About nayubi

nayubi · ‎10-01-2013

The logs indicate the server is slow to respond to the requests and they are being aged out. This can only be fixed by response times, weather hardware upgrade, or adding additional servers, etc. If you have multiple servers you may try and load balance between them by domains to lighten the load. You can also enable caching on the advanced tab. Around how many requests are you trying to proxy for? Your server should be responding back to the pan dns requests via the management unless configured with a service route. What is the vulnerability that this traffic is being seen as and on what interface and zone and direction is it seen coming from? Is it the server or client traffic being identified as the threat.

nayubi · ‎09-30-2013

This can be due to not receiving enough packets for the decoder to identify the application. Depending on what application it is, it may need more packets to identify.

nayubi · ‎09-27-2013

The above errors are due to a delayed response from the DNS server. There is an error processing the response packet from the dns server because the entry has already been cleared out to the tables. Try to use a server that has a faster response time to clear this up. Sep 24 04:21:54 Error: pan_dnsproxyd_recv_server_udp_cb(pan_dnsproxy_udp.c:487): [Drop Rcvd Server Pkt]: Error in processing packet Sep 24 04:38:40 Error: pan_dnsproxy_process_server_pkt(pan_dnsproxy_pkt.c:1320): [20840/-][Drop Rcvd Server Pkt]: No pending entry in conn tbl for server_tid:20840 Sep 24 04:38:40 Error: remove_conn_tbl_entry(pan_dnsproxy_pkt.c:284): conn_tbl[20840] entry is already freed! Sep 24 04:38:40 Error: pan_dnsproxyd_recv_server_udp_cb(pan_dnsproxy_udp.c:487): [Drop Rcvd Server Pkt]: Error in processing packet If this was due to bursty traffic and the buffers were becoming depleted you would most likely get the following error: Error: sendfromto(pan_dnsproxy_util.c:378): sendmsg (No buffer space available)

nayubi · ‎09-09-2013

The pan does not support the protocol VRRP as stated above. However it can pass that traffic as well as it has its own redundancy protocol High Availability. You can follow these doc's and video that will give you more information. I https://live.paloaltonetworks.com/docs/DOC-2926 https://live.paloaltonetworks.com/videos/1173 As far as design you can create aggregate links and add vlans with tags to separate the traffic. Or you can set the pan up as a pass through with just tagged ports. You will also need to keep in consideration if nat needs to be implemented on the pan or if it is happening some where else on the network. You should consult your SE to help with design if you have any doubts.

nayubi · ‎08-06-2013

If you have specific address ranges or networks for different roles in your organization you may be able to try and create a custom report with query builder and specify attributes of source or destination address or zone.

nayubi · ‎01-29-2013

As of now we do not have a single document that goes over the behavior of proxy arp on the firewall. However, here are some links to some discussions that go over some topics. https://live.paloaltonetworks.com/message/5232 https://live.paloaltonetworks.com/message/8332 Currently the firewall should only proxy arp for devices it thinks it is responsible for such as a dnat or sslvpn network.

nayubi · ‎01-29-2013

On 3.1.12 code we do not have any options to fail over the agents and if you should, there should not be any disruptions if failing over to the other agent as they should be identical. I would recommend a request for an enhancement request to get such a command. In the earlier versions of Pan OS the priority is based off of when the devices were entered into the firewall. However, in the new 5.0 version you can configure this with the custom agent sequence option. This option allows you to define the sequence order in which the User-ID agent profiles will connect to the defined server. For example, if you have four agents identified in the sequence list, it will attempt to connect to the first agent listed, if that connection fails, it will connect to the next agent listed, and so on. If this option is not configured, the connection sequence will follow the order of the agents listed in the main page

nayubi · ‎01-09-2013

You should be able to apply a url filtering policy to block that specific url and apply on the policy form internet to dmz. You can verify the policy it is hitting with the following command: test security-policy-match source <address> destination-port 443 destination <address> protocol 6 Based off of this result place the url policy on this security policy. You should also check your url filtering logs to see what is the url we see it as.

nayubi · ‎11-30-2012

You can try to create an object using an fqdn and try to apply in in a policy, but it looks like you may need to invest in url filtering.

nayubi · ‎10-30-2012

You do not need an additional license for multiple portals with only one gateway per portal. The global protect base license should suffice. You will only need a license when using multiple gateways and HIP check.

nayubi · ‎10-30-2012

These are reasons why they could be disabled, but yes if they believe it is no longer a threat or if it is combined in another signature that identifies it with better accuracy. Or if the application is obsolete. If you feel this threat is still an issue and should be a part of the Palo Alto database please contact support and open a ticket for review.

nayubi · ‎10-29-2012

In signature 335 there was only disabled vulnerability signature 30793 Microsoft Internet Explorer Content-Type Denial Of Service Vulnerability. This signature should no longer trigger as the signature is disabled. The reasons behind this are: 1. The signature is being reviewed for improvements 2. The vulnerability does not exist anymore

nayubi · ‎09-13-2012

What is the new pattern you have configured. The pattern you are trying to match on earlier is not long enough and you will need to match on more characters to be able to get the commit to complete and the to correctly match the signature.

nayubi · ‎07-16-2012

There is a known bug that is currently looking into a similar issue with this 37167

nayubi · ‎07-16-2012

an autocommit is triggered by a reboot of the dataplane weather it be a hard or soft reboot.

Member Since	‎05-02-2011 02:54 PM
Date Last Visited	‎08-12-2020 07:17 PM
Posts	64
Total Likes Received	7

Online Status	Offline
Date Last Visited	‎08-12-2020 07:17 PM

About nayubi

Re: DNS Proxy Errors

Re: Application Incomplete - Leading causes?

Re: DNS Proxy Errors

Re: Data center firewall design?

Re: User usage report enhancements

Re: Disabled Vulnerability Signatures in App+Threat Update 335

Re: "Could not set the session location" messages in Panorama

Re: DNS Proxy Errors

Re: ARP Proxy

Re: User usage report enhancements

Re: Custom Vulnerability Signature Operation Failed

Re: DNS Proxy Errors

Re: Application Incomplete - Leading causes?

Re: DNS Proxy Errors

Re: Data center firewall design?

Re: User usage report enhancements

Re: ARP Proxy

Re: How to change pan-agent priority?

Re: Block DMZ specific URL

Re: URL Filter - Block one and log the rest

Re: Global Protect License

Re: Disabled Vulnerability Signatures in App+Threat Update 335

Re: Disabled Vulnerability Signatures in App+Threat Update 335

Re: Custom Vulnerability Signature Operation Failed

Re: "Could not set the session location" messages in Panorama

Re: What triggers an autocommit?

Network Security

Cloud Security

Security Operations

About nayubi