About Mohammed_Yasin

Mohammed_Yasin

Recently, we did a Migration activity, From the Juniper SRX to Palo Alto. After successful Migration, we can notice that one drop over the PA firewall. We did troubleshooting from our end and in the global counter can see below error with drops flow_fpga_ingress_exception_err 1865 19 drop flow offload Packets dropped: receive ingress exception error from offload processor Tried to packet capture but don’t see any packet capture for this traffic. what is this error and why Paloalto is dropping this flow?

Mohammed_Yasin

@claudec I think it can be helpful, if converting the hash into HEX and create a custom vulnerability to drop anything that matches the file hashes. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0 And I have noticed, few of the hashes are already listed in Cisco Talos File Repute but not in PA Threat Vault.

Mohammed_Yasin

This is to bring in to your notice, few of them mentioned hashes are already listed in Talos File Repute but not in Threat Vault. This is our request to add the following hashes in Threat Vault too to avoid any risk.

Mohammed_Yasin

Thanks for your comments. Much Appreciated||| https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLOlCAO I have studied and found no way to block custom files based on hash-256 only. As per document file can block but based on patterns of specific file types. In my case, these Hash-256 only of near firms which recently attacked by these files and damaged therefore it needs to be blocked at my end as well to avoid any risk. I found few of them are blocked in wildfire but not all, so how I can add all in block state while having no file sample or pattern. Please advise the way to block all these hashes-256 without a sample or pattern. Your prompt response will be highly appreciated.

Mohammed_Yasin

Thanks for your comments. Much Appreciated||| https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLOlCAO I have studied and found no way to block custom files based on hash-256 only. As per document file can block but based on patterns of specific file types. In my case, these Hash-256 only of near firms which recently attacked by these files and damaged therefore it needs to be blocked at my end as well to avoid any risk. I found few of them are blocked in wildfire but not all, so how I can add all in block state while having no file sample or pattern. Please advise the way to block all these hashes-256 without a sample or pattern. Your prompt response will be highly appreciated.

Mohammed_Yasin

It's possible to block custom file hash-256 It's possible to block custom file hash-256 in Palo alto. Please let me know how I can check the respective file hashes disposition at a wildfire, either it is in block or not. Here is below the file hashes need to know for disposition. f743c0849d69b5ea2f7eaf28831c86c1536cc27ae470f20e49223cbdba9c677c e56d45628f0c2bda30ab235657704aac50a8433bdb4215c77a2e0f52f0f31a49 ae431797c551c20fe2f3fe1adc08a566edfabf45abbd924f0c8da06381ab6e48 4f7dd00a005caf046dd7e494fea25be2264974264d567edfc89122242b7c41bc 5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6 36be48e4eac81ad77aeade20b28ff8b72275832e6833f5e1b692eb99f312fd13

Mohammed_Yasin

It's possible to block custom file hash-256 in Palo alto. Please let me know how I can check the respective file hashes disposition at a wildfire, either it is in block or not. Here is below the file hashes need to know for disposition. f743c0849d69b5ea2f7eaf28831c86c1536cc27ae470f20e49223cbdba9c677c e56d45628f0c2bda30ab235657704aac50a8433bdb4215c77a2e0f52f0f31a49 ae431797c551c20fe2f3fe1adc08a566edfabf45abbd924f0c8da06381ab6e48 4f7dd00a005caf046dd7e494fea25be2264974264d567edfc89122242b7c41bc 5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6 36be48e4eac81ad77aeade20b28ff8b72275832e6833f5e1b692eb99f312fd13

Mohammed_Yasin

It's possible to block custom file hash-256 in Palo alto. Please let me know how I can check the respective file hashes disposition at a wildfire, either it is in block or not. Here is below the file hashes need to know for disposition. f743c0849d69b5ea2f7eaf28831c86c1536cc27ae470f20e49223cbdba9c677c e56d45628f0c2bda30ab235657704aac50a8433bdb4215c77a2e0f52f0f31a49 ae431797c551c20fe2f3fe1adc08a566edfabf45abbd924f0c8da06381ab6e48 4f7dd00a005caf046dd7e494fea25be2264974264d567edfc89122242b7c41bc 5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6 36be48e4eac81ad77aeade20b28ff8b72275832e6833f5e1b692eb99f312fd13

Mohammed_Yasin

One of our customers wants to download GP client 5.1.3 in the system without activating in Paloalto, wants to test a new client before activating in production Paloalto. Is there any way to download i PA-220 OS 8.1.15

Mohammed_Yasin · Re: Panorama can't proxy web interface after upgrade to 8.1.16

Hope its bugs. PAN-93193 Please check and update..

Mohammed_Yasin

Thank you for the comment. Yes Its production, the firewall was upgraded 5 days ago. its only very slow in wildfire logs appearing in the monitor section rest of the logs are performing usually average. I have checked the following links for the CEF for Arcsight. but doesn't help me with PAN 10. https://docs.paloaltonetworks.com/resources/cef.html https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/custom-logevent-format.html https://community.microfocus.com/t5/ArcSight-User-Discussions/Palo-Alto-Global-Protect-logs-CEF-format/m-p/2801217 https://community.microfocus.com/t5/ArcSight-User-Discussions/bd-p/arcsight-discussions

Mohammed_Yasin

Device Model: PA-5220 HA Mode Active-standby PAN-OS 10.0.0 The questions below as I couldn't find anything on Palo Alto website. Recently we have upgraded Palo Alto to v10.0.0. 1. Web management interface became very slow and searching logs takes very long time to load. Kindly advise if there’s any solution for that. Can we disable services of some added unused features, like SDWAN or IoT? Or is there any work-around to make it faster? 2. Integration with ArcSight Syslog server is not working well as logs are not parsed correctly. Seems the raw data format sent from Palo Alto changed in this version. Kindly advise how to fix this. Can we change the format to be similar to 9.0.x or 9.1.x format?

Mohammed_Yasin · Re: Panorama can't proxy web interface after upgrade to 8.1.16

Me too facing the same issue, After Firewall Upgrade to 8.1.16, The panorama is neither able to load the firewall-context nor even able to update definitions. Model 3060 Panorama M-100

Mohammed_Yasin · ‎08-18-2020

Yet not restarted the Logsrc

Mohammed_Yasin · ‎08-18-2020

Its physical device Model 850 even I can't see in CLI too but system logs are viewable from GUI as well as CLI.

Mohammed_Yasin · ‎08-18-2020

Having issues regarding the log. cannot see any logs on the Palo alto firewall. The changes: - we downgraded from Panos 10 to Panos 9.1.x since then we cannot see any logs.

Mohammed_Yasin · ‎08-13-2020

We have deployed the Panoroma Vmware NSX After success full deployment to the VMware, The Vmare NSX T - Service Managers - Service DefinitionsT - Service Managers - Service Definitions plugins/VMware/NSX-T/Service Managers/Service Definitions is out of sync but status is registered

Mohammed_Yasin · ‎08-06-2020

I have few Public IP which is blacklisted by there respective publishers, but it's not listed to panwdbl.appspot.com list. How I can send a request for updating the those IPs

Mohammed_Yasin · ‎08-06-2020

We have already configured the EDL feature in Palo Alto but the following behavior of Palo Alto has been observed while accessing the digital App and digital.com from the internet using 03 different blacklisted public IPs by Spamhaus (which is also used by Palo Alto). Two of them are allowed while one IP is blocked, while the Palo Alto Spamhaus list (panwdbl.appspot.com) showing only 01 blacklist IP from below 03 IP, why those IPs are not included in the PANWDB List which is already listed by Spamhaus as a blacklisted IP when we checked the IPs on their website (https://www.spamhaus.org/lookup/) they are showing the IP are in blocked list lookup results. Imaged are pasted in the below table for review.

Mohammed_Yasin · ‎08-04-2020

We just need to know the wildfire file type which is allowed to dynamic analysis. As I know the following URL described allowed file type for sandboxing but what happened with unknown Extention when it classified as an unknown file. https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/wildfire-overview/wildfire-file-type-s... Model PA-3220

Mohammed_Yasin · ‎08-04-2020

We just need to know the wildfire file type which is allowed to dynamic analysis. As I know the following URL described allowed file type for sandboxing but what happened with unknown Binaries ( unknown Extention ) when it classified as an unknown file. https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/wildfire-overview/wildfire-file-type-support.html Model PA-3220

Mohammed_Yasin · ‎07-27-2020

We are planning to upgrade PA-3020 devices to PAN-OS 9, please advise either PA-3020 devices can be upgraded to OS 9 PAN-OS 9.x is to use new features introduced in new OS like GRE tunneling, would you please confirm either our device PA-3020 support this upgrade? Model PA-3020

Mohammed_Yasin · ‎07-23-2020

I can see them from the device system monitor that, ( description contains 'Disconnected from Log collector Server: XX.XX.XX.X. , source: XX.XX.X.X' )

Mohammed_Yasin · ‎07-23-2020

Thank you for the comment. PAN-OS 8.1.7

Mohammed_Yasin · ‎07-23-2020

Thank you for the update, all of sudden the firewall logs are stopped to receive on a panorama device. It has noted that panorama could not able to receive logs from 800 series firewall. But panorama able to receive the logs from the 5k series firewall. Checked logs settings and forward settings, which is ok. Panorama and all the firewalls are in the same network. Panorama Disk space having enough space. I have followed this article too.. but the issue remains the same. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFCCA0

Mohammed_Yasin · ‎07-23-2020

We have five (5) devices managed through Panorama. Two of them are still generating logs, while three of them have stopped sending logs. Please assist. it the logs Stops to receive from the device and The traffic and threat logs can be viewed when looking directly on the firewalls, but are not visible on Panorama It has noted that panorama could not able to receive logs from 800 series firewalls But panorama able to receive the logs from the 5k series firewall. Appliance: M-200 Firmware Version: 8.1.7

Mohammed_Yasin · ‎07-12-2020

I have installed a certificate that was working fine with my firewall, but suddenly I lost access to the GUI of the firewall. I tried what is mentioned here in the link below with no luck. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC

Mohammed_Yasin · ‎07-12-2020

I have reinstalled a certificate that was working fine with my firewall, but suddenly I lost access to the GUI of the firewall. I tried what is mentioned here in the link below with no luck. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC

Mohammed_Yasin · ‎07-11-2020

Panorama OS Version 9.0.8 getting HA duplicate IP address with peer error when pushing the network template override to Palo Alto firewall HA pair. Further investigation we found that variable settings override for HA peer ip and priority is not pushed by panorama to firewall 2. Below is KB details. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNG0CAO How I can fix this.

Mohammed_Yasin · ‎07-07-2020

Could you brief of your running problem

Date Registered	‎01-21-2020 03:30 AM
Date Last Visited	23m ago
Total Messages Posted	89
Total Likes Received	4

Online Status	Online
Date Last Visited	23m ago

Strata

Prisma

Cortex

About Mohammed_Yasin