About Jatin.Singh

reaper

are you triggering anything in the threat log ?

Jatin.Singh

@MP18 @OtakarKlier Hi. We have done some troubleshooting on our end host PC and have found some TCP sessions that are continuously being created by our system and therefore sending traffic over the VPN Tunnel and keeping it alive. The TCP sessions are created, and then they time out. Then another TCP session is established and also times out. We are not initiating this traffic and there are no other active processes that are trying to send traffic over the VPN. Could you please see the attached screen shots and tell us how we can change this behavior so that we can effectively test the idle timeout settings on our Palo. If you require any other information, please let us know. Thanks Also what exactly is the difference between Inactivity Logout and Disconnect on Idle?? Seem to be same

reaper · ‎04-30-2020

Push the templates first, then push the policy (Also please don't put your subject in all caps, this is a professional forum 😉 )

Jatin.Singh · ‎04-21-2020

One of our client is getting previous week’s report on Weekly report emails. We have modified the dates of the report but this does not change thing. Checking to see if there is any other setting changes we can perform? It is a Weekly Activity report with: Top 10 users & Top 50 Application We also made changes to it from " last calendar week" to "last 7 calendar days" but still receiving last week report Followed this KB - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClvuCAC Please see config below

Jatin.Singh · ‎04-21-2020

This was raised with the TAC and the following fixed the issue Action Taken: ------------------ - SSO works fine when we select GP icon as credential provider during the login. - We also made changes to make GP as default credential provider as below. HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SetGPCPDefault to 1

BPry · ‎04-17-2020

@Jatin.Singh Contact support and get the Traps Cleaner for the version that you are having an issue with. They'll send you a folder with three files on it, and you can package that for SCCM.

SutareMayur · ‎04-15-2020

@Jatin.Singh, To be frank, i never worked on this and not really sure about this. I just shared the article that i had in my database. May be you can connect with support team to check what are the possibilities. Mayur

reaper · ‎04-02-2020

what version of PAN-OS is running on your Panorama? if it is old, consider upgrading in case there's a buig that fixes this if it is recent you'll want to reach out to support

reaper · ‎03-23-2020

hi @Jatin.Singh this is most likely, as @kiwi indicated, a disk space issue :https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS try clearing out disk space and try again if that still fails, try manually uploading 7.1.25, install and reboot

Laura_Strutzel · ‎03-17-2020

Does the palo alto device need rebooted to make the ssh changes take affect?

Yasasreeram-Cheedella · ‎03-11-2020

Hi Jatin, QoS is always applied on the egress interface. 1. T o limit upload, a QoS profile needs to be enabled on the untrust interface 2. To limit download, a QoS profile needs to be enabled on the trust interface. 3. In your case, to limit both download & upload traffic, QoS will have to be applied on both interfaces. 4. QoS Can also be applied to tunneled interfaces, please refer to https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEfCAK Hope this helps, Regards, Ram

SutareMayur · ‎03-11-2020

If you want to load balance two Global Protect VPN sites, the simplest way is to use one single GP URL and bind this URL to public IP of both VPN sites. So at dns level, by default it will work in Round Robin fashion. Mayur

Diegoz · ‎03-04-2020

Yo tengo en le mismo problema con la version 8.1.9, lo que nos informa es los siguiente: Actualmente, el problema de capacidad aislada del equipo DevOps en la nube de la UE se está abordando y estan trabajando en ello. Saludos

hshawn · ‎02-26-2020

@reaper Hmm, What about clientless VPN?

SutareMayur · ‎02-19-2020

Hi @Jatin.Singh, That's great. Could you mark this question as solved please. Mayur

SutareMayur · ‎02-16-2020

@Jatin.SinghWhat do you see in traffic logs? Is it allowing dns queries ? Mayur

reaper · ‎02-11-2020

@Jatin.Singh no pnorama receives the hostname once the firewall connects to it, so after you changed the hostname, the second panorama will only receive the new hostname when the firewall connects to it and reports its new hostname

BPry · ‎02-04-2020

@Jatin.Singh, This works perfectly fine and you can upgrade the individual agents before upgrading the agent bundle on the firewall if you need to.

BPry · ‎12-19-2019

@Jatin.Singh, You can put a feature request in with your SE so that he can either log a new Feature Request or add your companies vote to an existing FR.

BruceBennett · ‎12-01-2019

We had PAN Proffessional Services help us with our Azure deployment and they recommended going with individual firewalls and use Azure for load balancing between them. We went in expecting to run actuve/passive HA, but implemented their recommendation and it has been running great since it was installed. Unfortunately, I cannot give you the details behind why the recommendation to not use HA, other that two different PAN Engineers telling us that HA and Azure just don't work well together.

SteveCantwell · ‎11-20-2019

You can shutdown/reboot the Panorama. Should not be an issue. I am just curious if possible, to download a brand new 9.0.0 version of Panorama and create a new Panorama install. Not sure how far you have gotten with your logs, significance of logs (which I understand... probably important... ) Just at the end of day (so to speak) what is the most efficient way to get your Panorama back up and operational.

Jatin.Singh · ‎11-12-2019

We have one panorama virtual appliance [hostname: Panorama] running as mgmt server & local log collector -- Pan01 – [ collector-group : ac3 ] 2. There are other two virtual appliance pan02 & pan03 [dedicated log collectors ] will be added to the same [ collector group :ac3 ] Stage-1 After above 3 in the same log collector group, we’d like to enable log redundancy, as we assume this will make fw log sync between all 3 log collector members --- if this is wrong understanding, please advise the correct way? Stage-2 Once the log synced between all members, we’d like to convert the Pan01 to mgmt server Only, Not collecting downstream managed fw log any more While the other two Pan02 & Pan03 will still collecting log from managed fw and be managed by Pan01 ---- during this sync and convert process, will there be any moment we will be losing any fw log forwarding from managed devices ? -- please confirm Also, please confirm if this sync & convert approcach is doable or not?

SteveCantwell · ‎10-29-2019

Hello there... I have a simple question that I would like to better understand. With the split tunnel enabled, can you confirm that both DNS server entries are seen by the client machine? If this is true, then my question seems to be, what happens when the first goes down... (can you run a wireshark) to confirm that, indeed, the 2nd DNS server is being properly queried by the client. I would think this would be a client issue primarily. Of course, if you can show that DNS requests are making it across the VPN to the FW and not being resolved, that is a different story (and one which I think you are attempting to believe the issue is, but let's try to confirm our theory)

OtakarKlier · ‎10-04-2019

Hello, As Reaper mentioned, its a straight forward process. I would suggest that the two devices be on the same code version so it doesnt cause any weirdness. But basically exporting the config from the old device and importing into the new. Done it a few times. Regards,

mope_itadel · ‎10-03-2019

We have seen the very same issue on quite a few of our customers. The big issue is not that the split tunnel config is not pushed, but actually the Panorama pushes a blank split tunnel config to the firewall. This causes quite a few issues if the policy set does not allow internet access from the GlobalProtect zone.

SteveCantwell · ‎09-23-2019

resources-unavailable The session dropped because of a system resource limitation. For example, the session could have exceeded the number of out-of-order packets allowed per flow or the global out-of-order packet queue.

GeorgiosFakis · ‎09-16-2019

It seems that cannot find a server in auth GP-VPN-AUTH so go there to see what you have stated and then go to server profile to see if the profile has any IP .

BatD · ‎09-11-2019

@Jatin.Singh Yes, this is what I was trying to explain. You either manage the routes in Panorama templpate or localally on the firewall for the same VR. You can't mix the two and to fix it you will need to decide which routes do you need to keep.

OtakarKlier · ‎09-11-2019

Hello, I would say it is not a false positive since its a log, e.g. something the PAN is detecting. DO you have a scanner running using your credentails? I would find that device with that IP address and see why its doing what its doing. Regards,

Venkatesan_radhakrishnan · ‎09-05-2019

Check this article for kswap in high peak. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUbCAK

Date Registered	‎05-26-2019 05:38 PM
Date Last Visited	Thursday
Total Messages Posted	48
Total Likes Received	1

Online Status	Offline
Date Last Visited	Thursday

Strata

Prisma

Cortex

About Jatin.Singh