This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Dulle
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Dulle
07-31-2023
21Posts
11Likes
0Solutions
Jul 31, 2023Last Visited
User
Activity
User
Profile
Latest posts by Dulle
| Subject | Views | Posted |
|---|---|---|
| 9839 | 02-06-2018 10:45 PM | |
| 5465 | 12-06-2017 11:10 PM | |
| 3361 | 11-10-2016 11:02 PM | |
| 5078 | 04-01-2016 02:02 AM | |
| 5422 | 04-01-2016 01:22 AM | |
| 12841 | 03-18-2016 12:35 AM | |
| 5799 | 03-11-2016 02:44 AM | |
| 13424 | 03-11-2016 02:39 AM | |
| 6123 | 03-11-2016 12:54 AM | |
| 4442 | 03-10-2016 09:29 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 3 Likes | 02-06-2018 10:45 PM | |
| 1 Like | 12-06-2017 11:10 PM | |
| 1 Like | 04-08-2015 04:28 AM | |
| 1 Like | 03-11-2016 12:54 AM | |
| 1 Like | 03-10-2016 02:42 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes | |||
| 1 Like | |||
| 2 Likes | |||
| 3 Likes | |||
| 6 Likes |
User Badges
Community Statistics
| Member Since | 03-29-2011 02:45 AM |
| Date Last Visited | 07-31-2023 03:40 AM |
| Posts | 21 |
| Total Likes Received | 11 |
02-06-2018
10:45 PM
3 Kudos
>IP-MIB is not available. The related feature request (FR 1696) is still open. >Please reach out to your local SE and he can add your vote to this request to add more weight to it. Are there really no other customers that find this an issue ? Please, if more customers actually do, register with your local SE
... View more
12-06-2017
11:10 PM
1 Kudo
show counter global filter packet-filter yes delta yes This is the best of many great features -=Tommy=-
... View more
11-10-2016
11:02 PM
http://www.netresec.com/?page=Blog&month=2016-11&post=BlackNurse-Denial-of-Service-Attack Has anyone here tested the effect of this on any PAN-devices ? http://blacknurse.dk says: LIST OF REPORTED AFFECTED PRODUCTS : Cisco ASA 5515, 5525 (default settings) Cisco ASA 5550 (Legacy) and 5515-X (latest generation) SonicWall Some unverified Palo Alto Can't find any more info on what PANs
... View more
04-01-2016
02:02 AM
If ok, something like this: Feb 11 10:36:51 DEBUG: Unmounting Disk Pair D (/dev/md4) Feb 11 10:36:51 WARNING: Starting to check the file system integrity of the Raid Disk Pair D Feb 11 10:36:51 ERROR: e4fsck 1.41.12 (17-May-2010) Feb 11 10:36:51 DEBUG: 😧 clean, 20347297/61054976 files, 190167989/244189984 blocks (check in 2 mounts) Feb 11 10:36:51 WARNING: Done checking the file system integrity of the Raid Disk Pair D Feb 11 10:36:51 DEBUG: Mounting Disk Pair D (/dev/md4)
And also check with : >show system raid detail (But this you might very well know...)
... View more
03-18-2016
12:35 AM
Thanks a lot Gereardo.
Seems like I got confused about the use of ' versus "
In my initial example the closing ' was also missing, This was a copy/paste glitch. Honest
(there might be a closing ")" in your link that prevents it from being clickable)
... View more
03-11-2016
02:44 AM
Nah... Don't like the hotfix solutions, still 7.0.4.
And since neither 7.0.5 or 7.0.5-h2 has any description of a fix for this particular...anomaly, we haven't bothered.
... View more
03-11-2016
02:39 AM
HI Luciano
Thanks for your reply.
We use management interface as service route for all. Also forward all logs as Syslog to Splunk, and it is the health of this connection I want to check (we do get 'disconnect' messages too often) .
This is a bit like swimming the Niagara upstream, while catching fish, I assume, therefore filtering beyond host would make sense (syn/fin/rst flaggs)
But thanks again anyhow for your solid feedback.
-=Tommy=-
... View more
03-11-2016
12:54 AM
1 Kudo
Some more information for those who might care:
The problem is not resolved but it is apparent that it's related to the App 'Pushbullet' ( see www.pushbullet.com)
This is the result of 3(!) users in our company running Pushbullet as an extention i Chrome browser (still on the PA-5050)
FW(active)> debug dataplane pool statistics
DP dp0:
Software Pools
[ 0] software packet buffer 0 ( 512): 1/32768 0x8000000020c00680
[ 1] software packet buffer 1 ( 1024): 17781/32768 0x8000000021c20780
[ 2] software packet buffer 2 ( 2048): 31141/32768 0x8000000023c40880
[ 3] software packet buffer 3 (33280): 24506/24576 0x8000000027c60980
[ 4] software packet buffer 4 (66048): 304/304 0x8000000058878a80
[17] FPTCP segs ( 16): 1/49152 0x80000000d8f68a80
We play a game we call 'software buffer chicken' and see if the FPTCP pool depletion can cause a dp0 reset. The firewall chickes out, and seems to reset its pools. We win 😄
Also worth noting: the problem occurs only if you run a decryption policy that the traffic hits. (Hence the Forward Proxy TCP segs pool depeltion)
(We now do a no_decrypt for traffiic to IP 173.255.112.173, the home of Pushbullet, to avoid trouble over the weekend....)
... View more
03-10-2016
09:29 PM
And there came Application and Threat Content Release Notes Version 567, and proved me wrong....
... View more
03-10-2016
02:42 AM
1 Kudo
From my understanding of this vulnerability, a signature to cover the weakness might be difficult to create. Since the exploit collects data and then decrypts it, the vulnerability is not based in a protocol anomaly or an easily detectable exploit. The collection of data based on cracking a 40-bit RSA key, and can be found over time against the realtive limited variations with 40-bit. Data collection might be by interception between client and server, and this would be undetectable to both.
It might seem better to update the servers use of TLS/SSL, rather than wait for a usefull signature.
... View more
03-10-2016
02:24 AM
Does anyone know what filters are supported for the tcpdump command on PAN-OS (7.0) ? For troubelshooting of a Syslog (server) issue, due to large amounts of traffic, I need to capture only packets with syn- or fin/rst-flag set. Something like this : # tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0
Documentation found 'How To Packet Capture (tcpdump) On Management Interface' are sparse, as the filter options very well might be.
... View more
02-15-2016
02:58 AM
1 Kudo
Update:
Research by PAN-support revealed that this depletion in our case, is related to traffic with destination address 173.255.112.173 (stream.pushbullet.com/). The application is classsified in the session table as 'pushbullet', then changes to 'websocket' and finishes off as 'web-browsing' when logged.
The sessions are persistent throug the firewall even when the client is disconnected.
Even if the number of sessions to stream.pushbullet.com are modest, it seems somehow to bleed out the 'software packet buffer 0' If this occcurs,it did help in our case to run a 'clear session all filter destination 173.255.112.173' Also if the depletion causes problems (if all software packet buffer 0-4 are depleted, possibly dataplane reset), create firewall rule denying traffic to 173.255.112.173.
(Thanks a lot to PAN-support engineer Nikola for invaluable help)
... View more
02-12-2016
02:21 AM
We're currently observing something quite interesting: On our highly oversized PA-5050 firewall, software packet buffer 0 is, for several hours a day exhausted.
This is the platform (pair that runs in High Avalailability A/P): family: 5000 model: PA-5050 sw-version: 7.0.4
This is the anomaly:
> debug dataplane pool statistics
Software Pools [ 0] software packet buffer 0 ( 512): 1/32768 0x8000000020c00680 [ 1] software packet buffer 1 ( 1024): 23178/32768 0x8000000021c20780 [ 2] software packet buffer 2 ( 2048): 31775/32768 0x8000000023c40880 [ 3] software packet buffer 3 (33280): 24528/24576 0x8000000027c60980 [ 4] software packet buffer 4 (66048): 304/304 0x8000000058878a80 | | [17] FPTCP segs ( 16): 6703/49152 0x80000000d8f68a80
The load on the firewall is minimal:
> show session info -------------------------------------------------------------------------------- Number of sessions supported: 2000000 Number of active sessions: 38996 Number of active TCP sessions: 29985 Number of active UDP sessions: 8434 Number of active ICMP sessions: 273 Number of active BCAST sessions: 0 Number of active MCAST sessions: 0 Number of active predict sessions: 774 Session table utilization: 1% Number of sessions created since bootup: 355140861 Packet rate: 16892/s Throughput: 54252 kbps New connection establish rate: 760 cps --------------------------------------------------------------------------------
Anyone else seeing something similar ?
(and yes, case has been opened with PAN-support)
... View more
12-18-2015
02:10 AM
Check:
https://live.paloaltonetworks.com/t5/Management-Articles/Commit-Error-Failed-To-Handle-TDB-UPDATE-BLOCK/ta-p/62001
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-31-2023
03:40 AM
|
Latest Tags
No tags yet
Likes Given To
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks