About Stevenjwilliams83

Looking to see if anyone has configured Prisma Access with OneLogin? I am looking for the parameters needed for the ACS consumer URL and Validator.  ... View more

Sometimes I feel Panorama is a great tool, sometimes I rather manage firewalls locally and just API for mass pushes and deployments.   I had a firewall that was overridden in a few places and wanted to get this back in sync with panorama. So I followed this article:   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008UIPCA2&lang=en_US%E2%80%A9   it seems after all this reading and following these instructions all the sections on my local firewall are overridden now....why?     ... View more

I am trying to bulk add address objects to panorama instance in AWS using the panos for terraform and keep getting errors about the plugin. Can you use panos with terraform to push address objects via API to cloud instances or is there another way you are to do this? Or is this something that cannot be done period?   initializing provider plugins... - Finding latest version of hashicorp/panos... Error: Failed to query available provider packages Could not retrieve the list of available versions for provider hashicorp/panos: provider registry registry.terraform.io does not have a provider named registry.terraform.io/hashicorp/panos If you have just upgraded directly from Terraform v0.12 to Terraform v0.14 then please upgrade to Terraform v0.13 first and follow the upgrade guide for that release, which might help you address this problem. Did you intend to use paloaltonetworks/panos? If so, you must specify that source address in each module which requires that provider. To see which modules are currently depending on hashicorp/panos, run the following command: terraform providers ... View more

I have been trying to get this to work for days not and I am not getting anywhere. I always seem to struggle with certs due to how they are chained.    On my Palo I have a rootca (self-signed, certificate authority), intermediateca (issued by rootca, and also certificate authority), then I cut a cert called gp-cert (issued by intermediateca, non certificate authority).    My cert profile includes the intermediateca and the SSL/TLS SP includes the gp-cert.    I have downloaded the intermediateca cert without private key in PEM format and exported the gp-cert with private key in PSK12 format.   My DNS name for my gatway/portal lets say is vpn.company.com   vpn.company.com is the CN for the gp-cert   I upload these to my iPhone11 and when I attempt to connect I get an error:   Cannot verify server identity There is a problem with the security certificate. The identity of vpn.company.com cannot be verified.    My options are cancel or detail.   Detail gives me the certificate details and thats it.    I always remember I could click continue when this happens so did something change in iOS or is this an issue with my certs and how I have them chained or exported, or even signed?      ... View more

I have been having issues with DHCP server reservations on the panOS 10.x    I make reservations and I have found some devices i made reservations for get other IP addresses at times and botches my policies.    Anyone else have this issue? ... View more

I am new to this API stuff and I am trying to use postman to get just basic objects out of my palo. Just something as simple as "https://192.168.81.50/restapi/9.0/Objects/Addresses" the return I get it cannot get any response. I setup my api key in authentication portion of postman and selected to be added to header and I just cant get anything to work so any help would be great.  ... View more

I have added the URL to the exception list with no luck. Any suggestions?   C:\Users\Steven Williams\AppData\Local\Programs\Python\Python38>pip install Flask-SQLAlchemy WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ Could not fetch URL https://pypi.org/simple/flask-sqlalchemy/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/flask-sqlalchemy/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))) - skipping ERROR: Could not find a version that satisfies the requirement Flask-SQLAlchemy (from versions: none) ERROR: No matching distribution found for Flask-SQLAlchemy Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))) - skipping C:\Users\Steven Williams\AppData\Local\Programs\Python\Python38> ... View more

Anyone have issues with FB messenger or other chat platforms when SSL decryption is on? I see the logs say its allowed and tcp-fin but it doesn't work it just spins in a wait state on the app. when i click off my wifi and on to lte then it works fine so I know its the palo but cant seem to figure out what to exclude for ssl decrypt. I do not want to exclude *.facebook.com because that would be bad.  ... View more

I can't seem to get the policy right for my Meraki APs to check in with the meraki cloud. I have allowed DNS, Ping, Meraki-cloud-controller using any port and allowed to *.meraki.com and *.opendns.com. Still see stuff hit my deny. Anyone know the correct combo for a policy? ... View more

I have this weird issue where if my wireless clients lose connectivity to my meraki AP and then have to rejoin after the AP reboots, the DHCP server on the PA-220 stops handing out DNS servers that are inherited from the untrust port. I have all clients on my network as DHCP reservations. After they can't get DNS servers I have to reload the PA-220 and it takes forever to reboot. There is an article about setup a dummy scope, but I already have a scope so its not that. Anyone else have these issues?   running code 9.0.3-h3 ... View more