About ukhapre

ukhapre · ‎01-23-2015

Nope. L-3 interface can be part of only 1 vsys/ vr.

ukhapre · ‎01-23-2015

The 'Email Scheduler' comes under section 'PDF Reports' only. I have not seen any option with XML report scheduler.

ukhapre · ‎01-23-2015

Are you using default page or custom page for GP? What exact software version is being used? Did you import config on same revision of RMA unit? Does the problem exist in older rev too? I know too many questions but it can give some hints.

ukhapre · ‎01-23-2015

This looks like function is broken in 6.1.1. Please open a case with support to file a bug if you like. I ran across some commands not working in 6.1.1 panorama.

ukhapre · ‎01-23-2015

Hello, Tunnel interface ip is only needed if you want to use tunnel monitoring. OSPF routes do not need an ip for tunnel interface.

ukhapre · ‎09-08-2014

Please check if there are networks defined in access list. If yes, then you need to include the servers, printers ips there. Important - you also need security policy to allow the traffic. e.g VPN zone to Trust allow access to <server ip>

ukhapre · ‎09-08-2014

another thread EDNS?

ukhapre · ‎05-29-2014

Hello, if power restart does not take you to standard prompt, RMA is needed.

ukhapre · ‎01-15-2014

Hello, the latest version 5.0.10 has the most known bugfixes available. You may want to stick with 1 or 2 versions earlier code. Please check the release notes to see the known bugs (which are not fixed yet) and fixed issues list which may be relevant to your network. https://support.paloaltonetworks.com/Updates/SoftwareUpdates/245 Please mark it has helpful or correct answer if appropriate.

ukhapre · ‎01-15-2014

Hello You can run command below to check the lease >show dhcp server lease all There are not much detailed options available for DHCP monitoring. To see captive portal users >show user ip-user-mapping all type CP Hope this helps. Please mark it as correct answer or helpful if appropriate.

ukhapre · ‎10-29-2013

Maybe use custom reports instead?

ukhapre · ‎10-29-2013

Does application show as 'ssl' and its allowed but still blocked?

ukhapre · ‎10-29-2013

Hello, I hope port 80 is added to allow web based traceroute e.g. Free online network tools - traceroute, nslookup, dig, whois lookup, ping - IPv6 Setting up security rule with service as 'application-default' should restrict allowed traffic with signature+port match only.

ukhapre · ‎10-24-2013

Hello, There are 4 apps for youtube Youtube-base youtube-posting youtube-safety-mode youtube-uploading You can create policies to deny youtube by selecting app. Hope this helps. Unnati

ukhapre · ‎10-09-2013

You may want to put the question in Dev community for faster response.

ukhapre · ‎10-09-2013

It is suggested to disable av/windows firewall during the virtual adapter installation. Are you having this issue on all platforms or win 7? Also make sure to use latest client to avoid running into any bugs https://downloads.paloaltonetworks.com/software/GlobalProtect-1.2.6-RN-revA.pdf?__gda__=1381405336_d18641428c779e0e43c32… • 52667—Fixed an intermittent connection failure between the GlobalProtect agent (on the computer) and the gateway due to an issue with the agent not setting the correct routes on the computer. To restore the connection, the computer had to be rebooted.

ukhapre · ‎10-09-2013

This should be ok. Only http, ocsp, https, snmp, ping,telnet, user-id,ssh are available on management interface. I would not allow 'ping' to allow everyone know its available. Apart from above services, you can also restrict it to be available from only certain IPs - 'Permitted IPs'

ukhapre · ‎10-09-2013

Hello, if you put security rule with black list on top - without option log - it should avoid too many logs. e.g. create custom category with black list as custom-deny-no log add a security rule to block traffic with custom category and put it on top.

ukhapre · ‎10-08-2013

Hello, are you seeing web traffic running slow when GP is connected? or finding slowness with agent connection to firewall? I have not seen any such reports. For slow traffic, if there is no access route configured - all traffic will go through firewall. Setting up access routes only for desired networks will help.

ukhapre · ‎10-07-2013

Hello,You should wait for some time after migration to allow firewall analyze ununsed rules. The show unused rules are tied to the Monitor Logs , so if you are not having good history of logs, then all the rules will be marked as unused rules. I believe that is why you see inconsistent results. FYI only Below is command to pull a list >show running rule-use rule-base security type un used vsys vsys1 Hope this helps! Please mark it as correct answer or helpful if appropriate.

ukhapre · ‎10-04-2013

There is similar issue resolved in 5.0.8. Please refer to release notes at https://downloads.paloaltonetworks.com/software/PAN-OS-5.0.8-RN-revA.PDF?__gda__=1380975467_35d69ebda945f9eb038e88d5db1c…

ukhapre · ‎10-04-2013

Hello Greg, when you assign IP with /29 mask - the interface will be listening for all IPs in that range. Hence /32 is required if you want to put another IP from same subnet. If you simply need to use second IP for natting - there is no need to configure IP to the interface but only NAT, security policy should be enough

ukhapre · ‎10-03-2013

Hi, Yes. You need to specify separate rule for the traffic pertaining to IP range. e.g. see below rule for source range 10.0.0.0/8 Setup email, log forwarding profile and assign it to the the relevant security rule. For detailed steps to create email, log forwarding profile refer to https://live.paloaltonetworks.com/docs/DOC-3779 Hope this helps!

ukhapre · ‎09-30-2013

This indicates mismatch with remote site. Check proposals for IKE and IPSec. Make sure traffic is not NATed. If you are using cisco at remote end, select DH-group 'no-pfs' for the proposal. If tunnel is up and working, these messages may be during the negotiation.

ukhapre · ‎09-27-2013

PA-200 does not seem like a good fit. http://media.paloaltonetworks.com/documents/Summary_Specsheet-Nov12.pdf Here is another thread with similar discussion https://live.paloaltonetworks.com/message/10952#10952

ukhapre · ‎09-19-2013

Hello, also make sure the URL you specify as source opens up as 'TEXT' If there are any additional characters than addresses, there will be an issue to read the file. Also make sure that the URL is reachable by firewall. Once Dynamic block list is created, then you will be able to choose the same from source or destination address list from security policy. Hope this helps.

ukhapre · ‎09-19-2013

You can check with SE if he is able to get default timeout information. FYI - if you need application timeout changed only for certain traffic and not all the traffic then, 1. create a custom app with higher timeout value. 2. Setup application override policy https://live.paloaltonetworks.com/docs/DOC-1071 3. Create a security rule to allow new custom application. This way you have control timeout for interesting traffic only.

ukhapre · ‎07-26-2013

DOS protection and Zone protection is typically applied for attacks. Make sure to apply DOS protection to the security rule. Zone protection profile needs to be assigned to respective Zone. Make sure the content is uptodate and security rules are using AV, Vulnerability profile. If you find some virus which was not covered, pcaps/relevant URLs can be submitted to add the coverage. Wildfire can be configured which can help us identify the suspicious traffic.

ukhapre · ‎07-26-2013

URL filtering enabled : True You can remove the profile altogether or adjust URL filters accordingly URL filtering matches in following order. Block list Allow list Custom DP cache MP cache Cloud

ukhapre · ‎07-26-2013

Hello, you need to setup 'Application Override policy' to allow custom application get identified. Also make sure to add custom application in the security policy to allow traffic . Hope this helps. Unnati

Date Registered	‎04-15-2011 12:28 PM
Date Last Visited	‎03-25-2017 02:10 PM
Total Messages Posted	85
Total Likes Received	21

Online Status	Offline
Date Last Visited	‎03-25-2017 02:10 PM

Strata

Prisma

Cortex

About ukhapre