About karthikeyanB

Dear Team,   Please help us to below points... For 9.1.3 what should be the VM Sizing for the Panorama We are migrating from 8.1.10 to 9.1.3 whether the logging format will change There is default behaviour Changes can you give a heads up Regards Karthikeyan Balamurugan ... View more

Dear Support Team,   Please do us favour to update Security appliance Palo Alto with latest signature which help to prevent from latest vulnerability Authentication Bypass in SAML Authentication.   Patch requirement for  CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication   Regards Karthikeyan Balamurugan ... View more

Dear Team ,   One of our customer had vapt points of ssh weak ciphers vulnerabilty we had run the below commands     set deviceconfig system ssh ciphers mgmt aes256-ctr   set deviceconfig system ssh mac mgmt hmac-sha2-256  set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256 set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 2   so the customer had run vapt again, they are getting   arcfour   weak ciphers error. https://live.paloaltonetworks.com/t5/general-topics/how-to-disable-ssh-weak-algorithm-supported/td-p/204407   Note: Threat License expired   Regards Karthikeyan Balamurugan ... View more

Dear Team,   We are facing an issue in VPN where in Authentication of users is removed frequently at a random time.   IMPACT :   We have created Source User base policy - Hence once a user session is timed out, browsing of the user is impacted. User needs to relogin and then can access Internet Traffic. However Tunnel is always active and only "User Authentication" gets removed.   1) Browsing error - When the auth of the user is removed, user web browsing traffic gets blocked. 2) Session Browser - We Seen Traffic Details 3) System Logs - we got session timeout notification 4) Traffic Logs - Showing traffic hitting deny rule. 5) URL Logs - Showing Source Users mapped to ip gets removed (Zoom Webex is ip base policy and hence traffic gets routed through that Security Policy)   PAN  OS Version : 9.0.7   Please help to resolve the issue ASAP   Regards Karthikeyan Balamurugan ... View more

Dear Team,   As per the customer requirement we want to perform Port spanning or port mirroring on the firewall interface so we need confirmation whether it is recommended from Palo Alto and if we perform this will there be any impact on the firewall as firewall is in production at data center or is there any alternate method for this.   Request your immediate help on this.   Regards Karthikeyan Balamurugan ... View more

Dear Team,   We are not getting proper report for Last calendar month using query builder i.e (zone.src eq VPN) and destination is any and report has generated from 17 April to 23rd April. When use    query builder i.e (zone.src eq VPN) and  (zone.dst eq LAN) it is showing whole month report i.e starting from 1st April to 30th April.   Regards Karthikeyan Balamurgan ... View more

Team,              Below Advisory mentioned that openssh 7.9 is affected with few vulnerabilities  and on upgrade to 8.1.13 will resolve it. https://security.paloaltonetworks.com/PAN-SA-2020-0002   but below pan os open source listing mentioned as openssh version is 6.4 is used.  So can you please confirm whether update is required and whether update to 8.1.13 will resolve the issue???   https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-8-1-open-source-software-oss-listing.html Or whether Openssh version identification method is incorrect??   Warm Regards, Karthikeyan Balamurugan ... View more

Hello Team,   The below things are need to clarify,,,   How to know calculate SSL VPN interfaces bandwidth Individual VPN user bandwidth consumption Which VPN interface the highest bandwidth user is connected to All active connected VPN users Time duration of the connected VPN user if we enabled Split tunnel, SSL VPN Bandwidth should be increase?? Regards Karthikeyan Balamurugan ... View more

Hi,   We are facing issue with DNS Application, it uses more DP CPU Utilization 60 to 70%. We have done DNS Application override but no luck.   Please find the DNS Session details below.   Mem-Pool-Type MaxSz(KB) Threshold MinSz(KB) CurSz(B) Cur.Alloc Total-Alloc Fail-Thresh Fail-Nomem Local-Reuse(cache) dns 2048 80023 1024 830152 10012 279410 0 0 23472 (5)   Cache-Type MAX-Entries Cur-Entries Cur.SZ(B) Insert-Failure Mem-Pool-Type dns 7936 0 0 0 proxy dns_v4 10000 10000 829576 0 dns dns_v6 10000 0 0 0 dns dns_id 1024 12 576 0 dns   show running application statistics =================================== App (report-as) sessions packets bytes app changed threats dns 617738743 2661297868 269003342139 0 0 dns-over-https 144 3304 928999 145 0 DNS_Custom 914095 3979943 370509720 0 0 google_Custom 11823 1441034 876588498 0 0 google_Custom-1 105603 953550 198205705 105725 0 google_Custom-2 169 1735 380693 482 0 google_Custom-3 1 10 2237 6 0 google_Custom-4 15447 142899 31053748 15573 0 alipay 213 8487 3887252 214 0   How to reduce the DNS session count or any other alternative way to overcome this issue?   Any help here would be appreciated.   Regards Karthikeyan Balamurugan ... View more

Hello Team,   We need your support to provide specific access to system admin user. We need to provide access one of system admin only for configuring VPN user & create system admin user. Kindly confirm can we create a custom admin profile for above task or any another way to restrict access.   Regards Karthikeyan Balamurugan ... View more

Dear Team,   want to confirm whether we can decrypt FASP application or not ? , or can we do decryption for other than 443 traffic ? Please confirm whether we can decrypt non-443 traffic ? Regards Karthikeyan Balamurugan ... View more

Hello Team,   Three year before ,One of my customer is generated the certificate from linux machine and sent it to comodo for third party sign. Now they got new palo alto firewall and he is trying to install that certificate on palo alto but while installing certificate we are facing "Mismatched Public and Private keys"  I have one more doubt that, in order for creating a External CA signed certificate. What is the proper way to achieve it whether by generating the CSR from a Linux machine (or) CSR that generated by the PA Firewall itself. Do clarify me on the same. Thanks in advance !!   Best Regards, Karthikeyan Balamurugan         Regards Karthikeyan Balamurugan     ... View more

Dear All,   Kindly help me understand below query -     We would like to configure Security Policy Action "Block IP" for Critical, High and Medium level Vulnerability signatures for 3600 sec. As per understanding traffic from source-destination pair; Configurable for a 3600 seconds (period of time) will be blocked.   However request you to clarify whether traffic will be Allow or dropped on first attempt or detection of Vulnerability (Critical, High and medium) signature.   Please clarify.   Thanks in advance ... View more

Hello Team,   Kindly inform what is the information contains in md2 partition? Also inform the threshold for each partition.   Regards Karthikeyan  ... View more

Hello Team,   I have tried to configure SNMP V3 to send trap messges to opmanager in palo alto.  - At the tiime we struct with engineID,here we are unable to find engineID for Palo Alto in Opmanager.  - And also SNMP Walk itself its not working. - Its seems something i was missing in the configuration. - Can anyone help me here on what are things need to configure to properly work SNMP V3 but in the same SNMP V2 is working properly without any issues. SO issues is only with SNMP V3.   Awaiting for a reply !!   Best Regards, Karthikeyan Balamurugan     ... View more

Hi,   Please help to resolve the following vulnerability Vulnerabilities : 1. HTTP DELETE Method Enabled (http-delete-method-enabled) 2. HTTP OPTIONS Method Enabled (http-options-method-enabled) 3. TLS/SSL Server Supports The Use of Static Key Ciphers (ssl-static-key-ciphers) Thanks in advance ... View more

Hi,   How can we gather the Beacon Detection logs for Co-relation logs in our Syslog Server.   Regrads Karthikeyan Balamurugan     ... View more

Hi,   We have tried the below article tool to migrate the cyberoam to palo alto firewall but it wont work for cyberoam. Why it's not working? If there is any alternative way to migrate the firewalls?   https://live.paloaltonetworks.com/t5/Expedition-Migration-Tool/ct-p/migration_tool   Regards Karthikeyan Balamurugan  ... View more

Currently we are facing a peculiar issue with Linux system, which when connected to URL but are unable to fetch the OSquery packs from the mentioned URL. The same url is working properly when the linux system is connected to an open internet & able to download the packs.   We have already allowed the Destination ip’s of URL in our firewalls.    Thanks in Advance ... View more

Dear Team,   I have a Dual ISP (Primary/Secondary). I need to configured IPSec Tunnel via Load Balancing method.  What the method that we can apply to achive this.   Regrads   Karthikeyan Balamurugan ... View more

Hi All,   How to integrate the Everest application in Palo Alto firewall.   Regards Karthikeyan Balamurugan ... View more

Dear Team,   We Have PA Firewall With Single ISP and Peer End Sophos FW With Dual ISP.   Here I need to configure VPN Fail over. What are the step i need done PA side?    Regards Karthikeyan  ... View more