About sspringer

sspringer · ‎12-08-2014

Hi, This should be possible in PanOS 6.0 - the following release notes describe a bug fix included in PanOS 6.0.0: 51091—Two-factor authentication (where both a client certificate profile and an authentication profile are configured) was not functioning as expected. The client was not required to provide the login credentials associated with the authentication profile after successfully authenticating with the client certificate Have you tested with Windows or Mac clients? maybe there is limitation with mobile clients.

sspringer · ‎08-09-2014

The only problems I have seen are related to time sync issues: - Mismatch time between client machine and the firewall(one of them had wrong time) - Firewall had misbehaving or incorrect NTP server configuration Could you provide more info on the configuration. Idle timer configuration? (default is 60 minutes) What type of account used?(superuser/adminrole/etc) Could you also provide more info on the sequence of actions prior to the problem. Does it happen shortly after user login? Is there a certain action that causes the logout to happen?(such as click on Device tab or perform log query) Some debug data that can be gathered: Enable the following debugs and then reproduce the issue -WebUI Debug: How to Run a PAN-OS Web UI Debug -Management Server Debug: > debug management-server on debug Collect the following files(or a tech support): > less mp-log ms.log > less mp-log appweb3-websrvr.log > less mp-log php.debug.log

sspringer · ‎07-08-2014

There are some drop counters.. flow_policy_deny 6 1 drop flow session Session setup: denied by policy flow_tcp_non_syn 1 0 info flow session Non-SYN TCP packets without session match flow_tcp_non_syn_drop 1 0 drop flow session Packets dropped: non-SYN TCP without session match flow_fwd_l3_mcast_drop 9 2 drop flow forward Packets dropped: no route for IP multicast flow_fwd_zonechange 1 0 drop flow forward Packets dropped: forwarded to different zone Could you configure a packet-filter based on the source and destination used for testing and collect new counters? > debug dataplane packet-diag set filter match source x.x.x.x destination y.y.y.y > debug dataplane packet-diag set filter on Then collect counters with packet-filter > show counter global name filter packet-filter yes delta yes *Note* the filter will only match new sessions, not sessions already present in session table

sspringer · ‎06-17-2014

Hello, The VM-Series Deployment Guide provides an alternative to enabling promiscuous mode for layer3 deployments. VM-Series Deployment Guide 6.0 (English) Virtualization_Admin_Guide_6.0 page 11(section Requirements): "If you are deploying the VM-Series firewall using layer 3 interfaces, you can instead set the vmNIC MAC address to match the PAN-OS MAC address by manually editing the MAC address for each vmNIC in vSphere to match what is assigned on the VM-Series firewall. This change must be done while the VM-Series is powered off; it allows the firewall to receive frames that are meant for it." Cheers, Stefan

sspringer · ‎05-29-2014

The GP client had a performance increase included in 1.2.9 for IPsec traffic. Perhaps you could give it a try?

sspringer · ‎04-01-2014

knarra1 is correct - This issue should be fixed in 6.0.2.

sspringer · ‎12-06-2013

Hi Esteban, The error you are receiving is normal when restarting the management server, it is indicating the management server has closed an existing socket. The management-server should still restart, this can be confirmed by checking if the PID has changed > show system resources | match mgmtsrvr 12043 20 0 368m 215m 10m S 2 8.6 1:06.76 mgmtsrvr After restart PID is now 18548 > show system resources | match mgmtsrvr 18548 20 0 368m 215m 10m S 0 8.6 1:00.22 mgmtsrvr Please note that once restarted, the management server can take some time to fully initialize. If ACC is still showing no results, you can tail the ms.log to see if any helpful messages are printed regarding ACC report generation. Here is some example output from clicking on ACC tab. Note that 'no results entry for report job id 36' is printed, this is due to no relevant logs(i.e. URL/Threat/Data Filtering) generated in timeframe for the ACC query. > tail follow yes mp-log ms.log Dec 06 11:01:12 report generation started for 'top-applications-summary' Dec 06 11:01:12 generating report for time from 1386345672 to 1386349271 Dec 06 11:01:12 report generation: query on type thsum started for 'top-attacks-acc' Dec 06 11:01:12 report generation: vectorization started for 'top-attacks-acc' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-attacks-acc' Dec 06 11:01:12 report generation: sorting started for 'top-attacks-acc' Dec 06 11:01:12 report generation: sorting ended for 'top-attacks-acc' Dec 06 11:01:12 report generation: query on type trsum started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: vectorization started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: sorting started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: sorting ended for 'top-url-categories-summary' Dec 06 11:01:12 report generation: query on type appstat started for 'top-applications-summary' Dec 06 11:01:12 report generation: vectorization started for 'top-applications-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-applications-summary' Dec 06 11:01:12 report generation: sorting started for 'top-applications-summary' Dec 06 11:01:12 report generation: sorting ended for 'top-applications-summary' Dec 06 11:01:12 report generation started for 'acc-summary' Dec 06 11:01:12 generating report for time from 1386345672 to 1386349271 Dec 06 11:01:12 report generation: query on type appstat started for 'acc-summary' Dec 06 11:01:12 report generation: vectorization started for 'acc-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'acc-summary' Dec 06 11:01:12 report generation: sorting started for 'acc-summary' Dec 06 11:01:12 report generation: sorting ended for 'acc-summary' Dec 06 11:01:13 Error: pan_reportjobmgr_print_report(pan_report_mgr.c:2425): no results entry for report job id 36 Dec 06 11:01:13 Error: pan_mgmtop_show_report(pan_ops_common.c:1911): Unable to find report

sspringer · ‎11-23-2013

As long as the session transferring the ZIP has Layer 7 processing enabled, the zip will get decompressed and the PE file will match the File Blocking profile. It is NOT required to configure File Blocking profile to include ZIP file type.

sspringer · ‎10-24-2013

I believe that ACC would help in this effort. Has that provided more information?

sspringer · ‎09-18-2013

Hi Bob, I was able to get your desired behavior by configuring the URL Filtering Profile on the security rule to have 'myCustomCategory' set to action 'none'. -Stefan

sspringer · ‎08-20-2013

The PanOS images will actually be downloaded to '/opt/panrepo' partition. This can be confirmed by downloading a software release, checking disk-space, and then deleting the release: > request system software download version 5.0.4 > show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda3 1.9G 1.4G 501M 73% / /dev/sda5 6.6G 3.3G 3.0G 53% /opt/pancfg /dev/sda6 1.9G 1.3G 581M 69% /opt/panrepo tmpfs 1.3G 67M 1.2G 6% /dev/shm /dev/sda8 2.4G 1.8G 498M 79% /opt/panlogs > delete software version 5.0.4 > show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda3 1.9G 1.4G 501M 73% / /dev/sda5 6.6G 3.3G 3.0G 53% /opt/pancfg /dev/sda6 1.9G 1.1G 766M 59% /opt/panrepo tmpfs 1.3G 67M 1.2G 6% /dev/shm /dev/sda8 2.4G 1.8G 498M 79% /opt/panlogs Notice panrepo changes by 185MB which is roughly same size as the image file. The size for panrepo partition itself will vary for each platform.

sspringer · ‎07-30-2013

Hi Robert, There is no documented process for starting a script after successful connection with GlobalProtect. I was able to find a feature request open to add support for this very feature. Please contact your Account Team and request them to vote on FR ID: 1580 on your behalf. That said, we do have the DevCenter which is a dedicated place for sharing scripts and tools - you may get some better feedback and ideas. Perhaps one way to accomplish the same goal, have the batch script monitor an IP address only reachable over GlobalProtect, once ICMP replies are received then run desired command. Although, I am not a Windows guru and there could be unforeseen fallout for such a script. Cheers, Stefan

sspringer · ‎07-24-2013

Hello, J-PAKE is not enabled in PanOS implementation of SSH. -Stefan

sspringer · ‎05-31-2013

Hi, Can you check to see if any of the URL Filtering profiles on the firewall have 'Dynamic Url' unchecked? If so, this could be the cause. If using Dynamic URL lookup(brightcloud-cloud) then it is recommended to enable Dynamic URL on ALL URL Filtering profiles used in security policy. Once changed, it will be required to clear the DP url cache to trigger the new categorization. > clear url-cache all -Stefan

sspringer · ‎04-20-2013

Hi, What version of PanOS are you running? There have been a few issues removing users from locked list. The fixes are described in the release notes (bug 43665, 44805, 47387) with the most recent is fix in 4.1.12/5.0.3. Do you have the same issue with all browsers(IE/Chrome/Firefox)? If the user is locked out of GP Gateway they can be cleared from CLI: > request global-protect-gateway unlock - Stefan

sspringer · ‎02-08-2013

Hello, The release notes will contain a section 'Addressed Issues' that will list customer found problems. Release Notes can be found Support site -> Software Updates or in the Device WebUI(Device->Software). Here are a couple of bugs fixed in 4.1.7 related to block-ip: 41427 – On platforms that contain multiple data planes, aggregate DoS protection rules do not properly enforce block IP actions if the session is hosted by a dataplane other than dataplane zero. 41331 – On platforms that contain multiple dataplanes, block IP actions using custom vulnerability definitions are not enforced properly unless the session is being processed by dataplane zero. Hope this helps, Stefan

sspringer · ‎01-29-2013

Hi Gerold, I am not aware of a way to export the log view information from the API. Beginning in PanOS 5.0 the logs can be exported via API with 'type=log&log-type=traffic', then the xml returned could be transformed into csv. If you are using pre 5.0, perhaps you could utilize the 'scp export log traffic' option. Here is an example: scp export log traffic start-time equal 2013/01/12@00:00:00 end-time equal 2013/01/26@00:00:00 to root@172.18.32.143:/root/logbackup/logger.csv - Stefan

sspringer · ‎01-29-2013

Hello, The logs exported with 'scp export logdb' are stored using custom compression to help achieve efficient storage. While the logs cannot be viewed, the db can be imported into another PanOS system. If it is required to export the logs and view them, I would recommend using the 'scp export log traffic' option. Alternatively, you could use the XML API to retrieve the logs in xml form. For more information on API(Section 2.8 Retrieving Logs): Cheers, Stefan

sspringer · ‎01-28-2013

As you have found there is not an available column for 'Receive Time'. One possible workaround is to create a custom report using traffic logdb and then use 'Log View' in the report group. Here is a sample config: A email scheduler profile can be configured to send report-group off the device. This may not be ideal, but it should show the timestamp in the generated report pdf. -Stefan

sspringer · ‎01-26-2013

I was able to export the entire logdb on 5.0.2 successfully with the following command: > scp export logdb to root@172.18.32.143:/root/logbackup/firewall-logs.tgz Alternatively you can export each log type in csv format: > scp export log traffic start-time equal 2013/01/12@00:00:00 end-time equal 2013/01/26@00:00:00 to root@172.18.32.143:/root/logbackup/logger.csv root@172.18.32.143's password: Marking log as exported successfully... The downside to csv export is that a start and end time must be specified. You can view the oldest log for each log type with command: > show log traffic direction equal forward Time App From Src Port Source Rule Action To Dst Port Destination Src User Dst User =============================================================================== 2013/01/13 14:10:55 web-browsing l3-trust 64728 172.18.39.146 webtraffic allow l3-dmz 8080 172.18.38.141 - Stefan

sspringer · ‎01-25-2013

Hi, The purging mechanism works as follows. The quota is checked each time a logdb file is rotated. If the quota threshold is violated then we start deleting logs starting from the oldest until the threshold is no longer exceeded. To see how often the logdb file is rotating, you can review the ms.log file for the following entry "Initing log file with version". To answer the logdb export question: There is an option to export logs via ftp found in Device -> Scheduled Log Export I hope this helps clear any doubts. Please let me know if I can help clarify further. Cheers, Stefan

sspringer · ‎01-16-2013

To add to Numan's comment: By default the firewall will come with the access to the application package: panupv2-all-apps-350-1658 However, the Threat Prevention license is required to install the content package: panupv2-all-contents-350-165 The content package contains the same information in the application package + anti-spyware and vulnerability protection signatures. -Stefan

sspringer · ‎01-16-2013

Captive Portal was not designed for Internet -> Internal use so there could be some problems trying to implement it this way. One particular caveat, it is required to enable User-ID on the 'Internet' or 'External' zone. If you have User-ID Agent configured, this could flood the agent with the list of unknown IP addresses. I would recommend deploying this configuration only if the 'Internet' or 'External' zone is controlled and not publicly accessible. If you decide to move forward with this deployment, it would be advisable to involve your Sales team so they are familiar in case issues arise. Here is Tech Note on some specifics of User-ID: https://live.paloaltonetworks.com/docs/DOC-1807 -Stefan

sspringer · ‎12-07-2012

Hello, There is no way to export from device itself. The only methods of obtaining PAN-OS image - Download via Device -> Software - Deploy via Panorama - Manually download from your support portal account(support.paloaltonetworks.com) Software Updates section Cheers, Stefan

sspringer · ‎11-29-2012

There has been a issue identified on Panorama 4.1.9 when changing from device context to Panorama context the error 'Could not call showSessionVars.esp'. A fix is being verified for a future release(likely 4.1.10). PANOS versions 4.1.8-h3 and 5.0 are not impacted by this bug.

sspringer · ‎10-29-2012

Since you are running latest release, I would recommend collecting debug data previously mentioned and opening a case with support. It would help the investigation to have details on how to reproduce the error. - Stefan

sspringer · ‎10-28-2012

Hello, There have been a few reports of this error happening on older code. It seems that it may be related to slow context switching. What version of Panorama was the error received on? There have been improvements in context switching in 4.1.5. Are you able to reproduce the error upon a certain action? If you can reproduce, I would recommend gathering a webui debug and opening a case with support: - Stefan

sspringer · ‎10-26-2012

Hi EdwinD, We have been able to successfully pull members of the 'Domain Users' using 4.1.7. Perhaps the issue is unique to your environment. In order to force a full group membership refresh(as opposed to incremental), the following command can be run: > debug user-id reset group-mapping all Please open a case with support for further investigation if you haven't already done so. - Stefan

sspringer · ‎10-18-2012

Hi, Can you ensure you are logged in as Superuser? If you are receiving the error while logged in as Superuser then there may be problem with underlying database. You can search through the authd.log for keywords such as "corrupt", "dirty" or "malformed" that may point to problem with database. In addition to reviewing authd.log, the ms.log may contain some helpful messages. It is also possible more information could be gathered from WebUI debug() - this may give insight if there is problem with message format sent/received to the management server. PANOS 4.0.4 is fairly old and there have been many addressed issues relating to authd, including the bug already mentioned. In general we recommend to run no later than 2-3 maintenance releases behind the current release. - Stefan

sspringer · ‎10-18-2012

Using port 5007 should be fine. A common mistake when using port 389 is to forget to uncheck 'SSL'. Since ldap port 389 does not use ssl, please verify that 'SSL' is unchecked. Hope this helps. -Stefan

Date Registered	‎07-19-2011 01:07 PM
Date Last Visited	‎08-21-2020 12:52 PM
Total Messages Posted	133
Total Likes Received	50

Online Status	Offline
Date Last Visited	‎08-21-2020 12:52 PM

Strata

Prisma

Cortex

About sspringer