About sahithyan.subbu

sahithyan.subbu

Hi @reaper Thanks for your reply. Customer runs 9.0.7. I have a query that what if customer restarts the daemon or pid and then generates the TSF and share it to find the RCA. ? becuz there will not be a debugging and we cannot deep dive into logs..! In such cases will it be able to find why daemon or PID stopped working ??

sahithyan.subbu

Hi team, I would like to know why Daemons and processes ids are getting suspended or not working. I can see that which daemon stopped working by this cmd, > show system software status and for example: routed is stopped and i have restarted the routed process. But here i want to know what caused that daemon to not work ? Is there a way to check why daemon going suspended ? If it can be found in TSF using Auto assistance or PANTS tool, please do let me know. Note: routed is just an example, i want to know generally for all daemons...!

sahithyan.subbu · ‎07-29-2020

Hi team, ++ I want to configure HIP- Anti Malware with virus definition version. ++ I see in HIP log for Definition version as 200729-4 but I am not able to configure the same in Virus definition option in HIP anti malware. ++ I am not able to use any kind of characters and not more than 5digits. ++ How do I configure this ?? Attached my HIP log. HIP Virus Definition version

sahithyan.subbu · ‎06-14-2020

Hi team, I am facing the source IP mismatch region . This is the IP 41.139.156.142 which shows up from Kenya, i have confirmed from https://ping.eu & https://threatvault.paloaltonetworks.com/ but in firewall traffic log it show like this IP belongs to Germany. I have blocked this IP in policy but why it is happening ? Why firewall shows mismatch source region ? Does someone have insight on this issue ?? PAN OS version is 8.1.10.

sahithyan.subbu · ‎06-11-2020

Hi @reaper yes I did.

sahithyan.subbu · ‎06-10-2020

@reaper I got your ref from GOT. Good one. I already configured as per you said, i have configured authenticatoin rulebase and placed on top and also i have configure agent and captive portal accordingly, but it is not working. Do u have any document to configure this ??

sahithyan.subbu · ‎06-09-2020

Hi , You have use this pattern in block category to block all the youtube videos *.youtube.com/watch? and add Url which should be allowed in allowed category https://www.youtube.com/watch?v=CG7WDmFpsjU

sahithyan.subbu · ‎06-09-2020

Hi team, How to make work the Palo Alto Captive portal after users logged in to Global protect. ? Users who got connected to GP should get captive portal auth page while they try to use internet. Is there any way to achieve this ?

sahithyan.subbu · ‎05-27-2020

Hi team, I need to configure data filtering in firewall which should alert me when an excel sheet traffic which contains 19 gmail address goes through the FW i should get alert and traffic should get block when there are 20 and more gmail addresses. My regex is (g)|(G)mail\.com and this is working for websites like onedrive and wetranfer but for gmail it is not working as excepted. Instead of giving an alert, FW sends the reset flag for excel which contains 19 gmail addresses. Does any body have any idea about this ? I have even enabled strip ALPN in decryption profile for http/2 traffic.

sahithyan.subbu · ‎05-23-2020

sahithyan.subbu · ‎05-22-2020

sahithyan.subbu · ‎04-27-2020

@BPry Thanks for the response. Is this the link you were suggesting to look into it ?? https://live.paloaltonetworks.com/t5/General-Topics/How-to-limit-concurrent-GlobalProtect-connections-per-user/m-p/202128#M59665

sahithyan.subbu · ‎04-27-2020

@OtakarKlier Can't create a 1000 HIP profiles using Host ID and name with 1000 security policy with concern user. That's unmanageable. For instance if we configure this kinda setup, this is going to help only after the user got connected. How do you block the user logging in to portal and gateway ? User should get kick-out at the initial stage if they try to log in to the GP with inappropriate device. ! They should not even get logged in.

sahithyan.subbu · ‎04-25-2020

Hi Team, One of our customer wants to restrict "per user-per system" basis. In Global Protect Clients, one user is able to connect through multiple end devices. Can we able to restrict i.e one user should be able to connect through only one end devices.

sahithyan.subbu · ‎04-24-2020

Hi @jdelio Thanks for your support, I will check and let you know.

sahithyan.subbu · ‎04-23-2020

Hi Team, I have created certificate which is used for Decryption purpose. I have installed in Windows and Mac and its working. How do i install that in linux (Ubuntu or Kali ) ?? Please share your insights .

sahithyan.subbu · ‎04-13-2020

Hi team, I want to block .pst .dat .csr files. I know the PA FW works on file types rather than file extension, but i want to know .pst and .dat and .csr are which file types ?

sahithyan.subbu · ‎04-03-2020

Hi team, If One of the Ipsec Tunnel goes down i must get that alert in PRTG monitoring tool.... I have created snmp trap and log setting according to the alert from system logs, Prtg tool is able to get that traps. But customer requires a OID for this...I need a OID to get that trigger in PRTG if one of the tunnel goes down. Please HELP.

sahithyan.subbu · ‎04-02-2020

@kiwi Yeah man, I too think so 😕 Okay will create a ticket with PA TAC and will post the results here after i get a conclusion on this. Thanks for your support man, Appreciate that.

sahithyan.subbu · ‎04-01-2020

@kiwi It happens for random users and if once user's private IP starts showing 0.0.0.0 in remote user section that stays forever. Even after multiple re-connections from client side it just wont change back to actual private IP. About multiple gateways, yeah customer got 2 gateways but 2nd is non implemented in live yet so actual live in 1 gateway. Irony is this doesn't impact the network in anyway because in user end agent getting actual private IP that is 172.16.100.234, and also in traffic log i can able to see that actual IP also i can see that actual IP in system logs. Only thing is in GP gateway remote users section, only there i am seeing this weird ip 0.0.0.0 instead of actual private IP.

sahithyan.subbu · ‎04-01-2020

@kiwi Thanks for the prompt reply. Please see the below required info's, sw-version: 9.0.5 global-protect-client-package-version: 5.0.6 No HA.

sahithyan.subbu · ‎04-01-2020

Guys, The thing here is the firmware version. Below than 9.0.0 firmware's will throw an commit error if u haven't configured the client IP Pool just as a fall back option, If retrieved framed IP is failed to get IP from server then it will fall back to Client IP pool segment. So there is no other option than to create a client IP pool segment if you are in below 9.0.0 version. Hope this helps for many since there is no information and documents related to this.

sahithyan.subbu · ‎04-01-2020

Hi team, One of my customer experiencing a weird issue in global protect. When Client joins the GP he get a private IP 172.16.100.230 and i can see that system logs and also in his GP Agent. When he initiates traffic i can able to see that private iP in traffic log as well but issue is when i go to see the current users in GP Gateway >Remote user, i only see 0.0.0.0 as a private IP. Why this is happening ?? I surfed for a KB article but i couldn't find one, so if you guys found one please share and if you guys possess knowledge about this issue please share it here. I can't restart the ikemgr and sslmgr because user is getting authenticated and getting the correct private IP but only in firewall i cannot see that in current connected users, so there is any demon i have to restart except for ikemgr, sslmgr and rsamgr...???

sahithyan.subbu · ‎03-27-2020

HI @JoergSchuetter , Thanks for the response. Removing the whole gateway is not an option here. Is it possible to create an other gateway with same ISP IP ? But question is, if we configure the Client IP pool in Agent tab before getting into Client Setting then i cannot configure the retrieve Framed IP option. Agenda here is, GP users should get a static IP from Server.

sahithyan.subbu · ‎03-26-2020

Hi,, Even after i configured to " Retrieve Framed-IP-Address attribute from authentication server" Why am i still getting IP pool range commit failure ?? Please find below screenshots. Commit Error Config Setting

sahithyan.subbu · ‎03-26-2020

Hi, Why Client IP Pool in gateway level is grayed out ???

sahithyan.subbu · ‎02-28-2020

Hi team, Query about Captive portal Authentication. One of our customer enabled the CP auth but they needs to allow particular URL's without CP auth redirect even for unknown users. How to achieve this ? also please share the KB articles which is related to my query.

sahithyan.subbu · ‎02-27-2020

@BPry Yeah, exactly. i do agree that. There is no other option or a way to workaround, that is how the packets get processed in Firewall during the APP inspection. Either we have to map the signature to the custom App or we can do App override.

sahithyan.subbu · ‎02-20-2020

Hi peeps, I have created a custom application for a particular TCP port and added that particular application in to my security policy, but traffic gets hit to deny policy. It works only when i do App override but it is not recommended to do app override. Is there any way to achieve it without App-Override or its mandatory to create a App-Override for custom applications. ? Also Please Share me the KB articles if it got any info's related to my query. .

sahithyan.subbu · ‎02-19-2020

Dear Team, One of our client want to set email alert for data plane CPU threshold will be 60% for this. I checked it but found only option, where we can set an alerts on the basis of even severity. Need your help in this to set email alerts for data plane on certain threshold values. Kindly provide if you have any KB to configure this.

Date Registered	‎11-21-2019 03:38 AM
Date Last Visited	19 hours ago
Total Messages Posted	46
Total Likes Received	3

Online Status	Offline
Date Last Visited	19 hours ago

Strata

Prisma

Cortex

About sahithyan.subbu