Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- ›
- About nayubi
About nayubi
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
08-12-2020
18Posts
7Likes
7Solutions
Aug 12, 2020Last Visited
User
Activity
User
Profile
Latest posts by nayubi
| Subject | Views | Posted |
|---|---|---|
| 1378 | 10-01-2013 07:05 PM | |
| 2044 | 09-30-2013 10:58 AM | |
| 1378 | 09-27-2013 05:29 PM | |
| 2663 | 09-09-2013 01:52 PM | |
| 564 | 08-06-2013 06:56 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 10-29-2012 02:32 PM | |
| 1 | 07-16-2012 12:19 PM | |
| 1 | 09-27-2013 05:29 PM | |
| 1 | 01-29-2013 03:48 PM | |
| 1 | 08-06-2013 06:56 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 |
User Badges
Public Statistics
| Date Registered | 05-02-2011 02:54 PM |
| Date Last Visited | 08-12-2020 07:17 PM |
| Total Messages Posted | 64 |
| Total Likes Received | 7 |
10-01-2013
07:05 PM
The logs indicate the server is slow to respond to the requests and they are being aged out. This can only be fixed by response times, weather hardware upgrade, or adding additional servers, etc. If you have multiple servers you may try and load balance between them by domains to lighten the load. You can also enable caching on the advanced tab. Around how many requests are you trying to proxy for? Your server should be responding back to the pan dns requests via the management unless configured with a service route. What is the vulnerability that this traffic is being seen as and on what interface and zone and direction is it seen coming from? Is it the server or client traffic being identified as the threat.
... View more
09-30-2013
10:58 AM
This can be due to not receiving enough packets for the decoder to identify the application. Depending on what application it is, it may need more packets to identify.
... View more
09-27-2013
05:29 PM
1 Kudo
The above errors are due to a delayed response from the DNS server. There is an error processing the response packet from the dns server because the entry has already been cleared out to the tables. Try to use a server that has a faster response time to clear this up. Sep 24 04:21:54 Error: pan_dnsproxyd_recv_server_udp_cb(pan_dnsproxy_udp.c:487): [Drop Rcvd Server Pkt]: Error in processing packet Sep 24 04:38:40 Error: pan_dnsproxy_process_server_pkt(pan_dnsproxy_pkt.c:1320): [20840/-][Drop Rcvd Server Pkt]: No pending entry in conn tbl for server_tid:20840 Sep 24 04:38:40 Error: remove_conn_tbl_entry(pan_dnsproxy_pkt.c:284): conn_tbl[20840] entry is already freed! Sep 24 04:38:40 Error: pan_dnsproxyd_recv_server_udp_cb(pan_dnsproxy_udp.c:487): [Drop Rcvd Server Pkt]: Error in processing packet If this was due to bursty traffic and the buffers were becoming depleted you would most likely get the following error: Error: sendfromto(pan_dnsproxy_util.c:378): sendmsg (No buffer space available)
... View more
09-09-2013
01:52 PM
1 Kudo
The pan does not support the protocol VRRP as stated above. However it can pass that traffic as well as it has its own redundancy protocol High Availability. You can follow these doc's and video that will give you more information. I https://live.paloaltonetworks.com/docs/DOC-2926 https://live.paloaltonetworks.com/videos/1173 As far as design you can create aggregate links and add vlans with tags to separate the traffic. Or you can set the pan up as a pass through with just tagged ports. You will also need to keep in consideration if nat needs to be implemented on the pan or if it is happening some where else on the network. You should consult your SE to help with design if you have any doubts.
... View more
08-06-2013
06:56 PM
1 Kudo
If you have specific address ranges or networks for different roles in your organization you may be able to try and create a custom report with query builder and specify attributes of source or destination address or zone.
... View more
01-29-2013
03:48 PM
1 Kudo
As of now we do not have a single document that goes over the behavior of proxy arp on the firewall. However, here are some links to some discussions that go over some topics. https://live.paloaltonetworks.com/message/5232 https://live.paloaltonetworks.com/message/8332 Currently the firewall should only proxy arp for devices it thinks it is responsible for such as a dnat or sslvpn network.
... View more
01-29-2013
01:58 PM
On 3.1.12 code we do not have any options to fail over the agents and if you should, there should not be any disruptions if failing over to the other agent as they should be identical. I would recommend a request for an enhancement request to get such a command. In the earlier versions of Pan OS the priority is based off of when the devices were entered into the firewall. However, in the new 5.0 version you can configure this with the custom agent sequence option. This option allows you to define the sequence order in which the User-ID agent profiles will connect to the defined server. For example, if you have four agents identified in the sequence list, it will attempt to connect to the first agent listed, if that connection fails, it will connect to the next agent listed, and so on. If this option is not configured, the connection sequence will follow the order of the agents listed in the main page
... View more
01-09-2013
03:13 PM
You should be able to apply a url filtering policy to block that specific url and apply on the policy form internet to dmz. You can verify the policy it is hitting with the following command: test security-policy-match source <address> destination-port 443 destination <address> protocol 6 Based off of this result place the url policy on this security policy. You should also check your url filtering logs to see what is the url we see it as.
... View more
11-30-2012
03:58 PM
You can try to create an object using an fqdn and try to apply in in a policy, but it looks like you may need to invest in url filtering.
... View more
10-30-2012
12:30 PM
You do not need an additional license for multiple portals with only one gateway per portal. The global protect base license should suffice. You will only need a license when using multiple gateways and HIP check.
... View more
10-30-2012
11:31 AM
1 Kudo
These are reasons why they could be disabled, but yes if they believe it is no longer a threat or if it is combined in another signature that identifies it with better accuracy. Or if the application is obsolete. If you feel this threat is still an issue and should be a part of the Palo Alto database please contact support and open a ticket for review.
... View more
10-29-2012
02:32 PM
1 Kudo
In signature 335 there was only disabled vulnerability signature 30793 Microsoft Internet Explorer Content-Type Denial Of Service Vulnerability. This signature should no longer trigger as the signature is disabled. The reasons behind this are: 1. The signature is being reviewed for improvements 2. The vulnerability does not exist anymore
... View more
09-13-2012
05:26 PM
What is the new pattern you have configured. The pattern you are trying to match on earlier is not long enough and you will need to match on more characters to be able to get the commit to complete and the to correctly match the signature.
... View more
07-16-2012
12:19 PM
1 Kudo
There is a known bug that is currently looking into a similar issue with this 37167
... View more
07-16-2012
12:13 PM
an autocommit is triggered by a reboot of the dataplane weather it be a hard or soft reboot.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
