About MandarKulkarni

MandarKulkarni

Looks like more of DNS related issue ? client able to resolve dns name of portal ?

MandarKulkarni

your global protect portal using public cert ? Make sure root certificate is installed correctly on client PC. Check for logs on global protect client.

MandarKulkarni

Try Following Steps. Disable WMI services : run - services.msc - Windows Management Instrumentation(WMI) - stop the service. Delete the files under C:\Windows\System32\wbem\Repository Open regedit Go to HKEY_LOCAL_MACHINE > Software and HKEY_CURRENT_USER > Software. Delete the Palo Alto Networks folder. Delete the same if the same folder is present in any other user under HKEY_USERS. Un-install GlobalProtect from Windows 'program and features'. Make sure that the virtual adapter in not present in the Network adapter settings. Reboot the machine. Reinstall GlobalProtect with admin privileges. Confirm that WMI service is running.

MandarKulkarni

Trying to connect satellite to custom port on gateway. not connecting Any specific config needs to be done ?

MandarKulkarni

still no solountion to this issue ?

MandarKulkarni

Hi, Due to limitation of using port 443 we want to use custom port for connections to gateway from satellite. I believe changing port on portal config for gateway then doing destination nat on gateway should fix this issue. so satellite can connect to gateway fine. anyone faced same issue ?

MandarKulkarni

what permissions are required on panorama ?

MandarKulkarni · ‎04-30-2020

what other routes do u see on client ? check gp client routing table ? how are u advertising routes to client ?

MandarKulkarni · ‎04-27-2020

Try to delete all files under C:\Users\abc\AppData\Local\Palo Alto Networks\GlobalProtect reboot laptop and give a try

MandarKulkarni · ‎04-20-2020

thanks kiwi. following KB fixed my issue, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEYCA0

MandarKulkarni · ‎04-19-2020

PAN GPA is giving error , checking service on PC it reports stopped when I try to connect through agent. Tried to uninstall and install again , did not help. anyone faced same issue ? T14992) 04/17/20 08:50:44:186 Debug( 692): CAC, name is DigitalMediaDevices (T14992) 04/17/20 08:50:47:523 Info ( 246): InitWinConnection ... (T14992) 04/17/20 08:50:47:523 Info ( 256): Connecting to Pan MS Service end (T14992) 04/17/20 08:50:48:524 Debug( 268): CPanSocket::onConnect - return error code = 10061. (T14992) 04/17/20 08:50:52:528 Info ( 246): InitWinConnection ... (T14992) 04/17/20 08:50:52:528 Info ( 256): Connecting to Pan MS Service end (T14992) 04/17/20 08:50:53:536 Debug( 268): CPanSocket::onConnect - return error code = 10061.

MandarKulkarni · ‎04-01-2020

any article on bgp support on PA in azure.

MandarKulkarni · ‎03-11-2020

Login in through cli run following commands show interface all show routing route Any NAT policy ? ping source eth1/1 host g.w ip

MandarKulkarni · ‎03-10-2020

Can you elaborate little bit ? you are saying you pointed static route on Palo Alto to VNET .1 IP ? and not first IP in subnet of interface of firewall for example eth2 ?

MandarKulkarni · ‎03-10-2020

We are running into same issue where in palo alto VM ( NVA) is deployed in HA on azure using design mentioned below. https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure.html Looks like Palo Alto interface is not routing packet . I checked routing is fine with azure UDR and on Palo Alto VR , issue is only when traffic hits palo alto floating IP interfaces. Anyone faced same issue ? Basically issue we are facing with HA deployment .

MandarKulkarni · ‎12-26-2019

what exactly are you trying to achieve , V-Wire is basically bump in wire.

MandarKulkarni · ‎12-03-2019

Hi Guys, Lets say I have application SAP that allows port 8443 but looks like APP-ID is not getting matched and we are getting insufficent data followed by deny rule , question is how can we look for difference between expected application data and difference we are seeing. Just to approve application owners this is pattern we are looking for but we are getting following difference.

MandarKulkarni · ‎11-14-2019

Hi @AAstardzhiev the default which want to redistribute. How did your FW receive it? Static, or from another dynamic protocol? I have static route pointing to ISP IP. it exactly match route in routing table , redistribute rule and export statement. Looking at show routing protocol bgp policy export I see it does not hit export policy rule any specific debug comands we can run to check if 0.0.0.0 is getting advertised ? @AAstardzhiev Thanks a lot for your help

MandarKulkarni · ‎11-14-2019

I am trying to redistribute default route into EBGP peer it is not working. 1. Created Redistribute profile to redistribute default route 2. called redistribute profile under bgp redis rules 3. Checked allowed default routes to redistribute 3. created export policy to export 0.0.0.0/0 with action allow. Looking at below command we see export policy is not getting hit. show routing protocol bgp policy export specific to default route any suggestions ?

MandarKulkarni · ‎11-11-2019

I want to send default route to one peer-group only other peer-group should not recieve default route when I allow global Allow Redistribute Default Route it breaks bgp with other peer as far as i understand we need to enable Allow Redistribute Default Route to send default route to peer. any recommendation.

MandarKulkarni · ‎11-10-2019

debug ip bgp equivalent in palo alto

MandarKulkarni · ‎11-07-2019

@brand - If we are running multiple BGP peering dont u know it will cause issue with other peers ? as it will send default route to them ?

MandarKulkarni · ‎11-01-2019

@AlexanderAstardzhiev @Shawverr very Nice explanation I got it now.

MandarKulkarni · ‎10-31-2019

Hi Team, I have EBGP peering between PA- Router using EBGP. learning route 10.10.1.0/24 I want to advertise those EBGP routes ( ex 10.10.1.0/24) learned by PA to AWS where I have another EBGP peering between PA and AWS. Could this be done in Palo Alto. I see redistributes rules are there . I just wanted to have clear understanding if one ebgp learned route can be redistruted into another ebgp. Thanks in Advance.

MandarKulkarni · ‎10-13-2019

Hi kim Thanks for your reply what is Master Device in the device group. ?

MandarKulkarni · ‎10-07-2019

My CA is Portal / Gateway firewall it is having different template group and LSVPN HUB firewall on different template group. I have created new certificate for HUB gateway on Portal/GW template , exported it from template group and imported it on HUB firewall template group it is giving below error upload--private key - passphrase invalid input , upload -> private key -> passphrase is invalid Any suggestions why we are getting this error.

MandarKulkarni · ‎10-03-2019

Hi Folks, I want to configure email alert for interface flapt i.e ( subtype eq port ). On email server profile under custom log format if I add $subtype eq port , would it be sufficient to trigger alert ?

MandarKulkarni · ‎09-30-2019

What will happen in that case when DNS server becomes unreachable ? Would destination server be unreachable ? Possible solution if DNS server gets unreachable.

MandarKulkarni · ‎09-24-2019

We want to schedule dyanmic updates , we dont have test environment. we can schedule updates on satellite offices then after 2 days to be installed on hub sites. prb is if new application traffic hits it will be denied by hub as that application would be unknow for hub ? Any recommendation on this scenario.

MandarKulkarni · ‎09-18-2019

It is not in HA , standalone PA 220 firewall.

Date Registered	‎05-07-2014 09:00 AM
Date Last Visited	2 weeks ago
Total Messages Posted	136
Total Likes Received	8

Online Status	Offline
Date Last Visited	2 weeks ago

Strata

Prisma

Cortex

About MandarKulkarni