About robert.hoffmann

I monitor our GP-Portal with snmp for summary of connected users. Now I configured a second portal on the same device. The snmp monitors only all GP-users over all portals. How its possible to divide the monitoring value into portal a and b? ... View more

Hi,   for privacy reasons our customer has different log retention periods. He want's to delete all personally identifiable traffic log for traffic from internal to external to delete after 7 days. Also traffic logs for blocked traffic from externel to internal should be deleted after 7 days. Traffic logs for allowed traffic from externel should never (until disk full) been deleted. Internal server traffic logs should be deleted after 30 days. Is there any idea, how to resolve this? Panorama doesn't exist. Splunk isn't an option, because there are 20GB of log volume per day.   Thanks Robert ... View more

Hi,   PA writes in his Front Pane description HSCI port "PA-5220 firewall —One QSFP+ 40Gbps port (supports only a 40Gbps (QSFP+) transceiver or QSFP+ active optical cable)." and nothing for the QSFP+ ports.   Does PA-5200 also support 40G QSFP+ DAC Passive Copper Cable and if so on QSFP+ and HSCI Port?   Has anyone tried out?   Regards Robert ... View more

Hi,   I have some clients who are installing a NAT-Router behind the Firewall to span their own WIFI. The NAT devices are from different vendors with different MACs.   Has anyone an idea how to detect these NAT-devices irrespective of their MAC / IP-adress and how to deny all the traffic from these devices?   My intent is to block all traffic, where IP pakets have a different ttl than 128 / 64 but how can I solve this with palo alto.   Regards   Robert ... View more

What does it mean and how to solve it? Regards Robert ... View more

From this night with last dynamic update of Applications and Threats the detection of private IP's in Geo IP location changed from origin private IP to unknown. Does anyone have the same issue? Since this morning with last dynamic update of Applications and Threats we have massive connection problems and we are clutching at straws. ... View more

Hi, after Upgrading from 5.0.7 to 6.0.2 I got wrong values for active sessions information in my monitoring tool. The device it selfs shows a much lower value then my SNMP-network Monitoring tool. E:G.          on the device: At the same time via SNMP Is this How can I solve these problem? Greetings from the old continent Robert ... View more

Hi, is it possible to assign a QoS Profile to a L3 Subinterface? In my configuration on 5.0.2 there is the possibility only to physical interfaces. Best regards, Robert ... View more

Hi @all, in the cli I have an option to monitor the throughput via "show system statistics". Is there a way to monitor the firewallthroughput from external devices via snmp? Robert ... View more

Hi, on a PA 2020 running 4.1.0 is a VPN Gateway configured. A client PA 500 running 4.1.0 with dynamic WAN IP is configured as peer. Both devices can reach each other. In system log is a succesfull phase 1 and phase 2 and a succesfull ipsec connection. After that, a IPSec SA delete message appears and the IPSec key will be deleted. From this time the connection starts again with phase 2. Does anyone have any ideas? Regards from Germany Robert (newest log entries first) IPSec key   deleted. Deleted SA: 217.68.167.208[500]-212.122.61.23[500]   SPI:0xBF6E041B/0xCCA91B0D. IKE protocol IPSec SA delete message   sent to peer. SPI:0xBF6E041B. IPSec key installed. Installed SA:   217.68.167.208[500]-212.122.61.23[500] SPI:0x993E8A98/0xB4BA9B3F lifetime   3600 Sec lifesize unlimited. IKE phase-2 negotiation is succeeded as   initiator, quick mode. Established SA: 217.68.167.208[500]-212.122.61.23[500]   message id:0x3C2F0929, SPI:0x993E8A98/0xB4BA9B3F. IKE phase-2 negotiation is started as   initiator, quick mode. Initiated SA: 217.68.167.208[500]-212.122.61.23[500]   message id:0x3C2F0929. IPSec key deleted. Deleted SA:   217.68.167.208[500]-212.122.61.23[500] SPI:0xF09CB8C7/0xFDD307C5. IKE protocol IPSec SA delete message   sent to peer. SPI:0xF09CB8C7. IPSec key installed. Installed SA:   217.68.167.208[500]-212.122.61.23[500] SPI:0xBF6E041B/0xCCA91B0D lifetime   3600 Sec lifesize unlimited. IKE phase-2 negotiation is succeeded as   initiator, quick mode. Established SA: 217.68.167.208[500]-212.122.61.23[500]   message id:0x921F14E7, SPI:0xBF6E041B/0xCCA91B0D. IKE phase-2 negotiation is started as   initiator, quick mode. Initiated SA: 217.68.167.208[500]-212.122.61.23[500]   message id:0x921F14E7. IPSec key deleted. Deleted SA:   217.68.167.208[500]-212.122.61.23[500] SPI:0xE56D34C4/0xBC5294AA. IKE protocol IPSec SA delete message   sent to peer. SPI:0xE56D34C4. IPSec key installed. Installed SA:   217.68.167.208[500]-212.122.61.23[500] SPI:0xF09CB8C7/0xFDD307C5 lifetime   3600 Sec lifesize unlimited. IKE phase-2 negotiation is succeeded as   initiator, quick mode. Established SA: 217.68.167.208[500]-212.122.61.23[500]   message id:0x593A6173, SPI:0xF09CB8C7/0xFDD307C5. IKE phase-2 negotiation is started as   initiator, quick mode. Initiated SA: 217.68.167.208[500]-212.122.61.23[500]   message id:0x593A6173. ... View more

Hallo, I configured a PA500 with Pan OS 4.1 wit the WAN interface as DHCP-Client and default route to this interface. In DNS-Proxy settings  I configured a DNS-Proxy with inherit source the wan if. Primary and secondary DNS is inherited and the dns proxy is aktivated for the internal interface. A firewall rule gives all users access to the dns-proxy for name resolution an the PA is allowed from wan to wan for dns. In traffic monitor I can see, that users gain acces to the dns proxy. But the PA want's to go out for dns resolution with the internal if. So I have to configure a rule to give the internal if access to external. Thats not practicible. At the and I hae to give 25 internal interfaces acces to external DNS. On a second appliance without DHCP on the WAN-interface it works like expected. The PA works realy as a proxy. User have acces to the PA for DNS and the PA gos out for DNS Requests wit his external interfaces. Regards Robert ... View more

Hallo, I installed a PA500 wit Pan OS 4.1 at customer side and most thing working fine. I configured the WAN interface as DHCP-Client with default route to this interface. In NAT-Rules i want to publish a internal server to give external sources acces to this internal source (simple portforwarding). My problem is, if I configure a destination translation, the PAN OS needs an address in the destination (not destination translation). A commit of a new rule set without a destination address fails. If i take my WAN-address as destination, everything works fine. Problem is that this IP changes from time to time. Is there the possibility to specify the interface or 'any' in this kind of use? Regards Robert ... View more