About MohammedAsik

MohammedAsik · ‎04-16-2020

Hi Team In sec policy I have allowed for some users only RDP and SSH application. But these users are able to use WINSCP application because WINSCP application also using port 22. I want to block winscp application but allow ssh application. How can we achieve this ? Please help us. Regards Mohammed Asik

MohammedAsik · ‎04-03-2020

Hi @JoergSchuetter Do you have "Save User Credentials" enabled on the portal config (authentication)? Yes, I have enabled this option. After disabled GP asking credentials for every time to connect VPN.( In my lab). But its not working in one of our customer machine. After I tried to disabled the 3rd option "Clear Single-Sign-On Credentials on Logout" its working in customer machine. Now issue got resolved. Thanks a lot @JoergSchuetter

MohammedAsik · ‎04-02-2020

Hi Team My firewall PAN os is 8.1.9 and GP version is 5.0.5. Issue : Whenever I try to disconnect and connect the GP, its connected without asking credentials. If i manually give sign out from GP then only its asking for login credentials to connect GP. My requirement is Whenever I try to connect GP it should ask Login credentials and then connect..without Login credential it should not connect. Please help me out in this Regards Mohammed Asik

MohammedAsik · ‎03-11-2020

Hi Team Please let us know the total number of concurrent Users that can connect to Global protect vpn on the PA 3220 firewall. Regards Mohammed Asik

MohammedAsik · ‎03-03-2020

Hi Team We are facing issues with the newer version of global protect client version 5.0.8 on MAC machines. The client once installed, doesn’t ask for credentials & try’s to connect directly to the vpn. Please let us know if there is an know bug relate to such issues. Regards Mohammed Asik

MohammedAsik · ‎02-12-2020

@adm2devos Please configure the customize URL category for https://urlfiltering.paloaltonetworks.com/test-grayware and add it in URL filtering with action block. configure decryption policy with ssl forward proxy. Then this page will be block.I tested in my lab its working as expected. Regards Mohammed Asik

MohammedAsik · ‎02-12-2020

Hi Mayur Issue got resolved after added the IP on tunnel interface.and PBF policy.I followed the below KB article. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIeCAK Thanks for your support. regards Mohammed Asik

MohammedAsik · ‎02-11-2020

Hi Mayur Yes, still I am facing this issue

MohammedAsik · ‎02-07-2020

Hi Svelez Yes I have security rule to allow from inside to vpn zone. Please find the below security rule and static route for respective tunnel traffic 144.250.3.222/32 0.0.0.0 10 A S tunnel.10 { from inside; source 172.31.62.0/24; source-region none; to vpn; destination 144.250.3.222; destination-region none; user any; category any; application/service 0:any/any/any/any; action allow; icmp-unreachable: no terminal yes; }

MohammedAsik · ‎02-07-2020

Please find the below ss tunnel.10 interface

MohammedAsik · ‎02-07-2020

Mayur its a tunnel interface. thats why its showing next hop as 0.0.0.0. In traffic logs its taking the internet rule and its not pass through tunnel interface. its passing through internet interface Ethernet 1/1. Mohammed Asik

MohammedAsik · ‎02-07-2020

Please find the below routing and security policy details 144.250.3.222/32 0.0.0.0 10 A S tunnel.10 { from inside; source 172.31.62.0/24; source-region none; to vpn; destination 144.250.3.222; destination-region none; user any; category any; application/service 0:any/any/any/any; action allow; icmp-unreachable: no terminal yes; } Regards Mohammed Asik

MohammedAsik · ‎02-07-2020

HI Mayur I have configured proxy ID s also. but its not working regards Mohammed Asik

MohammedAsik · ‎02-07-2020

HI Team I have created S2S VPN tunnel between palo alto and cyberoam firewall. Tunnel is up but the traffic is not flow. Under Cyberoam firewall there is one server with public IP 144.21.X.X. From palo alto we need to reach the peer end public IP 144.21.X.X via the vpn tunnel. but whenever I tried to reach the peer end public IP 144.21.X.X its going via the internet rule instead of vpn rule. Our requirement is that traffic should go via the vpn tunnel to reach the IP 144.21.X.X I have configured the PBF policy but its not work.. Please help on this Regards Mohammed Asik

MohammedAsik · ‎11-29-2019

HI Team Our customer has one requirement that need to upload files in Wetransfer application but its also using the web-browsing application to upload the same file. If i allow the Web-browsing application in policy unnecessary websites are getting open. Requirement is specific user uploading files to wetransfer application at the same time they are not browse anything all should be blocked. Please help us to achieving this Thanks in advance Regards Mohammed Asik

MohammedAsik · ‎11-04-2019

Hi Team Please let us know the IPS signature for Zero Day vulnerability in Google Chrome. Need to block this.Please help us. Regards Mohammed Asik

MohammedAsik · ‎11-01-2019

In traffic logs, I could see the session reason end was " aged out". But everything seems to be expected. For internet traffic NAT applied and could see destination address ip has been resolved. but in web browser its not resolved ( tried the same thing with three different machines. ingress interface --> tunnel.2 and egress interface --> eth 1/2 as per the configuration

MohammedAsik · ‎11-01-2019

Hi Team 1. After connected the global protect DNS resolution is not happening. but i can able to do ping 8.8.8.8. 2. In nslookup google.com also resolved. But if I ping the same google.com dns is not resolving. 3. If I browse any website, that is not working due to dns resolution issue. My dns IP is 8.8.8.8. Is anyone experienced like this type of issue. Please suggest some resolution for this Best regards Mohammed Asik

MohammedAsik · ‎10-30-2019

Hi Team We are planning to upgrade the firewall from 8.0.9 to 9.0.3-h3. Currently in my firewall we are using the URL filtering overrides, Authentication policy and API key life. In PAN 9.0 release information introduced the some new features changes to default behavior regarding URL filtering overrides, Authentication policy and API key life are as below snapshot. My concern is will this new features impact post OS upgradation ? and want to know in detail from the below snapshot. Regards Mohammed Asik

MohammedAsik · ‎09-18-2019

Hi julio My policy is trust to untrust and source destination is any any.. Not restrict anything

MohammedAsik · ‎09-18-2019

Hi Team In my premise we have more than 200 machines, In all of the machine Captive portal is not working on chrome browser only but its working fine on IE and firefox browser. Its not seems like browser issue. Something related to PA firewall. Please help me to fix the issue. Regards Mohammed Asik

MohammedAsik · ‎08-28-2019

Hi Vince Yes, In security rule I have allowed the application Ping , SSL, FTP and service as Application-default. Since the unwanted ports are hit the server without allowing the mentioned port Regards Mohammed

MohammedAsik · ‎08-28-2019

Hi Vince Incomplete mean, syn arrive to your server and your server never answer. Yes you're correct, the syn arrived to the server. My requirement is syn should not reach the server, it should block from firewall. How can we achieve it ? Regards Mohammed Asik

MohammedAsik · ‎08-28-2019

Hi Steve I had already configured as application default and I could able to ping from external network. But the issue is, we are receiving the lot of unwanted ports hit the server. Due to this, Server load become high. So that only we want to mention the particular the ports in service. I want to block the unwanted port hit from firewall itself which will not hit the server. Could you suggest me? Regards Mohammed Asik

MohammedAsik · ‎08-27-2019

Hi Team We have configured the one Destination NAT policy. My requirement is Ping the NAT IP (Public IP) from the external network. I have configured one security policy with application as 'ping' and service as 'any'. For the above configuration, I can able to ping the Public IP from the external network. But I want to allow the specific service for Ping application. Note : If I configured the service as "any or application-default", I can able to ping from the external network. If I mention particular service, I couldn't able to ping from the external network. My question is, What is the service need to allow only for PIng application? If you need any further information, please let me know. Regards Mohammed Asik

MohammedAsik · ‎08-06-2019

Hi Team Just to share additional details - We have nginx web server who acts as a proxy and directs traffic to the server where we have hosted Joomla (CMS). Every website of Joomla (i.e partner website) is SSL with Lets Encrypt. To be precise we have 350+ websites. We recently received attack on these websites which was not detected by Palo Alto, probably due to absence of SSL inbound Inspection. I configure my Nginx server in DMZ and Application server (Joomla) in LAN. Nginx server will decrypt the ssl traffic and transfer through PA firewall to LAN My question is, Will Firewall can now detect Vulnerabilities? Regards Mohammed Asik

MohammedAsik · ‎08-05-2019

Hi All, Thanks for all to share the valuable infornation. I will check and let you know the status. Again thanks very much for all Cheers Mohammed Asik

MohammedAsik · ‎07-31-2019

Hi SteveCantwell Thanks for your valuable infirmation. What size FW are you working with (thinking PA5000 series FW, so please advise)? My Answer : We are using PA 3020 firewall model. Please let us know is this model having better performance for decryption? Please advise. Regards Mohammed Asik

MohammedAsik · ‎07-31-2019

Hi Reaper I host more than 100+ websites. Do I need to upload certificate of all websites? Will it impact performance of Palo? Regards Mohammed Asik M

MohammedAsik · ‎07-31-2019

Hi Team Kindly help with below query. We approx host 100 websites of our partners. All websites are on SSL (https). I want to configure SSL Inbound Inspection. As per my understanding, I need to import SSL certificate of 100 websites for SSL inbound inpection. However this is not feasible. Is there any other simple way to implement the same. Regards Mohammed Asik M

Date Registered	‎02-11-2019 01:00 AM
Date Last Visited	Thursday
Total Messages Posted	50
Total Likes Received	2

Online Status	Offline
Date Last Visited	Thursday

Strata

Prisma

Cortex

About MohammedAsik