This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About sspringer
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About sspringer
06-24-2022
133Posts
50Likes
23Solutions
Jun 24, 2022Last Visited
User
Activity
User
Profile
Latest posts by sspringer
| Subject | Views | Posted |
|---|---|---|
| 1869 | 12-08-2014 09:12 PM | |
| 2565 | 08-09-2014 06:14 PM | |
| 1724 | 07-08-2014 09:18 AM | |
| 3360 | 06-17-2014 11:50 AM | |
| 4420 | 05-29-2014 06:43 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 06-11-2012 10:33 AM | |
| 2 Likes | 01-16-2013 10:31 AM | |
| 2 Likes | 10-18-2012 05:22 PM | |
| 1 Like | 11-26-2011 07:51 PM | |
| 1 Like | 03-30-2012 06:12 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 4 Likes | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 07-19-2011 01:07 PM |
| Date Last Visited | 06-24-2022 04:11 PM |
| Posts | 133 |
| Total Likes Received | 50 |
12-08-2014
09:12 PM
1 Kudo
Hi, This should be possible in PanOS 6.0 - the following release notes describe a bug fix included in PanOS 6.0.0: 51091—Two-factor authentication (where both a client certificate profile and an authentication profile are configured) was not functioning as expected. The client was not required to provide the login credentials associated with the authentication profile after successfully authenticating with the client certificate Have you tested with Windows or Mac clients? maybe there is limitation with mobile clients.
... View more
08-09-2014
06:14 PM
The only problems I have seen are related to time sync issues: - Mismatch time between client machine and the firewall(one of them had wrong time) - Firewall had misbehaving or incorrect NTP server configuration Could you provide more info on the configuration. Idle timer configuration? (default is 60 minutes) What type of account used?(superuser/adminrole/etc) Could you also provide more info on the sequence of actions prior to the problem. Does it happen shortly after user login? Is there a certain action that causes the logout to happen?(such as click on Device tab or perform log query) Some debug data that can be gathered: Enable the following debugs and then reproduce the issue -WebUI Debug: How to Run a PAN-OS Web UI Debug -Management Server Debug: > debug management-server on debug Collect the following files(or a tech support): > less mp-log ms.log > less mp-log appweb3-websrvr.log > less mp-log php.debug.log
... View more
07-08-2014
09:18 AM
There are some drop counters.. flow_policy_deny 6 1 drop flow session Session setup: denied by policy flow_tcp_non_syn 1 0 info flow session Non-SYN TCP packets without session match flow_tcp_non_syn_drop 1 0 drop flow session Packets dropped: non-SYN TCP without session match flow_fwd_l3_mcast_drop 9 2 drop flow forward Packets dropped: no route for IP multicast flow_fwd_zonechange 1 0 drop flow forward Packets dropped: forwarded to different zone Could you configure a packet-filter based on the source and destination used for testing and collect new counters? > debug dataplane packet-diag set filter match source x.x.x.x destination y.y.y.y > debug dataplane packet-diag set filter on Then collect counters with packet-filter > show counter global name filter packet-filter yes delta yes *Note* the filter will only match new sessions, not sessions already present in session table
... View more
06-17-2014
11:50 AM
Hello, The VM-Series Deployment Guide provides an alternative to enabling promiscuous mode for layer3 deployments. VM-Series Deployment Guide 6.0 (English) Virtualization_Admin_Guide_6.0 page 11(section Requirements): "If you are deploying the VM-Series firewall using layer 3 interfaces, you can instead set the vmNIC MAC address to match the PAN-OS MAC address by manually editing the MAC address for each vmNIC in vSphere to match what is assigned on the VM-Series firewall. This change must be done while the VM-Series is powered off; it allows the firewall to receive frames that are meant for it." Cheers, Stefan
... View more
05-29-2014
06:43 PM
2 Kudos
The GP client had a performance increase included in 1.2.9 for IPsec traffic. Perhaps you could give it a try?
... View more
12-06-2013
09:06 AM
1 Kudo
Hi Esteban, The error you are receiving is normal when restarting the management server, it is indicating the management server has closed an existing socket. The management-server should still restart, this can be confirmed by checking if the PID has changed > show system resources | match mgmtsrvr 12043 20 0 368m 215m 10m S 2 8.6 1:06.76 mgmtsrvr After restart PID is now 18548 > show system resources | match mgmtsrvr 18548 20 0 368m 215m 10m S 0 8.6 1:00.22 mgmtsrvr Please note that once restarted, the management server can take some time to fully initialize. If ACC is still showing no results, you can tail the ms.log to see if any helpful messages are printed regarding ACC report generation. Here is some example output from clicking on ACC tab. Note that 'no results entry for report job id 36' is printed, this is due to no relevant logs(i.e. URL/Threat/Data Filtering) generated in timeframe for the ACC query. > tail follow yes mp-log ms.log Dec 06 11:01:12 report generation started for 'top-applications-summary' Dec 06 11:01:12 generating report for time from 1386345672 to 1386349271 Dec 06 11:01:12 report generation: query on type thsum started for 'top-attacks-acc' Dec 06 11:01:12 report generation: vectorization started for 'top-attacks-acc' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-attacks-acc' Dec 06 11:01:12 report generation: sorting started for 'top-attacks-acc' Dec 06 11:01:12 report generation: sorting ended for 'top-attacks-acc' Dec 06 11:01:12 report generation: query on type trsum started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: vectorization started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: sorting started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: sorting ended for 'top-url-categories-summary' Dec 06 11:01:12 report generation: query on type appstat started for 'top-applications-summary' Dec 06 11:01:12 report generation: vectorization started for 'top-applications-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-applications-summary' Dec 06 11:01:12 report generation: sorting started for 'top-applications-summary' Dec 06 11:01:12 report generation: sorting ended for 'top-applications-summary' Dec 06 11:01:12 report generation started for 'acc-summary' Dec 06 11:01:12 generating report for time from 1386345672 to 1386349271 Dec 06 11:01:12 report generation: query on type appstat started for 'acc-summary' Dec 06 11:01:12 report generation: vectorization started for 'acc-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'acc-summary' Dec 06 11:01:12 report generation: sorting started for 'acc-summary' Dec 06 11:01:12 report generation: sorting ended for 'acc-summary' Dec 06 11:01:13 Error: pan_reportjobmgr_print_report(pan_report_mgr.c:2425): no results entry for report job id 36 Dec 06 11:01:13 Error: pan_mgmtop_show_report(pan_ops_common.c:1911): Unable to find report
... View more
11-23-2013
11:30 AM
As long as the session transferring the ZIP has Layer 7 processing enabled, the zip will get decompressed and the PE file will match the File Blocking profile. It is NOT required to configure File Blocking profile to include ZIP file type.
... View more
10-24-2013
05:26 PM
I believe that ACC would help in this effort. Has that provided more information?
... View more
09-18-2013
05:21 PM
Hi Bob, I was able to get your desired behavior by configuring the URL Filtering Profile on the security rule to have 'myCustomCategory' set to action 'none'. -Stefan
... View more
08-20-2013
01:21 PM
3 Kudos
The PanOS images will actually be downloaded to '/opt/panrepo' partition. This can be confirmed by downloading a software release, checking disk-space, and then deleting the release: > request system software download version 5.0.4 > show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda3 1.9G 1.4G 501M 73% / /dev/sda5 6.6G 3.3G 3.0G 53% /opt/pancfg /dev/sda6 1.9G 1.3G 581M 69% /opt/panrepo tmpfs 1.3G 67M 1.2G 6% /dev/shm /dev/sda8 2.4G 1.8G 498M 79% /opt/panlogs > delete software version 5.0.4 > show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda3 1.9G 1.4G 501M 73% / /dev/sda5 6.6G 3.3G 3.0G 53% /opt/pancfg /dev/sda6 1.9G 1.1G 766M 59% /opt/panrepo tmpfs 1.3G 67M 1.2G 6% /dev/shm /dev/sda8 2.4G 1.8G 498M 79% /opt/panlogs Notice panrepo changes by 185MB which is roughly same size as the image file. The size for panrepo partition itself will vary for each platform.
... View more
07-30-2013
09:17 AM
2 Kudos
Hi Robert, There is no documented process for starting a script after successful connection with GlobalProtect. I was able to find a feature request open to add support for this very feature. Please contact your Account Team and request them to vote on FR ID: 1580 on your behalf. That said, we do have the DevCenter which is a dedicated place for sharing scripts and tools - you may get some better feedback and ideas. Perhaps one way to accomplish the same goal, have the batch script monitor an IP address only reachable over GlobalProtect, once ICMP replies are received then run desired command. Although, I am not a Windows guru and there could be unforeseen fallout for such a script. Cheers, Stefan
... View more
07-24-2013
09:22 AM
1 Kudo
Hello, J-PAKE is not enabled in PanOS implementation of SSH. -Stefan
... View more
05-31-2013
12:59 PM
1 Kudo
Hi, Can you check to see if any of the URL Filtering profiles on the firewall have 'Dynamic Url' unchecked? If so, this could be the cause. If using Dynamic URL lookup(brightcloud-cloud) then it is recommended to enable Dynamic URL on ALL URL Filtering profiles used in security policy. Once changed, it will be required to clear the DP url cache to trigger the new categorization. > clear url-cache all -Stefan
... View more
04-20-2013
09:17 AM
Hi, What version of PanOS are you running? There have been a few issues removing users from locked list. The fixes are described in the release notes (bug 43665, 44805, 47387) with the most recent is fix in 4.1.12/5.0.3. Do you have the same issue with all browsers(IE/Chrome/Firefox)? If the user is locked out of GP Gateway they can be cleared from CLI: > request global-protect-gateway unlock - Stefan
... View more
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks