About SirchRettop

Hi guys,   What is the reason?   A brand new firewall from the factory, we give it a management ip-address and panorama server address, we import the firewall config to Panorama and commit to Panorama.   We then change the network and device templates so that we the ethernet1/1 and 1/2 become layer 3.   When we try to push this config to the firewall it fails   Is this normal behaviour?   Can you really not change the default config via Panorama.   You need to log in to each firewall if its a large deployment and delete the vWire and associated interfaces?   ... View more

Hi Live,   I'm experiencing an issue with a setup of aggregated ethernet interfaces configured with LACP simply for redundancy connections between our HA Active/Passive firewalls and Cisco ISR 4451 routers.   I'm wondering what steps to take as regards packet captures on firewall interfaces to figure out why negotiation will fail. Or is this expected behaviour?   ethernet1/1 and ethernet1/2 = AE1   Virtual IP (public/ default gateway) presented to firewalls from CPE Cisco routers.     So far we have tried all modes of LACP and transmission rates w/ active, passive, fast, slow but there has been still no change as regards ethernet1/2 and lacp negotiation failure with the router interface of GE0/0/2   I have reviewed >less mp-log l2ctrld.log but no indicators there either.     As far as I'm aware, physical layer 1 hasn't been checked.   Interface and AE/LACP settings     >show lacp aggregate-ethernet ae1   ... View more

Hi Community,   Having a headache of an issue lately and I believe it to be an issue on the customer environment rather than a setting configuration on the firewall, or software issue in PAN-OS e.g.   I've little experience with enterprise active directory so I learn as I go.   At the moment, customer has been using the Domain DNS for User Domain settings on Authentication Profiles and Group Mappings.   I plan to change this and make sure to use the NetBIOS in place of the domain DNS for User Domain settings in Authentication Profiles and Group Mapping settings.     PAN-OS 9.0.8 Global Protect 5.1.3 Windows Server: Not Sure   In the customers environment, certain subnets, be it wired or wireless,  the ip-user-mapping are picked up as sometimes lan.corp.com/user or corp/user.   Therefore, an ip-user-mapping of lan.corp.com/user isn't recognized as being part of the AD group corp/webaccess  and security rule is never hit.   Same user will then remove the wired connection, will be picked up on a different ip-address via Wifi but is now seen on the firewall as corp/user, is seen inside AD group corp/webaccess and hits the rule, gaining web access.   * * Again issue happens when users try to authenticate from home via Global Protect.    Verifying with command [ > tail follow yes mp-log authd ] users authentication will fail because lan.corp.com/user is not inside AD group globalprotect .... user will try again and again until eventually they are picked up as corp/user. * * I've searched almost all of LiveCommunity, Fuel User Group and Support Portal Knowledgebase to see if this has come up before.   Most articles state the requirement of using NetBIOS in place of Domain DNS but nothing stating what steps the customer should do to verify domain mapping and AD is correct.   Please help     ... View more

Hi community,   I'm wondering if it is possible to gain access to the below live community link or is this just for Palo Alto Networks employees?   https://live.paloaltonetworks.com/t5/Internal-Knowledge-Base/Designing-Networks-with-Palo-Alto-Networks-Firewalls/ta-p/60868   ... View more

Hi community,   I'm wondering what you guys like to focus on when running a Proof Of Concept with the nextgeneration firewall?   For example, you are running a PoC in TAP mode for two weeks. At the half way mark you have a call with the customer to show them what kind of traffic and/or threats have been seen, usernames in the logs.   Do you mainly focus on App-ID, Content-ID, User-ID... or do you focus on the ACC tab and help customer navigate.   Do you show them the reporting aspect, be it custom and preconfigured?   What is your approach?   Thanks for the feedback community.   ... View more