This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
About mpgioia
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About mpgioia
02-20-2019
67Posts
9Likes
3Solutions
Feb 20, 2019Last Visited
User
Activity
User
Profile
Latest posts by mpgioia
| Subject | Views | Posted |
|---|---|---|
| 2886 | 01-08-2019 02:36 PM | |
| 1951 | 10-01-2018 08:17 PM | |
| 3514 | 06-05-2017 04:35 AM | |
| 3525 | 06-04-2017 06:16 PM | |
| 3537 | 06-04-2017 03:50 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 05-25-2017 09:21 PM | |
| 1 Like | 05-14-2017 02:39 AM | |
| 1 Like | 05-09-2017 09:07 AM | |
| 1 Like | 05-05-2017 08:59 AM | |
| 2 Likes | 05-02-2017 12:20 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 02-09-2015 03:16 AM |
| Date Last Visited | 02-20-2019 01:32 AM |
| Posts | 67 |
| Total Likes Received | 9 |
01-08-2019
02:36 PM
And the secure syslog option... where's the cert steps/setup to load a cert like PAN-OS doc shows here, for example, ? https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring
... View more
10-01-2018
08:17 PM
What about if I'm seeing this with both LEDs red ? IPSEC and IKE down.. Yet to see ikemgr.logs..
... View more
06-05-2017
04:35 AM
I reckon Ileveraging the API is the best bet. But tell me.. how does the 'Monitor Tag' work ? That will be key in querying against when parsing and summating manually in the API... me thinks (for my use case/requirement for the report). But the reference to the humble 'tag' in PANOS 8.0 doco references it only to 'SaaS Application Usage' ? 😕 https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/objects/objects-tags
... View more
06-04-2017
06:16 PM
I'd love to be able to, 1. Tag all my policies that match a source condition of a tenant /24 with a tag. I.e. (Some have some whitelisting of 'org wide prohibited apps' , above an org wide block list of say spotify, etc) .. so would have 2 or 3 rules above & beyond the sourceNAT allow at the bottom. 2. then based on that tag want to build a custom report of cumulative BYTES showing columns of, 1. That tag, 2. Source IP, 3. Destination IP, 4. Bytes for 'calendar month'. 3. no grouping or filtering. Just cumulative BYTES on that tag. If I have 100 tags then I have 100 rows. 100 rows, 4 columns. If I tack on additional tenants.. then rows will grow, but 4 columns remain/are static.
... View more
06-04-2017
03:50 AM
Hi all, I have a simple 'tenanted' environment. A /24 subnet represents a tenant behind the trust of my PAN. I want a simple report that shows 'traffic' over the last calendar month of that /24. I think this is simple by applying a 'monitor tag' per subnet. And then tagging my basic permit rules that match that source condition match of that /24 with that 'monitor tag'. But this 'sort by' and 'group by' is annoying. I don't want to sort or group by anything. I literally want a 'database = traffic' based custom report where selected columns are (top down) - Monitor Tag - Source address - Destination address - Bytes with no grouping. See what i'm trying to do ? The sort by is giving me a finite display of rows. I just want a total bytes of every vlan/subnet. Any suggestions from the community ?
... View more
05-30-2017
11:03 PM
That'd do it 😕 🙂 Thanks.
... View more
05-30-2017
10:06 AM
I posted a question here in a config article. https://live.paloaltonetworks.com/t5/Configuration-Articles/Certificate-config-for-GlobalProtect-SSL-TLS-Client-cert/tac-p/158713#M2099 PORTAL just lets me hit 'accept' anyway. (of course.. as it's all self-signed..) But GATEWAY won't let me continue ? Server certificate validation failed (again... makes sense.. cause it's self-signed.. but I would have thought I could continue anyway with a popup/trust me anyway prompt ?) Same TLS/SSL profile set for both GATEWAY + PORTAL. Self-signed/created CA, and server cert signed by aforementioned CA cert. This server cert is what is referenced in the TLS/SSL profile.
... View more
05-25-2017
09:21 PM
1 Kudo
* facepalm * l3 switch/routing concentration point had two default routes.. One pivoted one way another pivoted to inside of PAN.. ('another way' was the next hop of a prior device that the PAN is intending to replace..).... Everything fine and good.
... View more
05-14-2017
05:28 PM
@MicGioia wrote: @TranceforLife wrote: Are servers virtual or physical boxes? Can you access resources locally (without going through the Palo)? And interesting @TranceforLife you asked whether the destination was virtual or physical. Because that seems to be a correlation now.. Why did you ask that ?
... View more
05-14-2017
04:38 PM
@TranceforLife wrote: Are servers virtual or physical boxes? Can you access resources locally (without going through the Palo)? Yes.. so strangely.. I see a correlation. 2 x servers being Hyper-V hosts. They can't have anything DNAT'd to them. Guests that lie ontop of them are fine. I don't think it has anything to do with the teamed NICs. I tore them down and still an issue. Yes, can access resources from behind the firewall... all INSIDEis no issue. Some sort of protocol/packet/path hygiene, I can think of, is the only issue. Swap the PAN for a standard perimeter NAT/router.. like a cheapy/small thing. And it works fine. Routing/NAT'ing through the PAN. Equals blockages again.
... View more
05-14-2017
02:39 AM
1 Kudo
Agreed... shall get it tomorrow.
... View more
05-12-2017
10:50 AM
I did this. https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Set-the-Palo-Alto-Networks-Firewall-to-Allow-non-Syn/ta-p/62868 Didn't make a difference. 😕
... View more
05-12-2017
09:53 AM
05-12-2017
09:47 AM
I'm going to go on the basis the teamed setup on the NICs for the two servers i'm DNAT'ing to are creating session/state protocol hygiene disaster where PAN needs top notch hygiene (i.e. a cheap-ass NAT/router that was the routing/NAT point before the PAN port forwarded fine for these services). Is there anything I can disable in terms of hygiene checks with assymetry for the TCP state machine on the PAN that will undeniably confirm/deny this is the issue ? Also wireshark is spitting out ip checksum offload errors everywhere.. which may not be so much an issue as wireshark complains about this when packets have the whole hardware processing offload on the NIC for the checksum. Guaranteed the servers with their broadcom software and NICs and team setup are doing this checksum offload. But thought id just mention it.
... View more
05-12-2017
09:36 AM
Not just SMTP. Even RDP. I notice in PAN logs it shows app as 'incomplete' and session end reason 'aged-out'. But the successfull ones are app 'ms-rdp' and tcp states that are otherwise. Like port '80' another DNAT, app parsed as 'activesync'... but.. also a ton of 'incompletes' .. which I can re-create by simply telnetting to port 80.. which would normally test my DNAT out.. but this deployment .. ages out.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-20-2019
01:32 AM
|
Latest Tags
No tags yet
Likes Given To
| User | Likes Count |
|---|---|
| 1 | |
| 5 | |
| 4 | |
| 2 | |
| 1 |
Likes From
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks