Attribute, the Information are there, but it seems neither the Firewall GUI itself nor on the Applipedia ( http://apps.paloaltonetworks.com/applipedia/ ) supports such a filtering possibility. Is there another way?
... View more
02-13-2012
07:15 AM
As described, we have some VPN tunnels which allows any traffic (Proxy IDs 0.0.0.0/0). With this, we have a GRE-Like Encrypted tunnel. With VPN, there are always a lot of NAT configuration which could be wrong. Since the administrators on most of our remote sites aren't big companies, there usually don't have big knowledge in special NAT configurations. So, they are sometimes wrong and on a Zyxel (or similar) firewall, it is not easy to debug. Sometimes they even struggle on the routing part. An easy way to find configuration issues on the remote firewall (if you don't have access to it), is looking at the traffic which is coming from this VPN. Routing Issues -> No Traffic at all NAT issues -> Traffic with wrong source/destination IP If you can do a filter on outgoing interfaces, it's also an easy way to check if my NAT is correct. As described, I am looking for traffic which is not as expected. So, i am not able to filter it based on IP information. And for a setup like "each VPN has its own zone" (so I can filter based on Zone) the Paloalto doesn't support that much zones as we have tunnels.
... View more
02-09-2012
04:41 AM
Hi I am looking for a way doing a packet capture (or Debug Flow) with a filter based on a defined VPN Connection. The only thing I found, was a filter like "debug dataplane packet-diag set filter match ingress-interface tunnel" but with this I am not able to filter just one VPN Connection (eg tunnel.100). It seems, this command doesn't support sub-interfaces. Filtering based on src-/dst-address is not possible since we sometimes use GRE like VPN's (both sides of Phase2 ProxyID's are 0.0.0.0/0) and I want to check if src-/dst-IP are the right ones. Also, filtering based on zone is not possible since all our vpn tunnels are in the same zone (firewall doesn't support that many zones as we have tunnel interfaces)
... View more
02-08-2012
12:15 AM
Isn't it possible to upgrade directly to 4.1.2? Why is this intermediate step to 4.1.0 needed?
... View more
01-09-2012
06:34 AM
I am trying to create some reports based on the "Threat Summary Log"-Database. Unfortunately, I am not able to create a report which shows me just the blocked threats. If I use the "Threat Log"-Database, the report works fine (but to short time period), so I think the action is not stored in the Summary-Database. Can I change this behavior and add the action to the Summary Log?
... View more
11-10-2011
04:31 AM
Hi To block a webpage like Facebook, I have the follow two possibilities. 1) Block it by the Url Filter 2) Block it by the AppID Since the URL Filter just looks at the URL and no other content. Access to Facebook will only be blocked if I try to access it by "www.facebok.com". But access via " http://translate.googleusercontent.com/translate_c?hl=de&rurl=translate.google.ch&sl=de&tl=en&u=http://www.facebook.com/&usg=ALkJrhh_Iem_Ly3suOQ6H0aOBboI4hw4wg " will not recognize it as the Facebook URL --> no blocking If I use the AppID to block Facebook, I am expecting even blocking this Google translate URL since the content is still Facebook. But this isn't the case. I don't get any Facebook app in my traffic log. So, what is the exact difference between URL Filtering and AppID's (for "Website"-AppID's) and how can I block all this even if the user uses Google translate?
... View more
08-29-2011
06:46 AM
Hello Thanks for your answer. To sum up: Sites in my own category will always overwrite the BrightCloud (downloaded db and cloud lookup) definition. Btw: What do you mean with "Device cache"? Cached BrightCloud cloud lookups?
... View more
08-23-2011
03:52 AM
Hi I am wondering what will happen if one URL is in two different categories. Especially if one is configured to block, the other to pass the request. I don't know if this can happen within predefined categories (from BrightCloud), but as i am able to define new ones, its possible to add a already categorized URL in my own category. Our goal is, to have a global deny and allow category for all of our user groups. Defining the URL's in each of the URL Profile isn't a option, because its easy to get a inconsistency. So i would like to create two new Categories (globalAllow, globalBlock) and add (or remove) my URL's just to this category. To do this, I have to know the behaviour if a URL is in two categories.
... View more
07-07-2011
03:44 AM
It was the Certificate...bit I don't understand why the same Cert works fine with SSL-VPN. Additionally, my AV-Scanner did some strange things which got me some wrong debug results.
... View more
07-05-2011
01:38 AM
Hi Phil Same Cert works fine with SSL VPN. I generated it on the PaloAlto. I tested the Captive Portal with a external generated Cert too. In which logfile should I find some capitve debug messages.I took a look at a lot of logfiles but couldn't find any useful information. Marco
... View more
06-27-2011
08:44 AM
I tried to configure my PaloAlto with a captive portal, but something seems to be wrong, as i don't get any login form. As I use the captive portal in redirect-mode, the firewall forwards my browser request to something like https://publicWLAN:6082 . This seems to work right. I also got a "allow" Log entry on my traffic log. I tried to analyze the traffic from my test-computer (Wireshark on my test-computer) to this https://publicWLAN:6082/ ... . I can see a TCP-Session setup, ONE SSL Hello from my Client to the Firewall and Session close packets (initiated from firewall). So it seems to be something wrong with the SSL handshake. So, how can I debug this SSL handshake on the Paloalto.
... View more
Labels:
- Labels:
-
Troubleshooting
05-30-2011
02:45 AM
Must have: - Documentation Cleanup...E.g. There is an "official" Documentation (PA-4.0_Administrators_Guide.pdf) and a Lot of "How To" Guides (How to Configure HA on PANOS 3.1.2.pdf, Active Active Techz Note-2.pdf, ...). I don't like to have that many documents. Especially if they talk about the same topic and one File doesn't have all the info. - Easy Access to "show system state" information by Script (for Monitoring). E.g. accessible by SNMP or XML-API Nice to have: - Since the newest PanOS supports active/active. It would be nice to have a "active/passive"-per-VirtualSystem possibility. Its a lot easier to debug if you know, this hole V-Sys is processed by this cluster node. And there is no asymmetric routing within this setup.
... View more
05-03-2011
12:21 AM
Hello Thanks for your feedback. Is there a non SNMP-way to monitor device status? My goal is to create a Nagios script which checks the hardware status (Fan, PowerSuply, Temp, ...).
... View more
Contact Me
Latest Tags
No tags yet
Latest Blogs
Copyright 2007 - 2020 - Palo Alto Networks
