About a.jones

Hi All,   We have a problem with the report data on Solarwinds. We are running a multi-vsys Palo Alto 5220 with bgp connectivity to a router and need to run bandwidth reports on all vsys. All Vsys have at least 2 BGP Peering for inside and outside on 2 AE's, each assigned a particular Vlanif.  All reports seemed to look good but one person is saying one of the reports is reporting too little usage. On a particular vsys we are seeing bandwidth peaking at around 60Mb in the day. When I monitor the Router interface for that particular Vlanif I get a peak of around 600Mb which I am told is expected usage.   I can't see anything that would give this problem. We have configured a standard snmpv3 setup, monitoring on the relevant interfaces and vlanifs. I have looked at the reporting on a second pair of Palo Altos we have which reports around 350Mb at eak which is expected.   Has anyone seen this before and have a solution? Monitoring on the router is not ideal as I can't break down the traffic to Globalprotect, VPNS etc.   Regards   Adrian ... View more

Hi All,   I'm trying to configure a Floating IP for a VPN on an Active-Active pair of 5220's. I have the Floating IP configured with the Active-Primary Device Priority 1 and Active-Secondary with Device Priority 100. The Interface IPs for both devices are in different subnets to the Floating IP.   When I ping the floating IP from home, I see a log entry on the device for the ping but I never get a response from the ping.   Any idea's?   Regards   Adrian ... View more

Hi All,   I have recently configured a clientless vpn for a customer but the solution needs client certificates for the users to log in with a browser. Is there a way I can make this an authentication only solution with no client certificate requirement?   The GlobalProtect configuration is configured and working for staff members using PreLogon successfully. The clientless VPN is configured within this portal configuration. Authentication is only possible for users in the ldap group.   It all works but the client was no client certificate. Any resolution must not break the current PreLogon Globalprotect.   Regards   Adrian ... View more

Hi All,   Hoping someone can help. I need a custom response page for URL Filtering. I know I need to use Javascript but that is not my forte so hoping can provide the inform for me. I need to produce two distinct page responses depending on the IP address the user comes from ie: If they come from address range 10.0.0.0/8 a URL response page produces "Page Blocked for Security Reasons" If they come from any other address range a URL response page produces "Page Blocked because we have the power to do so".   I understand it is a text file I need to upload, it's just the page construct I'm struggling with.   Thanks in advance   Adrian ... View more

Hi All,   I have a pair of Active-Active firewalls that have now come under my management. There is an existing Ipsec VPN which is only configured on the Active-Primary so if this fails, the VPN goes down.   I have a required for 6 more VPNs. Has anyone configured resilient IPSec VPN on the Active-Active setup? What's the best way to achieve this - a floating IP or something else?   Once I have the new VPNs configured and operational I'll need to look at migrating the existing one.   Regards   Adrian ... View more

Hi All,   I have an issue with a Template push to device issue.   I have added some routes in the BGP import section and have committed to Panorama without issue. When I push to device I run into a couple of separate issues which is causing me problems.   When I push to devices using the force template values I get issues concerning HA and this error: ha1-backup interface ipaddr configured to match peer-ip-backup address   My setup is an active passive pair with unique management addresses, unique hostnames.   HA is configured with unique IPs for Peer HA1 on both, pointing to the IP set on Control Link HA IP set on the opposite device. The backup HA is configured to work on the management interface and the peer set to opposite device IP.   If I don't force template it is all okay, and it works apart from the config is not pushed.   If I force the template, the passive device fails with the error above but the primary device has the config on.   Question is how to resolve this through Panorama? If it can't, is it best to do this config on the device and is that achieved by selecting the "Disable Device and Network Template" in Device>Setup>Panorama settings?   Secondary quicky question - is it best to have sync config ticked post migration to Panorama as the documentation wasn't clear whether to enable it or not?   Regards   Adrian ... View more

Hi All,   A quick query that I have seen on my minemeld install.   I have created a number of RBL lists and I can see that although the miner is pulling (or indicating) there are IPs to be mined, when I look at the Aggregator I see that it is not aggregating any and therefor the output is 0. This was not the case when I built them. Any ideas?   As an example here are the prototypes I am using: Miner: attributes confidence: 50 direction: outbound share_level: green type: IPv4 source_name malwaredomainlist.ip url http://www.malwaredomainlist.com/hostslist/ip.txt     Processor: minemeld.ft.ipop.AggregateIPv4FT   Output: minemeld.ft.redis.RedisSet   Regards   Adrian ... View more

Hi All,   Quick question on my new deployment for Panorama. I have a HA pair with unique hostnames and IP addresses with firewall as an active passive pair. The migration steps state the following: Do not combine the HA firewall pair in to a single template if a unique Hostname, management IP address, or HA configuration is configured for each HA peer. You may also configure a unique Hostname, management IP address, or HA configuration locally on the firewalls.   What do I need to do to accommodate this? I may be having a "stupid" moment but the documentation is not 100% clear (bad night and 6.30am). Using this document: https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management.html#id177DF10905Z   Regards   Adrian ... View more

Hi All,   Can someone help me with a NAT over VPN. What I thought was correct isn't working and I have tried a number of combinations that all fail.   The encryption domains are (based on Palo) Remote 85.90.253.239, local 192.168.90.228, to reach a server on IP 10.0.8.82.   What would the NAT look like? Every combination that I think is correct doesn’t see the NAT rule hit. Probably so simple I'll headbutt the desk but for now....it's eluding me - albeit I've spent the weekend migrating 5 large councils to a Palo Solution so very worn out.   Regards   Adrian ... View more

Hi All,   I have installed minemeld on Ubuntu 18.04 using Ansible Playbook. I have followed the instuctions on https://github.com/PaloAltoNetworks/minemeld-ansible#howto-on-ubuntu-1804 and rebooted the device but I get the Error Checking Credentials: Bad Gateway error.   Looking at the supervisorrd.conf status I see minemeld-web in a fatal status. Looking ath the minemeld-web log I see the following: root@ld1-mm01:/opt# tail /opt/minemeld/log/minemeld-web.log File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/minemeld/flask/main.py", line 3, in <module> app = create_app() File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/minemeld/flask/__init__.py", line 67, in create_app from . import metricsapi # noqa File "/opt/minemeld/engine/0.9.64/local/lib/python2.7/site-packages/minemeld/flask/metricsapi.py", line 19, in <module> import rrdtool ImportError: librrd.so.4: cannot open shared object file: No such file or directory [2019-12-03 08:46:39 +0000] [1092] [INFO] Worker exiting (pid: 1092) [2019-12-03 08:46:39 +0000] [1089] [INFO] Shutting down: Master [2019-12-03 08:46:39 +0000] [1089] [INFO] Reason: Worker failed to boot.   I have followed instructions to downgrade pip but that does not work.   There are instructions to do the following pull (not sure how to do this or if it is necessary): https://github.com/PaloAltoNetworks/minemeld-ansible/pull/43   Any advice on how I can get this working?   Thanks   Adrian ... View more