About shafi021

Hi All,   We have Link and path monitoring enabled but no link and path group configured.   Actually I never enabled the link and path monitoring so my question is , is it enabled by default?   Also, if we don't have any link or path group configured as in my case, is it not active ?   I could not find any doc for the same.     @BPry  Can you please help me on this or anyone ? Thanks ... View more

Hi Team,   I want to Disable weak cipher suites for SSL/TLS and SSH   my question is, are the below commands correct ?   Do I need to run below commands on Active and Passive firewalls separately ?   I am using data port as management ( I do have dedicated management port with IP but not using it)  so below commands are still valid.   Also, I am on PAN OS 9.0.9.    for SSL/TLS to disable weak Algorithm- set shared ssl-tls-service-profile web-gui protocol-settings auth-algo-sha1 no set shared ssl-tls-service-profile web-gui protocol-settings enc-algo-3des no set shared ssl-tls-service-profile web-gui protocol-settings enc-algo-rc4 no set shared ssl-tls-service-profile web-gui protocol-settings keyxchg-algo-rsa no HOW TO FIX WEAK CIPHERS AND KEYS ON THE MANAGEMENT INTERFACE > configure # delete deviceconfig system ssh # set deviceconfig system ssh ciphers mgmt aes256-ctr # set deviceconfig system ssh ciphers mgmt aes256-gcm # set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256 # set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 256 # set deviceconfig system ssh session-rekey mgmt interval 3600 # set deviceconfig system ssh mac mgmt hmac-sha2-256 # set deviceconfig system ssh mac mgmt hmac-sha2-512 # commit # exit > set ssh service-restart mgmt > configure # delete deviceconfig system ssh kex mgmt # set deviceconfig system ssh kex mgmt ecdh-sha2-nistp521 # commit # exit > set ssh service-restart mgmt   Reference:   Disable weak cipher suites for SSL/TLS https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC   Disable weak cipher for SSH https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN5bCAG&lang=en_US%E2%80%A9   @OwenFuller @BPry Can you please help ?   ... View more

Hi Guys,   I have Firewall setup where standby firewall has more config then active firewall. Right now config is out of sync and HA1 back up link is up. HA1 and HA2 links are down. What I want is the config of standby firewall on the active as well . if I click on 'Sync with Peer' , which config will be synced ?   @BPry can you please help on this?   Thanks   ... View more

Hi Guys,   I want to create the DOS profile for critical servers. I read that I can use classified type so connection count toward only one IP address. My question is can I add multiple servers IPs in same DOS Rule or I need to create multiple DOS rules. Also, I might need to tune threshold base on servers so is it better to create new DOS rule? If I use same DOS rule then connection count will still be per destination IP or will it act like aggregate to all the Destination IPs ? ... View more

Hi,   I am looking to block the RFC 1918 blocks coming from internet to our LAN zone. So, Policy will be Source zone: Public , IP: RFC1918 blocks, Destination zone: LAN, IP : any . Can you guys please confirm that creating this policy will fulfill my requirement?    @OwenFuller can you please give your input?  Thank you    ... View more