About mpgioia

I reckon Ileveraging the API is the best bet. But tell me.. how does the 'Monitor Tag' work ? That will be key in querying against when parsing and summating manually in the API... me thinks (for my use case/requirement for the report). But the reference to the humble 'tag' in PANOS 8.0 doco references it only to 'SaaS Application Usage' ? 😕 https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/objects/objects-tags ... View more

I'd love to be able to, 1. Tag all my policies that match a source condition of a tenant /24 with a tag.  I.e. (Some have some whitelisting of 'org wide prohibited apps' , above an org wide block list of say spotify, etc) .. so would have 2 or 3 rules above & beyond the sourceNAT allow at the bottom. 2. then based on that tag want to build a custom report of cumulative BYTES showing columns of, 1. That tag, 2. Source IP, 3. Destination IP, 4. Bytes for 'calendar month'. 3. no grouping or filtering.  Just cumulative BYTES on that tag.  If I have 100 tags then I have 100 rows. 100 rows, 4 columns. If I tack on additional tenants.. then rows will grow, but 4 columns remain/are static. ... View more

That'd do it 😕 🙂 Thanks. ... View more

@MicGioia wrote: @TranceforLife wrote: Are servers virtual or physical boxes? Can you access resources locally (without going through the Palo)?     And interesting @TranceforLife you asked whether the destination was virtual or physical. Because that seems to be a correlation now.. Why did you ask that ?   ... View more

@TranceforLife wrote: Are servers virtual or physical boxes? Can you access resources locally (without going through the Palo)?   Yes.. so strangely.. I see a correlation. 2 x servers being Hyper-V hosts. They can't have anything DNAT'd to them. Guests that lie ontop of them are fine.   I don't think it has anything to do with the teamed NICs. I tore them down and still an issue.   Yes, can access resources from behind the firewall... all INSIDEis no issue.   Some sort of protocol/packet/path hygiene, I can think of, is the only issue. Swap the PAN for a standard perimeter NAT/router.. like a cheapy/small thing. And it works fine.  Routing/NAT'ing through the PAN.  Equals blockages again. ... View more

Agreed... shall get it tomorrow. ... View more

I did this. https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Set-the-Palo-Alto-Networks-Firewall-to-Allow-non-Syn/ta-p/62868 Didn't make a difference. 😕 ... View more

I'm going to go on the basis the teamed setup on the NICs for the two servers i'm DNAT'ing to are creating session/state protocol hygiene disaster where PAN needs top notch hygiene (i.e. a cheap-ass NAT/router that was the routing/NAT point before the PAN port forwarded fine for these services). Is there anything I can disable in terms of hygiene checks with assymetry for the TCP state machine on the PAN that will undeniably confirm/deny this is the issue ?   Also wireshark is spitting out ip checksum offload errors everywhere.. which may not be so much an issue as wireshark complains about this when packets have the whole hardware processing offload on the NIC for the checksum.  Guaranteed the servers with their broadcom software and NICs and team setup are doing this checksum offload. But thought id just mention it.  ... View more

Not just SMTP. Even RDP. I notice in PAN logs it shows app as 'incomplete' and session end reason 'aged-out'. But the successfull ones are app 'ms-rdp' and tcp states that are otherwise. Like port '80' another DNAT, app parsed as 'activesync'... but.. also a ton of 'incompletes' .. which I can re-create by simply telnetting to port 80.. which would normally test my DNAT out.. but this deployment .. ages out. ... View more

Negative.  The inter-zone default block at the bottom is not popping up when over-ride and log is set. And wireshark shows some streams getting to the SMTP EHLO.  So I know it gets through sometimes. Also on PAN monitor it shows as tcp-fin for session end reason.. so I know it gets to the end of the tcp state-machine. ... View more

Yes..  I was going to say that .. because client is sending SYN's again with seq=0 and never updating. Checking... ... View more

There.. Following a stream end to end.   ... View more

The NAT's are getting to the server... I can see it in wireshark on the endpoint..   There's a mess of ip checksum mismatch's and ACK number mismatches.. Probably assymetry going on..   ... View more

Yes.. can hit the services on the servers fine inside... Hyper-V.. quite sure.. don't have access to the underlying Hyper-V solution.. just the guest.. but can see Hyper-V NDIS bindings everywhere in the network settings so assume they are virtual and Hyper-V is the virt solution. ... View more

Static. default vr. to tunnel interface.       From the 192.168.75.15 host (near end) below.     ... View more

omg.. I think the 'decapsulated inner packet' is coming through on Cisco ASA as IPv6 ?!   Look at the log line at the end.. truncated off..  But the first parameter appears to be in IPv6 format ?   ... View more

Infact I just posted template Syslog output (or should I say.. all I received was the template syslog output from the rep on the other side..) i'll get the actual output/log line to see what the translated inner packet is. ... View more

This is ridiculous.. and appreciate the pipe in @TranceforLife. Yes, incrementing enc/dec packets. And check this out.. when I run a PCAP,  and filter right down to a source of a /32 and a destination of a /32 (near and far end), all 4 stages of what it can pcap.. I literally get no files created when I try to, like, http/https browse.  Nothing. I start my ping off to the dest.. bang files created.. 😕   If it helps, at least on the far end/Cisco side I get a repeating,   ---------------------------------------------------------------------------------------------------------------------------------------------------------- IPSEC: The decapsulated inner packet doesn't match the negotiated policy in the SA.   The packet specifies its destination as pkt_daddr its source as pkt_saddr, and its protocol as pkt_prot. The SA specifies its local proxy as id_daddr/id_dmask/id_dprot/id_dport and its remote proxy as id_saddr/id_smask/id_sprot/id_sport. ---------------------------------------------------------------------------------------------------------------------------------------------------------- ... View more

@chris.russell wrote: Yeah, thats why i recommended sourcing pings from something other than whatever interface its pinging from now.   Educate me here. ... what do you mean by this ? 🙂 Right now, I'm on a near end proxy-id/policy source address.. (like an actual machine in this subnet.. remotely) pinging to proxy-id/policy destination address (this I'm not on remotely.. but have been told in confidence by far end representative it's there and live.. obviously..)   See.. now i'm stressing again that it's my side again if 'Session Start' is ticked in logging on my policy and I don't see my traffic-half/side on the way to the far end.. when I technicaly should right ? ... View more

@AXI_IIEN_Remo wrote: You could also enable "Session Start" log so you will also see logs for not established sessions.   But as you describe this setup, and when you don't see any encryption/decryption errors I would also definately check the other side (make someone check the other side). Maybe the other side has access-lists in place which only allow icmp?   What you could still check is the system log, if the ASA tries to setup a new phase 2 tunnel for tcp traffic while sending only icmp to the existing one. Not really likely but a while ago I had a cisco-router admin who somhow managed to configure his router to setup different phase 2 tunnels for every source/destination/port constellation.   With the routing I think you're absolutely right. If there is a routing problem also icmp would fail.   Yeh am logging at Session Start and End. Don't see nothing.. I'll check the other side.. Thanks guys. ... View more