About batd2

batd2

@BPry Thanks for the response. Can you please elaborate more on how the optimizer works, if logs are not sent to panorama? Do you know of any KBs explaining that?

batd2

Can Policy Optmizer be used in Panorama running PanOS 9.0 or 9.1 in Management only mode for firewalls running PanOS8.1 ? I could not find information on how the Policy Optimizer works under the hood. Does it look at the actual traffic logs or do the firewall create statistics, which are sent to Panorama?

batd2

@kiwi Thank you. This answers what I was looking for. The second question I could not find info for is, how can you see the difference between config to pushed and what is already on device, similar to what you get in GUI?

batd2 · ‎06-29-2020

@domari We could not see anything misconfigured and we only have issues with the Demisto server. All other appliances seem to work ok behind the Clinetless VPN. If I understand it correct the Clientless VPN portal re-writes the page content and I wonder if this is somehow causing the issue.

batd2 · ‎06-18-2020

I have multiple servers behind a clientless Global Protect VPN Portal and they all work fine apart form the Demisto (Cortex XSOAR) HTTPS, which shows blank page when browsing to it. The Demisto server works fine when browsing to it directly and all other sites work ok over the Clientless portal . The GP Clientless content package is up to date and I have been testing with security policy allowing any service/application to the Demisto server. I see permitted traffic in logs with packets flowing in both directions. It looks like that the issue is related to the Clientless Content re-write and I followed the content rewrite troubleshooting page, but had I could not find the exact reason for the behaviour and how to fix it. I also could not find anything related to the issue in the Demisto support section.

batd2 · ‎05-27-2020

Most of the existing skillets seem to apply to a firewall and only very few are for use stati input of a single Device Group or Template. In my experience most of the customers have Panorama and most of the Panorama tasks require interaction with multiple Device Groups/Templates. Can you please share your ideas for how to deal with multiple templates? As an example I use the code below, which requires manually input, but at can apply the config (in this case syslog server profile) to multiple templates. Is this the best way to achieve that and can you suggest a way to select templates more dynamically, based on name matching a regex pattern? variables: - name: profile_name description: Syslog Profile Name type_hint: text - name: templates_name description: Tempalate to config type_hint: list snippets: - name: syslog_profile xpath: /config/devices/entry[@name='localhost.localdomain']/template element: |- {% for tempate in templates_name %} <entry name="{{tempate}}"> <config> <shared> <log-settings> <syslog> <entry name="{{profile_name}}"> ### Element config ### </entry> </syslog> </log-settings> </shared> </config> </entry> {% endfor %}

batd2 · ‎05-21-2020

HI team. A bit of a silly question, but how to do you use persistent shared volume for the panhandler container? I spent half a day trying to get it to work, used the installation script, tried manually, read docker documentation, but it did not work.

batd2 · ‎05-19-2020

I started testing panhandler and I am very impressed with the functionality. I am trying to get it integrated in our environment, but my company has very strict privacy rules and will not allow using GitHub for production devices. In fact, if approved, it is likely that the tool will not be allowed any internet connectivity. Is there a way to upload skillets and use panhandler without GitHub?

batd2 · ‎05-14-2020

@Abdul_Razaq The config is definitely set to "on-demand". I did it lot of time, I uninstalled GlobalProtect app, ensured that all files are deleted. Then installed it again, connected to portal and everything works fine. As long as I reboot the machine, it gets back to the error message. Reinstalling fixes it until the next reboot.

batd2 · ‎05-13-2020

@Sethupathi Did you manage to resolve the issue? I am getting the same error message and even "globalprotect disable" or "disconnect" does not work and returns the message below: "Unable to establish a new GlobalProtect connection as a GlobalProtect connection is already established from this Linux system by the same user or another user." I am running the latest 5.1.2 linux app.

batd2 · ‎04-23-2020

@reaper This is really good guide and showed me something I did not know before. Can you please elaborate more on what exactly "save config partial" does. How it differs from "save config" and what does the "exclude" option does? I could not find any documentation for it.

batd2 · ‎04-01-2020

@benatddsnetwork.com Did you recently update your PanOS? We had a problem with scp after upgrade to 8.1.13 and the response from support was that they had fixed a few OpenSSH vulnerabilities in the recent update, which changed some ssh/scp behaviour.

batd2 · ‎03-15-2020

@ksteves1 Thank you. It an old post, but I was stuck and this response helped me fix the script I was working on. "xml_result()" was the bit I was missing. pan.xapi is amazing and does exactly what I need.

batd2 · ‎03-13-2020

@umar00o The general Palo Alto best practices recommendation is to apply zone protection to all zones, however realistically there is no much use for ZP on it.This is just a virtual interface used only for the GP tunnel binding and there will not be much of benefit in using zone protection.

batd2 · ‎03-13-2020

I did some work with pandevice and I am able to create new configuration in a Firewall, but struggling working with the existing Panorama configuration. Can you please help me with ideas for the below. I need to move a firewall between panorama appliances and the task is: Given the firewall serial, find the Template Stack and Device Group the firewall is assigned to in PanoramaA. In PanoramaA find the Template members of the Template Stack and Parent Groups for the Device Group. Copy the Device Groups, Device Group Inheritance, Template Stack and Template from PanoramaA to the new PanoramaB.

batd2 · ‎03-13-2020

@Sethupathi I think the initial connection is still over SSL and after authentication the traffic tunnel is either IPSec or SSL. Also, I don't think you can have IPSec only mode and you always need SSL failback.

batd2 · ‎03-10-2020

Can anyone suggest a solution?

batd2 · ‎03-10-2020

@LucaVitali I think the your approach is slightly wrong. You can load any part of the configuration (e.g. address objects), but you can't directly load the whole configuration file, but exclude some conifg items. I am not sure why exactly you need to do that, but one way to automate it could be to take the current config of the " /config/shared/local-user-database -user-database" then load the old configuration snapshot file and have a second API call to load the most up to date content of " /config/shared/local-user-database -user-database".

batd2 · ‎03-03-2020

@BPry Thank you for your quick response. That makes sense appart from " this rule will work exactly as you would expect it " I did some more testing and looks like that traffic with unidentified AppID is just being allowed and logged as matching this rule, even though the rule has action "Deny". So is it right to say that all unidentified AppID traffic will just be let in?

batd2 · ‎03-02-2020

It is not clearly described in documentation and I could not find a complete topic related to it. How does application:any, service:application-default behaves when apply to a “Deny” rule? Presumably it will block the application if application is detected on a default port, but normally deny rules do not have recognised application, because of not enough packets to detect the application. How will application be detected? Also how will “application-default” rule behave (regarding if deny or allow) in the following cases of a traffic with AppID: Incomplete Insufficient-data unknown, apps with ports “tcp/dynamic” or “udp/dynamic” (e.g. torrent) apps with port not defined (e.g. icmp)

batd2 · ‎02-28-2020

@Chris-UNN Is it possible that your colleague configured it as "bi-directional" or Destination NAT? In this case, the firewall will use ARP to indicate to its neighbours that it owns the IPs and traffic can be sent to it.

batd2 · ‎02-28-2020

Do you know where in CLI or configuration files we can find Panorama Template objects which were locally overridden on a firewall? I am trying to script for locally overridden configuration settings checks of multiple Panorama-managed firewalls, but noting in the configuration files indicates that the object was overridden. Do you have more inside understanding of how the override process works and how is it processed by the firewall?

batd2 · ‎02-28-2020

@Chris-UNN This is can happen when you misconfigure NAT and put a mask to the NAT IP addresses.

batd2 · ‎02-20-2020

@AlexanderAstardzhiev I am not sure what Panorama model and PanOS version you have, but we have physical M applience on 8.1 and the interface troubleshooting commands are there, e.g."> show interface ethernet1/2", "> tcpdump interface ethernet1/2" .

batd2 · ‎02-20-2020

@Sethupathi As the file does not act as proxy for the traffic, it is not able to modify the HTTP header and insert "x-forwarded-for"

batd2 · ‎02-20-2020

@Sonu_Singh Looks like a bug...

batd2 · ‎02-20-2020

@sahithyan.subbu I agree that it is not the recommended way to monitor CPU use, but In it can possibly be done. As long as there is a log for the even, you can build very specif filter (e.g. "description contains 'cpu'" or similar) and trigger email alert when log matches the filter.

batd2 · ‎02-20-2020

@SutareMayur The authentication methods will be executed in order. It will go to the second login method only if the first method fails. You can check your authentication logs, but probably this is what is happening.

batd2 · ‎02-20-2020

@Sistemas_SanLucar There is no webpage as such. I think that the normal process is to raise it with your assigned by Palo Alte SE and they will submit a feature request.

batd2 · ‎01-27-2020

I need to automate run particular operational commands , which were not available in the API. I tried running them using SSH to the Panorama CLI, but it fails. Also Paramiko Python script does not seem to work and not sure what are we doing wrong. Can you please share any experience exectuing SSH commands?

Date Registered	‎01-17-2020 07:36 AM
Date Last Visited	Monday
Total Messages Posted	30
Total Likes Received	1

Online Status	Offline
Date Last Visited	Monday

Strata

Prisma

Cortex

About batd2