About Sethupathi

Hi Batd2,   This issue persist when  not exiting globalprotect prompt-mode properly.   If you enter into the interaction prompt you have to quit it properly (don't use cntl+c <-- if you use cntl+c it'll stopped not quit the process will hang) you have to kill it using of below command, PC:~$ ps aux | grep global protect <----- verify the process then kill it PC:~$ globalprotect disconnect <-------- if on demand mode PC:~$ globalprotect disable <-----------if always on mode PC:~$ globalprotect show --details PC:~$ globalprotect show --status   To connect use below command, PC:~$ globalprotect connect --portal <portal ip>   - Regards, Sethupathi   ... View more

Hi Team, Could you please help us here. ! ... View more

Hi Team, Could you please help us here! ... View more

Hi Stuart, For HTTP OPTIONS and DELETE method allow (note there is no associated CVE and both are standard HTTP methods). After review, both HTTP methods do not have actual impact on firewall management Web GUI therefore the said vulnerability was not applicable in this scenario. Palo Alto firewall allows HTTP OPTIONS and DELETE methods because a new RESTful API capability is using it, not the web server itself. Therefore these two listed vulnerabilities are not applicable in Palo Alto Network firewall. - HTTP DELETE Method - HTTP OPTIONS Method For the last vulnerability, "3. TLS/SSL Server Supports The Use of Static Key Ciphers (ssl-static-key-ciphers)" related to static key ciphers, this can be mitigated by using a ECDSA based certificate which will limit to the following forward secrecy ciphers in 8.1 ECDHE-ECDSA-AES-128-SHA ECDHE-ECDSA-AES-256-SHA ECDHE-ECDSA-AES-128-GCM-SHA-256 ECDHE-ECDSA-AES-256-GCM-SHA-384 Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5mCAC Steps for securing the administrative access: 1) Generate/import an ECDSA server certificate on the firewall. This can be generated by using a self-signed CA ECDSA or your internal PKI ECDSA certificate. Please note the certificate that is reference by the SSL/TLS service profile cannot be a CA certificate. 2) Create an SSL/TLS service profile with Min and Max versions set to TLSv1.2 3) Reference the ECDSA certificate in the service profile 4) Apply the profile(s) to the various L3 SSL/TLS services Hoped this clarifies.   - Regards, Sethupathi M ... View more

Hello BatD,   thanks for your prompt response. I'll check the same.   With Regards, Sethupathi M ... View more

Hi Team,   Could you please help us here.   Regards, Sethupathi M ... View more

Hi Team,   Could you help us here to fix the vulnerability.   Note:Getting this vulnerability when scaning Management port.   PAN-OS version 8.1.9   Regards, Sethupathi M ... View more

Hi Team,   Could you help us here to fix the vulnerability.   Note:Getting this vulnerability when scaning Management port.   PAN-OS version 8.1.9   Regards, Sethupathi M ... View more

Hi Team,   Having dedicated HA ports and which is directly connected.   It has been noticed that , Total management plane consumed disk space i.e. root partition is almost full.   Filesystem            Size  Used Avail Use% Mounted on /dev/md3              3.8G  3.3G  295M  92% / /dev/md5              7.6G  4.1G  3.1G  58% /opt/pancfg /dev/md6              3.8G  2.0G  1.7G  55% /opt/panrepo tmpfs                 2.0G  116M  1.9G   6% /dev/shm cgroup_root           2.0G     0  2.0G   0% /cgroup /dev/md8              198G   44G  144G  24% /opt/panlogs tmpfs                  12M     0   12M   0% /opt/pancfg/mgmt/lcaas/ssl/private   Note:I'm having  PA-5050   Could any one help us here.   Regards, Sethupathi M   ... View more

Hi Brandon,   I'm having PA-5050.   Regards, Sethupathi M ... View more

Hello Team,   I'm also getting same, Problem description: 1)        Observed data plane under severe load message in the system logs. 2)        Within a second, got “All HA2 keep alives are down” message 3)        HA keep alives were down for exactly 4 seconds. Can anyone suggest what is the troubleshoot methods and how can I findout a RCA.? Could you help us here.   Thanks & Regards, Sethupathi M ... View more

Hi,   I can't access this document, Please help us with a new one or a any suggestion?   Regards, Sethupathi M ... View more

Hi Otakar,   When we enabled our LAN interface to be part of multicasting  other IP flood threats get started and same is drops in zone protection in critical category and which also spike up my data plane CPU by 10 %   Also we removed zone protection from LAN zone and enabled multicast , then our firewall goes on toss i.e. it disturb my CPU as well as other protocol like BGP.   In customer environment they have configured Dos policy from WAN to LAN zone, and also Zone protection profile for LAN zone as well as WAN zone ..?? (Is this a recomended way for using both Dos and Zone protection profile ?)   Regards, Sethupathi M ... View more