About Javith

Hi All,   Firewall is connecting to update server. it retrieves all the recent PAN-OS versions and all dynamic updates(app ver).    But when i start to download the software/dynamic updates, its connecting to update server and exchanging some packets but download stuck at 0%   device is registered, restarted managment plane, cleared job id, still stucks at 0% download. no license issue(they have only support license) tried both staticupdates.paloaltonetworks.com and  updates.paloaltonetworks.com.  source-isp interface ip to all traffics are allowed. Please suggest ... View more

Hi All,   Some of the sessions are ended with Resource-unavailable reasons. Almost all traffics in these sessions are web-browsing and some updates traffics on port-80.   All https-443 are working fine. this issue happened for 4 hours on last week.  checked here for describtion: https://www.paloaltonetworks.com/documentation/61/pan-os/newfeaturesguide/networking-features/session-end-reason-logging.html   Is there any way to resolve?. Please suggest ... View more

Hi All,   I have configured everything correct. But no entry in LDAP server security logs while I try to login paloalto Web UI using LDAP profile.     Here at pan I can retrieve the all group user. I have configured the auth. Profile to 'all' entry in allow list..tried both domain\username(captive portal working fine with this format) and username alone..Pls suggest     admin@paloalto> tail follow yes mp-log authd.log   2015-11-05 12:35:02.826 +0530 debug: pan_auth_request_process(pan_auth_state_engine.c:1537): Trying to authenticate: <profile: "", vsys: "", username "cslworld\paloaltotest">   2015-11-05 12:35:02.827 +0530 debug: _get_auth_prof_detail(pan_auth_util.c:928): "cslworld\paloaltotest" is an admin user   2015-11-05 12:35:02.849 +0530 Error: pan_auth_cache_get_admin_authprof(pan_auth_cache_adminusers.c:222): No default auth profile found for username paloaltotest   2015-11-05 12:35:02.849 +0530 Error: _get_admin_authentication_profile_by_name(pan_auth_util.c:501): No admin auth prof found with the name paloaltotest   2015-11-05 12:35:02.849 +0530 Error: _get_admin_authentication_profile(pan_auth_util.c:546): No auth prof/vsys is found for admin user "paloaltotest"   2015-11-05 12:35:02.849 +0530 Error: pan_get_authprofile_n_setting(pan_auth_util.c:1029): Failed to get authentication profile for admin cslworld\paloaltotest ... View more

Hi All,   We have configured IPSec VPN between PAN and AWS.    When i iniate the tunnel, IPSec and IKE SA installed successfully as a initiator. then, IKE protocol IPSec SA delete message sent to peer. SPI:0x... After a second, IPSec key deleted. Deleted SA..... please suggest      ... View more

Hi All,   We want to view the traffics in Mbits/sec. We have configured QoS and see the traffics in realtime.    Is there any traffics reports in Mbits?..In Graph, I see the traffics in Bytes.    Please share any alternative ways.. ... View more

Hi All, We configured captive portal-redirect with local db when unknown users(who are not in AD,belongs to local db) redirected and web form is authenticated. But the problem is they can't browse internet. Browser shows" page not loaded" to those users.. Can you tell me possible cause? One more problem.. Users who are logged in via LDAP are disconnected over particular time(in a day).. After restart their PC and log in again..its(user-ip) working. Setting: server session enabled, can i put more minutes in timeout? Please temme possible cause?.. Thanking you ... View more

For particular traffic, session created and security rules hits But URL filtering profile blocks the traffic....when allow the unknown in URL filtering profile -traffics are allowed. In Logs: Packet categorized as Unknown udp... This traffic is Tally ERP 9.0 from client-server. Can i create custom app-id? with pattern or not?..so that the particular traffic internal packets will not be inspected..? Please suggest ... View more

Hi All, my req: isp 1 4mbps(untrust) ->pa 500a->(trust)cisco switch l3a-> isp 2 4mbps(untrust)->pa 500b->(trust)cisco  switch l3b->    same web servers but using  isp 1 &2 public ip's(redundancy purpose) to do static s-nat for web servers external users should use both isp to reach web servers in active/active ha mode->load share/balance.. my config doubts: trust l3 ips connected to cisco switch should be different..right? dns servers for both isp's are different..so i changed default 4.2.2.2/8.8.8.8 to isp dns servers..right? web servers should be exposed to external users-so configured s-nat static and tick bi-directional..right? Please suggest best and simple practise to this requirement and confirm me whether above steps are right? how to do ha active/active..please tell me procedure.. ... View more

I configured ipsec vpn with palo alto to checkpoint. pinging isp: local/external ip(182.x.x.x) to peer ip(102.x.x.x) ping successful. pinging local network to peer ip: local pc(10.10.10.x) to peer ip(102.x.x.x) ping unsuccessful..tracert confirm drops on internet..ike not established(verified by show vpn ike-sa gateway )..following vpn troubleshooting doc. ping 10.100.100.x(remote ip) from fw cli ping remote pc (10.100.100.x) and pinging peer ip from firewall cli successful..but prblm is it doesn't take external ip(182.x.x.x) route..it takes another route(customer says vpn is connected to other fw too) so fw takes that routes and successfully pings remote ip then i put this command: ping source 182.x.x.x host 102.x..x.x  ->successful ping source 182.x.x.x host 10.100.100.x->unsuccessful.. after going to system logs->it shows ike phase 1 aborted msg and sometimes both phase 1 and phase 2 succeeded logs..but ipsec tunnel is not showing up. Can i tell customer to disconnect same vpn connection which is using another route to reach remote ip successfully(directly connected i think) ?? Please suggest.. ... View more

Hi All, I have websense web filter license. I want to integrate it with PAN firewall. Could you share any documents to integrate it as proxy.? Please guide. Thanks ... View more

Hi All, Wan interface on PA-3020 with static IP connected to ISP router. Since two days, we're facing continue ping drop of WAN interface 3 to 4 times a day, doesn't reestablish the connectivity until reboot the firewall. Then, We had checked with the alternate modem device and monitored whole day, no ping drop and no network down issues we faced. Twice confirmed with the ISP, but didn't find a problem from ISP end. Device running on PAN OS-6.0.2 . Please suggest. Thanks ... View more

Hi All, Captive portal comfort page configured with customized logo. This logo is displaying in the top of User Identification portal when using firefox but this logo not displaying (logo not loaded.right click->show picture also useless in ie8) when using IE8/9/11(os: windows xp/7). Is there any known bug for this issue?.I think-By default,browser/Internet option settings prevent this logo to load. Please Guide. Thanks ... View more

Lan2(trust zone-172.16.10.0/24)-> internal  -                switch from trunk->       (eth1/1-172.16.10.100)PAN FW(eth1/2-192.168.1.104/24)->(192.168.1.1/24) DSL modem(untrust) Lan2(trust zone-172.16.20.0/24)->connected thro. mpls ->                                 (eth1/1.10-172.16.20.100) My vr config: Destination:0.0.0.0/0, Interface:eth1/1, Next hop:192.168.1.1/24 my security policy: trust to untrust -any any my Nat: source nat dynamic and port: 192.168.1.104/24 pinging from 172.16.10.0/24 to internet : allowed,nat applied and successful ping Pinging from 172.16.20.0/24 to internet: allowed,nat applied but packet not returned to 20.0/24 ... View more

Please tell me whether smtp mail server report profile have username/password authentication? or we have only domain name/server ip option to configure this profile? ... View more