Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About jcostello
About jcostello
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
11-15-2016
81Posts
16Likes
2Solutions
Nov 15, 2016Last Visited
User
Activity
User
Profile
Latest posts by jcostello
| Subject | Views | Posted |
|---|---|---|
| 629 | 08-05-2014 06:45 AM | |
| 431 | 07-17-2014 02:11 AM | |
| 3164 | 06-20-2014 01:12 PM | |
| 815 | 06-18-2014 01:40 PM | |
| 738 | 06-17-2014 02:07 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 12-12-2011 08:49 AM | |
| 1 | 05-29-2012 08:04 AM | |
| 1 | 06-17-2014 02:07 PM | |
| 1 | 11-04-2011 10:36 PM | |
| 1 | 05-25-2011 01:37 PM |
User Badges
Public Statistics
| Date Registered | 03-07-2011 10:11 AM |
| Date Last Visited | 11-15-2016 06:28 PM |
| Total Messages Posted | 81 |
| Total Likes Received | 16 |
08-05-2014
06:45 AM
Kevin How about swapping the authentication profile for the Portal and the Gateway - RADIUS authentication on Portal and LDAP on the Gateway. RADIUS will push the user1@domain.com to the gateway and then prompt. Not the typical configuration but will still do two factor authentication.
... View more
07-17-2014
02:11 AM
What type of firewall is the peer device? The message above is indicating that the IPSec settings are not matching on the firewalls. What is the IPSec profile you are using on your local systems and what is the configuration of the remote host?
... View more
06-20-2014
01:12 PM
This article is based on setting up Freeradius to use Google Authenticator - http://www.virtualvcp.com/tech-guides/36-vmware-view/194-securing-vmware-view-google-authenticator-and-freeradius I have not done this as yet but as it is using RADIUS as the authentication method, it should work.
... View more
06-18-2014
01:40 PM
1 Kudo
Slawek, You might start by looking at the netstat output for the workstation with the source port 65409 This article will help for a Windows system - See what process is using a TCP port in Windows Server 2008 - TechRepublic The SysInternals tools from Microsoft can also help - Windows Sysinternals: Documentation, downloads and additional resources One issue that may arise is that modern malware tends to hide itself from the built in tools that could be used to identify it. May your efforts be successful. James
... View more
06-17-2014
02:07 PM
1 Kudo
Another option is to run request system private-data-reset from the CLI This will clear the configuration from the device but maintain the software version and dynamic updates/
... View more
06-09-2014
06:29 AM
That still requires a commit on the Palo Alto to disable the account
... View more
06-06-2014
12:39 PM
1 Kudo
Meant to include the link to this article in my prior response Using LDAP to Authenticate to the WebUI RADIUS can also be used for WebUI authentication Configuring Read-only Admin Access with RADIUS Running on Win2008 and Cisco ACS 5.2 Configuring Administrator Authentication with Windows 2008 RADIUS Server (NPS/IAS) How to define Access Domains for Administrators
... View more
06-06-2014
11:26 AM
2 Kudos
A couple of options as its not possible to disable an account on the PA itself Change the password on the account after the consultants leave Configure either Kerberos or LDAP authentication for the account and disable the account there I typically recommend number two since it does not require a commit on the firewall to change the password.
... View more
06-06-2014
05:37 AM
1 Kudo
Try something along the lines of show service | match 1492 tab complete will also work to show you the remaining available command strings show service {hit the tab key on your keyboard} <name> <name> | Pipe through a command <Enter> Finish input
... View more
06-05-2014
01:20 PM
can you grab and clean up (replace any public IPs with something else i.e replace the Cisco address with Cisco-Address) the following from the 3020 show network tunnel ipsec (only need the lines for the tunnel having issues) show network ike crypto-profiles ike-crypto-profiles show network ike gateway (only need the gateway associated with this connection) From the ASA - connect to ssh or console show run find the related Cisco command from this article - Sample IPSec Tunnel Configuration - Palo Alto Networks Firewall to Cisco ASA for the VPN
... View more
06-05-2014
10:48 AM
On the ASA CLI or the configuration output I was looking for the assigned transform set Which of the crypto profiles on the 3020 is assigned to the VPN that is having issues
... View more
06-05-2014
08:03 AM
From the 3020 CLI - please provide the output for your profile configured for IPSEC set cli config-output-format set configure show network ike crypto-profiles ipsec-crypto-profiles from the ASA gather the line that starts with crypto ipsec transform-set that is configured for the crypto map Thanks
... View more
06-05-2014
07:24 AM
IPSEC Crypto Profile on PA defaults to group-2 (group 1, group-2, group-5 and group-14 are available) The ASA is indicating group 1
... View more
06-05-2014
06:49 AM
Phase 2 Mismatch notification message 14:NO-PROPOSAL-CHOSEN What is the transform set on the ASA for this network? What is your corresponding IPSEC policy on the 3020? Sample IPSec Tunnel Configuration - Palo Alto Networks Firewall to Cisco ASA
... View more
06-05-2014
06:18 AM
Have you reviewed the IKE log on the 3020 from the CLI less mp-log ikemgr.log What do you have set for your proxy-ids on your 3020?
... View more
06-04-2014
11:20 AM
Device Tab User Identification Menu Captive Portal Settings sub tab Idle Timer (min) This is the user time to live (user TTL) setting for a captive portal session. This timer resets every time there is activity from a captive portal user. If the length of time the user is idle exceeds the idle timer, the captive portal user mapping will be removed and the user will have to log in again. (1-1440 minutes, default 15 minutes). Expiration (min) This is the maximum TTL, which is the maximum amount of time that any captive portal session can remain mapped. After the expiration duration has elapsed, the mapping will be removed and users will have to re-authenticate even if the session is active. This timer is used to ensure prevent stale mappings and the value set here overrides the idle timeout. Therefore, as a best practice, set the expiration to a value that is higher than the idle timer (range 1 - 1440 minutes; default 60 minute
... View more
06-02-2014
02:14 PM
Which version of Panorama are you currently running?
... View more
06-18-2013
01:06 PM
1 Kudo
I can't give an authoritative answer as to why, but the log at start does not appear to be invoked until the session establishes. With log at end set to no, it would not have shown up as an incomplete either. Was rule 146 created at the command line by any chance?
... View more
06-18-2013
10:55 AM
log-end no; it was getting associated to a rule that would not report the end of the session
... View more
06-18-2013
10:42 AM
from the configure prompt what is the output for show rulebase security rules 146 for log-start, log-end and log-setting
... View more
06-18-2013
10:10 AM
With the settings of start and end on the logging of all traffic on that deny rule, you will fill the logging queue on the box and it will not be able to process all of the logs. With something that is denied, it won't wait for the three way handshake to log an entry if logging functioning correctly
... View more
06-18-2013
10:06 AM
The deny all logging can put a strain on the log-receiver (in my experience) From the CLI try the following command debug log-receiver statistics look for entries under Logs discarded (queue full)
... View more
06-18-2013
10:01 AM
The implicit deny rule on a PAN will not generate log entries. You would need to have an explicit deny rule with logging enabled to see the traffic that is denied.
... View more
06-08-2012
09:06 AM
Couple of clarification questions What version of PANOS are you running and which VPN/GP client do you have installed - we are running 4.0.11 with NetConnect 1.3.3 Who is you scan provider? We are using Qualys (I believe) Thanks James
... View more
06-08-2012
08:59 AM
+1 to this. I have an open ticket in regard to this as well. If you have not opened a ticket with support, please do so it should help with the escalation for resolution Thanks James
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
