About Bart_Jocque

Bart_Jocque · ‎04-16-2013

Thanks emr, I found indeed the answer here : https://live.paloaltonetworks.com/docs/DOC-1528

Bart_Jocque · ‎04-16-2013

Yes indeed I was looking into the traffic logs. There is no url filtering on this box. Can someone of PA confirm that this is only working url filtering logs ?

Bart_Jocque · ‎04-16-2013

I still didn't manage to get this working in our lab infra : admin@lab01(active)> show system setting ctd state Notify user for APP block : no Alternative AHO : no Skip CTD : no Parse x-forwarded-for : yes Strip x-fwd-for : no Bloom Filter : yes HTTP Proxy Use Transaction : yes Enable Regex Statistics : no URL Category Query Timeout : 5 Bypass when exceeds queue limit: yes packets queued for packet capture: 5 whether to do packet capture after: yes max. loop for packets processing: 1024 Not to Block HTTP Range request: yes CTD ID : 1 CTD Allocator Usage : 92%(44 MB) AHO Allocator Usage : 87%(97 MB) Packet capture of a GET request: GET http://www.microsoft.com/ HTTP/1.1 Host: www.microsoft.com Pragma: no-cache Cache-Control: no-cache X-Forwarded-For: 10.255.224.130 Proxy-Connection: Keep-Alive X-BlueCoat-Via: 36967894f0722148 I have also enabled user-id on the incoming zone. That should be all to get thos working according to the DOC. What else could be wrong ?

Bart_Jocque · ‎02-05-2013

And as side question to this, how would Apple IOS clients be counterd, I guess as IPSEC clients ? So would this mean 2000max on 5020 ?

Bart_Jocque · ‎02-05-2013

In all the specifications sheets there is a different number listed for the concurrent SSLVPN and IPSECVPN supported clients. eg. on a 5020 2,000 IPSec VPN tunnels/tunnel interfaces 5,000 SSL VPN Users I find these number very confusing : Globalprotect uses both IPSEC and SSL ( IPSEC is preferred I was told). So my question, how many globalprotect clients are supported then on, for example , a 5020 ? 2000 or 5000 ?

Bart_Jocque · ‎01-30-2013

anyone ?

Bart_Jocque · ‎01-22-2013

With the command "set system setting ctd x-forwarded-for yes" the x-forwarded-for header is parsed to populate the source.user field in the logs. However, which exact header is actually being parsed with this command? Is it "x-forwarded-for" ? ( according to the CLI guide) Or is it "x-fwd-for" ? (according to the KB article) or both ? Can it be changed ? How ? Thanks, Bart

Bart_Jocque · ‎12-27-2012

I'll bet you are viewing logs of a certain vsys Systemlogs are not visible when you are viewing log of a vsys. ( I had the ame issue before, been there 😉 Be sure to to set vsys to "all" on the top of the monitor page. Kr, Bart.

Bart_Jocque · ‎11-15-2012

There are quite some bugs described under "support" / "case management" / "Articels" But I agree, this is not a real bug lookup tool...

Bart_Jocque · ‎11-14-2012

What are the details of the download job saying ? In CLI : show jobs all -> look for "Downld" jobs , note the job id , then : show jobs id xx

Bart_Jocque · ‎11-14-2012

Seeing this error as well since a long time on some panorama deployements My experience is that this is caused by ESX resource issues ( probably slow disk access) However, to be confirmed by your TAC.

Bart_Jocque · ‎11-14-2012

You can also search for the status of *current* bugs in the case management tool , if you have a support contract

Bart_Jocque · ‎11-14-2012

Monitor -> manage custom reports -> Create/edit report -> Time Frame : Custom

Bart_Jocque · ‎10-10-2012

What is this "XML tool" ? never heard of it. Can you share some details about this tool ?

Bart_Jocque · ‎10-10-2012

yep

Bart_Jocque · ‎10-10-2012

hmm, weird, not under my account...

Bart_Jocque · ‎10-10-2012

Just had the issue again on a 4050. We also had some weeks ago on a 2050. After pressing CTRL-C several times after the login prompt I had the message 'Cannot connect to management server' I then tried 'debug software restart management-server' -> no help. then issued the command request restart system -> OK ( but reboot of course, while HA unit took over) Opened a TAC case to obtain the 4.1.7 h2 hotfix. Wondering why they don't post this one on the website....

Bart_Jocque · ‎10-09-2012

Hi, I've tried to create a work-arround by adding a second captive portal , but this seems also not to be possible. Even a second VSYS will not help, captive portal settings are PER device and not PER vsys. So does this really mean that the only solution would be to buy additional box ?

Bart_Jocque · ‎09-27-2012

I also had unresponsive management (GUI, CLI and Serial) on the active box of a 2050-cluster just a few days after upgrading to 4.1.7. A reboot was the only solution. The issue did not occur yet any of our 4000 or 5000 clusters that where upgraded ot 4.1.7. Fingers crossed. Can I conclude that issue is only on the 2000 series ? Is it possible to restart the authd or mgmt service on the active unit via the CLI of the passive unit ? It woud be nice to have a techdoc from the TAC on this issue, which seems to impact lots of people ...

Bart_Jocque · ‎07-26-2012

Anyone ? Not possible ?

Bart_Jocque · ‎07-24-2012

Why would you create two VR's in the first place for a simple setup like this ? On the publicVR you would still require a route towards your internal network and on the defaultVR you still require a router towards the internet. So you will end up with two serial VR's with almost identical routing tables. I don't see how this would help you. You should just assign the ip 71.100.100.50/27 to your untrust interface and 71.100.100.193/27 to your DMZ interface. And have one VR. Bart.

Bart_Jocque · ‎07-24-2012

Hi, I have the following use case for a large customer : 1/ Captive portal authentication with client certificate profiles. 2/ When the client has no valid cert, an authentication fallback mechanism is required with username/password ( radius or kerberos) I know how to configure both authentication mechanisms seperate , but would it be possible to get them working in a "fallback" combined mode. The way I would configure this is with an "authentication sequence" containing both a "client certificate profile" and a "radius profile", but this does not seem to be possible. Anyone knows a workarround ? Thanks ! Bart

Bart_Jocque · ‎07-24-2012

There are no CLI questions as far I can remember.

Bart_Jocque · ‎01-06-2012

Maybe you try to make a data-filtering profile for the file-type mp3 ? - Edit - seems indeed that mp3 is not amongst the supported file-types. You could enter a feature request to add this file-type... Message was edited by: Bart.Jocque

Bart_Jocque · ‎01-06-2012

Hi, All userID setting are to be configured PER vsys. Kr, Bart

Bart_Jocque · ‎01-05-2012

configure set mgt-config users <admin-username> phash <password> commit

Bart_Jocque · ‎01-05-2012

I corrected the link in my first post.

Bart_Jocque · ‎01-05-2012

Hi, You will have to configure ssl decryption for this.

Bart_Jocque · ‎01-05-2012

You could also make a custom app for this by matching the domain in the context 'http-req-host-header'. This allows you the use full regex expressions ( full regex is not possible in custom URL filters )

Bart_Jocque · ‎01-05-2012

You will have to use an application for this. Services are limited to udp & tcp.

Date Registered	‎07-14-2011 07:04 AM
Date Last Visited	‎08-18-2015 09:07 AM
Total Messages Posted	75
Total Likes Received	19

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

Strata

Prisma

Cortex

About Bart_Jocque