About ppatel

ppatel · ‎11-27-2012

Replication was performed in-house on 4.1.x. Following was the custom system log format in the email server profile :- 1) With white spaces syntax:- $domain \n$id \n$actionflags \n$severity \n$time_generated \n$object \n$severity 2) Without white spaces syntax:- $domain\n$id\n$actionflags\n$severity\n$time_generated\n$object\n$severity 3) $domain $id $actionflags $severity $time_generated $object $severity Email Alert Logs that appear in my email-address Alert 1:- 1 \n0 \n0x0 \ninformational \n2012/07/27 20:48:00 \n \ninformational Alert 2:- 1 \n0 \n0x0 \ninformational \n2012/07/27 20:50:58 \n \ninformational A similar issue has been filed as a bug to engineering and the targeted release is 5.0. This issue might not be resolved in 4.1.x branch Let me know if this is helpful. Regards Parth

ppatel · ‎10-18-2012

Hi Ian, I guess, you should go through this detailed step by step documentation of the GlobalProtect configuration for users upgrading from Net-Connect. It also covers the necessary migration steps and tips for customers using NetConnect remote access solution upgrading to PAN-OS 4.1. Upgrading the software version will also migrate SSL VPN configuration into Global protect configuration for PAN Os 4.1. Global protect should work with PAN-OS 4.0 but you can use netconnect till the OS is not upgraded. Once upgraded to Global protect when the users go to the portal and download the client they would be asked for an option to uninstall netconnect from your machine. Also the following link will help install GP client via AD GPO https://live.paloaltonetworks.com/docs/DOC-1737 FYI, go through the following technote:- Regards

ppatel · ‎10-17-2012

Hello, After how many tries does the the user lock out? And how frequent is the user trying to log in again after locking out? Check the release notes for software version 4.0.13 which should address the issue. 39665 – Admins logging in to the firewall that are locked out after reaching the set number of failed login attempts are not be removed from the lock list after the failed login timer expires. In 4.1 branch, this is addressed in 4.1.7. Regards

ppatel · ‎10-11-2012

Darren, Is the Ip-pools assigned to the Global protect gateway overlapping the Local LAN? If that is the case, It is recommended to have ip-pool as a completely different subnet that the Local LAN -trust network. Regards

ppatel · ‎10-11-2012

The box does not automatically boot. Keep entering either 'Q' or 'Ctrl+C' to exit the job to main menu where there is an option to reboot. Look at the attachment in my first reply. When you navigate to the bottom of the list, there is an option to reboot. Regards Parth

ppatel · ‎10-11-2012

Hi Karl, Under custom log format in syslog profiles for threat, there is no URL field. However, as seen below, 'src' and 'dst' field highlighted below should be the source address and the destination address. When compared to Monitor > Logs > Threat logs, source address would be "attacker" and the destination address would be the "victim". There is a checkbox "Resolve hostname" in the web UI, which will resolve the ip-addresses. However this is restricted to just the firewall. When you export it to syslog, I believe only the ip-addresses will show up for the threat logs and not the URLs. Let me know if this explanation helps. Regards Parth

ppatel · ‎10-11-2012

Hi, There is no time limit to this.I have seen cases where it takes 15-20 minutes for the same out put as you see. However, you can exit out by pressing Ctrl+C or Esc and go back to the main menu and reboot the device. Once rebooted completely, you can shut it down if you want. Regards Parth

ppatel · ‎10-11-2012

Hello, I think the disk check is no longer running.I have attached the Sample output from a 4000 series firewall below but it might differ based on platforms: Diagnostics" and ran the "Test Disk Performance with Bonnie++" selection you suggested. Here's the output ... =================================================== Testing.... Using uid:0, gid:0. Writing with putc()...done Writing intelligently...done Rewriting...done Reading with getc()...done Reading intelligently...done start 'em...done...done...done... Create files in sequential order...done. Stat files in sequential order...done. Delete files in sequential order...done. Create files in random order....Using uid:0, gid:0. Writing with putc().............................................................done. Writing intelligently......................done Rewriting........................................done Reading with getc()...........................................................done Reading intelligently...................done...........................Bonnie output: Version 1.03d------Sequential Output------ --Sequential Input- --Random- -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks-- MachineSize K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP /sec %CP Thor 2G 32269 99 99629 43 48146 15 33579 96 118085 16 268.7 1 ------Sequential Create------ --------Random Create-------- -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete-- files /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP 16 +++++ +++ +++++ +++ +++++ +++ +++++ +++ +++++ +++ +++++ +++ Thor,2G,32269,99,99629,43,48146,15,33579,96,118085,16,268.7,1,16,+++++,+++,+++++,+++,+++++,+++,+++++,+++,+++++,+++,+++++,+++ done. Stat files in random order...done. Delete files in random order...done. Try to exit out by pressing Ctrl+C or Esc. In addition to that I would also recommend you perform FSCK disk check from the maintenance mode. Once the FSCK disk check is done, reboot the device and examine the reboot sequence and look for emask/ata errors. You also see that in system logs of the firewall sometimes:- 19:00:56 10.3.66.2 10.3.66.2 1,2010/05/04 19:00:56,0002C111111,SYSTEM,general,0,2010/05/04 19:00:56,,general,,0,0,general,critical,ata2.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6 frozen If you see this, it possible means you have corrupt hard drive. Let me know if this helps. Regards Parth

ppatel · ‎10-11-2012

Hello, The detailed issue is documented at the following link indicating as an expected behavior. https://live.paloaltonetworks.com/docs/DOC-3369 Regards Parth

ppatel · ‎10-11-2012

Hi Tomoyuki, That is true. Panorama does not have a show arp command because there is no physical interface. In order to see the arp information of individual devices we would have to log into each device.It is a server hosted on a VM to manage the devices. Hence it is not possible to read the arp table on Panorama Let me know if this helps. Regards

ppatel · ‎10-11-2012

Hi, The reboot of the device followed by the auto-commit also depends upon the Hardware Platform. For PA 500 and 2000 series, we have seen instances where auto commit takes a while to complete as compared to 5000 series Regards Parth

ppatel · ‎10-10-2012

The fix to HA sync will be introduced in software version 4.1.9 . However 4.1.8 hotfix is now available. So please open a support ticket with Palo Alto Networks and once verified, it would be made available to you. 4.1.8-hotfix should take care of HA A/P, A/A, and Panorama HA. For more details look up this document:- https://live.paloaltonetworks.com/docs/DOC-3890 Regards Parth

ppatel · ‎10-10-2012

Andrew, Once you create the application over ride rule along with the custom application and commit, you need to clear all the existing sessions from the firewall that uses inbuilt application >clear session all OR >clear session all filter source <x.x.x.x> Now test the application override rule by sending traffic. Regards Parth

ppatel · ‎10-10-2012

Andrew, Here is the link to disable application inspection on the firewall for certain traffic. https://live.paloaltonetworks.com/docs/DOC-2816 Create two custom applications under Objects>Applications 1 ) For tcp port, select under port :- tcp/dynamic 2) For UDP, select under port :udp/dynamic Create two separate application override rules , one of tcp and the other for udp traffic. One security rue will have protocol TCP and ports 0-65535 The other security rule will have protocol UDP and port 0-65535 Let me know if this helps. Regards

ppatel · ‎10-09-2012

At this time only the logs can be exported out in CSV format. Scheduled export of logs can also be done. Select the log type from the drop down list. The reporting is done in PDF formats only. Regards Parth

ppatel · ‎10-09-2012

How to create an Email Server Profile:- Go to Device > Server Profile > Email, Click Add and fill the required fields (as per the example below) Name, Enter a name for the email settings Server, Enter a name to identify the server (1-31 characters) Display name: Email Server From: Enter the From email address To: Enter the email address of the recipient. Cc: Optionally, enter the email address of another recipient. Gateway: Enter the IP address or host name of the Simple Mail Transport Protoco l Regards

ppatel · ‎10-09-2012

You can create multiple user activity reports and generate the reports for the last several days, weeks or months according to your requirement. User activity report is created one per user. So if you want to create reports for 5 users, you need 5 entries under Monitor > PDF Reports > User Activity Report. Now for each user activity report, you need to create email scheduling profile. Report group:- Name of the user activit report Email Profile:- The Email Server profile that includes the mail server gateway. Set up under Device > Server profiles > Email Recurrence:- When to generate and email to the addresses specified in Email profile. At this time it appears that multiple user activity reports cannot be combined within a single custom report to be generated at a single time. Let me know if this helps. Regards

ppatel · ‎10-08-2012

Hi Darren, You should be download the updates now. Give it a try and let us know. Regards

ppatel · ‎10-08-2012

Hi Darren, You should be able to update contents soon. There are some minor changes made on the server side. Let me go ahead and try it out in-house and will keep you posted. Regards

ppatel · ‎10-08-2012

I think you are taking about the proxy id's here, correct me if I am wrong. Tunnel Monitoring is used to keep a VPN tunnel communicating with the other VPN endpoint. If a tunnel monitor profile is created it will specify one of two action options if the tunnel is not available; wait-recover or fail-over. For tunnel monitoring, under Network> Ipsec Tunnels > Advance Options, the destination ip-address would be a single Ip-address. Secondary ip-address cannot be configure on the tunnel interface under Network > Interfaces > Tunnel However, you can set proxy ids to achieve this where you can keep the local private subnet in "local" field and the remote private subnet under "remote" field. The same proxy ids also need to be set on the other side but the local and the peer subnets would be reversed. Regards

ppatel · ‎10-08-2012

You would have to turn on SSL decryption for SSL encrypted websites, when using URL filtering or to detect some applications (for example face-book chat, posting etc). You can block all the categories together by clicking down arrow key as shown below. Regards Parth

ppatel · ‎10-07-2012

Anytime Jason If there are any issues with this, please open a support ticket and we will be able to assist you. Have fun!!! Regards Parth

ppatel · ‎10-07-2012

Jason, The upload action should work in the case of file upload to drop-box with the security rule as mentioned above in the security rule. Regards Parth

ppatel · ‎10-07-2012

Jean, If that is the case, we would like see the configuration and review logs on the firewall. Does the second sub-interface have the ip-address in the same subnet as the first? Regards

ppatel · ‎10-07-2012

Is the Cisco establishing the VPN tunnel with the Palo Alto firewall or the firewall is just in a pass through stage for ipsec traffic? It somehow appears from the description the tunnel is terminating on the firewall. Correct me if I am wrong. If that is the case and from the description of the two ip-addresses in use , you can use the the feature of secondary ip-address on the interface and not the sub-interfaces. What I mean is the following:- Trust Zone:- Internal corporate network Untrust Zone:- Outside World VPN zone :- tunnel is in this zone. (VPN users) From above, 10.30.6.59/24 is the interface address. However the VPN ike-gateway address can be set as a secondary ip-address on the interface as 10.30.6.110/32 as seen above. Tunnel will be in VPN zone:- NAT rule should look like the following:- One rule for the trust users and one for the VPN users (Ip-pool) Also make sure you have security rules from VPN to Trust and the other way around. And there is no explicit deny rule in the security rule base. Let me know if this helps. Regards

ppatel · ‎10-07-2012

The file blocking feature You should be having the direction set to "both" in the file blocking profile. Since the traffic is governed through the security policies in the firewall, it is all zone based. The security profile that needs to be applied to the policies should be the following across the zones. For example , say block .exe files. Security Rule in this case would be the following:- The file block page/custom page will be displayed for the file types ".exe" through across the zones. The file type should match with the type set for either "block" or "continue" to trigger the response page. If you need to set up custom page, you can upload under Device>Response Page Let me know if that helps. Regards Parth

ppatel · ‎10-07-2012

Also, The maximum file size supported via "upload file" feature is 2GB. If the file would be of a greater size, the upload would fail. Regards Parth

ppatel · ‎10-07-2012

Hello, I was able to successfully upload the file to the case management portal. If not, try using IE or chrome browser. Regards Parth

ppatel · ‎10-05-2012

For your ease, From the GUI of the firewall , go to Device> Setup> Management > Panorama Settings. Click Disabled shared confg as highlighted below. Let me know it it helps. Regards

ppatel · ‎10-05-2012

Also I see that docs.google.com falls in "online-personal-storage" category You can block that category but just allow docs.google.com in the Explicit allow list. Furthermore,for ssl websites, It is not possible to tell what protocol is inside without SSL Decryption so the categorization is done either by IP or via the Common Name from the SSL certificate. Regards

Date Registered	‎05-17-2011 12:30 PM
Date Last Visited	3 weeks ago
Total Messages Posted	162
Total Likes Received	66

Online Status	Offline
Date Last Visited	3 weeks ago

Strata

Prisma

Cortex

About ppatel