About sspringer

sspringer · ‎12-08-2014

Hi, This should be possible in PanOS 6.0 - the following release notes describe a bug fix included in PanOS 6.0.0: 51091—Two-factor authentication (where both a client certificate profile and an authentication profile are configured) was not functioning as expected. The client was not required to provide the login credentials associated with the authentication profile after successfully authenticating with the client certificate Have you tested with Windows or Mac clients? maybe there is limitation with mobile clients.

sspringer · ‎08-09-2014

The only problems I have seen are related to time sync issues: - Mismatch time between client machine and the firewall(one of them had wrong time) - Firewall had misbehaving or incorrect NTP server configuration Could you provide more info on the configuration. Idle timer configuration? (default is 60 minutes) What type of account used?(superuser/adminrole/etc) Could you also provide more info on the sequence of actions prior to the problem. Does it happen shortly after user login? Is there a certain action that causes the logout to happen?(such as click on Device tab or perform log query) Some debug data that can be gathered: Enable the following debugs and then reproduce the issue -WebUI Debug: How to Run a PAN-OS Web UI Debug -Management Server Debug: > debug management-server on debug Collect the following files(or a tech support): > less mp-log ms.log > less mp-log appweb3-websrvr.log > less mp-log php.debug.log

sspringer · ‎07-08-2014

There are some drop counters.. flow_policy_deny 6 1 drop flow session Session setup: denied by policy flow_tcp_non_syn 1 0 info flow session Non-SYN TCP packets without session match flow_tcp_non_syn_drop 1 0 drop flow session Packets dropped: non-SYN TCP without session match flow_fwd_l3_mcast_drop 9 2 drop flow forward Packets dropped: no route for IP multicast flow_fwd_zonechange 1 0 drop flow forward Packets dropped: forwarded to different zone Could you configure a packet-filter based on the source and destination used for testing and collect new counters? > debug dataplane packet-diag set filter match source x.x.x.x destination y.y.y.y > debug dataplane packet-diag set filter on Then collect counters with packet-filter > show counter global name filter packet-filter yes delta yes *Note* the filter will only match new sessions, not sessions already present in session table

sspringer · ‎06-17-2014

Hello, The VM-Series Deployment Guide provides an alternative to enabling promiscuous mode for layer3 deployments. VM-Series Deployment Guide 6.0 (English) Virtualization_Admin_Guide_6.0 page 11(section Requirements): "If you are deploying the VM-Series firewall using layer 3 interfaces, you can instead set the vmNIC MAC address to match the PAN-OS MAC address by manually editing the MAC address for each vmNIC in vSphere to match what is assigned on the VM-Series firewall. This change must be done while the VM-Series is powered off; it allows the firewall to receive frames that are meant for it." Cheers, Stefan

sspringer · ‎05-29-2014

The GP client had a performance increase included in 1.2.9 for IPsec traffic. Perhaps you could give it a try?

sspringer · ‎04-01-2014

knarra1 is correct - This issue should be fixed in 6.0.2.

sspringer · ‎12-06-2013

Hi Esteban, The error you are receiving is normal when restarting the management server, it is indicating the management server has closed an existing socket. The management-server should still restart, this can be confirmed by checking if the PID has changed > show system resources | match mgmtsrvr 12043 20 0 368m 215m 10m S 2 8.6 1:06.76 mgmtsrvr After restart PID is now 18548 > show system resources | match mgmtsrvr 18548 20 0 368m 215m 10m S 0 8.6 1:00.22 mgmtsrvr Please note that once restarted, the management server can take some time to fully initialize. If ACC is still showing no results, you can tail the ms.log to see if any helpful messages are printed regarding ACC report generation. Here is some example output from clicking on ACC tab. Note that 'no results entry for report job id 36' is printed, this is due to no relevant logs(i.e. URL/Threat/Data Filtering) generated in timeframe for the ACC query. > tail follow yes mp-log ms.log Dec 06 11:01:12 report generation started for 'top-applications-summary' Dec 06 11:01:12 generating report for time from 1386345672 to 1386349271 Dec 06 11:01:12 report generation: query on type thsum started for 'top-attacks-acc' Dec 06 11:01:12 report generation: vectorization started for 'top-attacks-acc' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-attacks-acc' Dec 06 11:01:12 report generation: sorting started for 'top-attacks-acc' Dec 06 11:01:12 report generation: sorting ended for 'top-attacks-acc' Dec 06 11:01:12 report generation: query on type trsum started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: vectorization started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: sorting started for 'top-url-categories-summary' Dec 06 11:01:12 report generation: sorting ended for 'top-url-categories-summary' Dec 06 11:01:12 report generation: query on type appstat started for 'top-applications-summary' Dec 06 11:01:12 report generation: vectorization started for 'top-applications-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'top-applications-summary' Dec 06 11:01:12 report generation: sorting started for 'top-applications-summary' Dec 06 11:01:12 report generation: sorting ended for 'top-applications-summary' Dec 06 11:01:12 report generation started for 'acc-summary' Dec 06 11:01:12 generating report for time from 1386345672 to 1386349271 Dec 06 11:01:12 report generation: query on type appstat started for 'acc-summary' Dec 06 11:01:12 report generation: vectorization started for 'acc-summary' Dec 06 11:01:12 report generation: pre-sort-hook started for 'acc-summary' Dec 06 11:01:12 report generation: sorting started for 'acc-summary' Dec 06 11:01:12 report generation: sorting ended for 'acc-summary' Dec 06 11:01:13 Error: pan_reportjobmgr_print_report(pan_report_mgr.c:2425): no results entry for report job id 36 Dec 06 11:01:13 Error: pan_mgmtop_show_report(pan_ops_common.c:1911): Unable to find report

sspringer · ‎11-23-2013

As long as the session transferring the ZIP has Layer 7 processing enabled, the zip will get decompressed and the PE file will match the File Blocking profile. It is NOT required to configure File Blocking profile to include ZIP file type.

sspringer · ‎10-24-2013

I believe that ACC would help in this effort. Has that provided more information?

sspringer · ‎09-18-2013

Hi Bob, I was able to get your desired behavior by configuring the URL Filtering Profile on the security rule to have 'myCustomCategory' set to action 'none'. -Stefan

sspringer · ‎08-20-2013

The PanOS images will actually be downloaded to '/opt/panrepo' partition. This can be confirmed by downloading a software release, checking disk-space, and then deleting the release: > request system software download version 5.0.4 > show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda3 1.9G 1.4G 501M 73% / /dev/sda5 6.6G 3.3G 3.0G 53% /opt/pancfg /dev/sda6 1.9G 1.3G 581M 69% /opt/panrepo tmpfs 1.3G 67M 1.2G 6% /dev/shm /dev/sda8 2.4G 1.8G 498M 79% /opt/panlogs > delete software version 5.0.4 > show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda3 1.9G 1.4G 501M 73% / /dev/sda5 6.6G 3.3G 3.0G 53% /opt/pancfg /dev/sda6 1.9G 1.1G 766M 59% /opt/panrepo tmpfs 1.3G 67M 1.2G 6% /dev/shm /dev/sda8 2.4G 1.8G 498M 79% /opt/panlogs Notice panrepo changes by 185MB which is roughly same size as the image file. The size for panrepo partition itself will vary for each platform.

sspringer · ‎07-30-2013

Hi Robert, There is no documented process for starting a script after successful connection with GlobalProtect. I was able to find a feature request open to add support for this very feature. Please contact your Account Team and request them to vote on FR ID: 1580 on your behalf. That said, we do have the DevCenter which is a dedicated place for sharing scripts and tools - you may get some better feedback and ideas. Perhaps one way to accomplish the same goal, have the batch script monitor an IP address only reachable over GlobalProtect, once ICMP replies are received then run desired command. Although, I am not a Windows guru and there could be unforeseen fallout for such a script. Cheers, Stefan

sspringer · ‎07-24-2013

Hello, J-PAKE is not enabled in PanOS implementation of SSH. -Stefan

sspringer · ‎05-31-2013

Hi, Can you check to see if any of the URL Filtering profiles on the firewall have 'Dynamic Url' unchecked? If so, this could be the cause. If using Dynamic URL lookup(brightcloud-cloud) then it is recommended to enable Dynamic URL on ALL URL Filtering profiles used in security policy. Once changed, it will be required to clear the DP url cache to trigger the new categorization. > clear url-cache all -Stefan

sspringer · ‎04-20-2013

Hi, What version of PanOS are you running? There have been a few issues removing users from locked list. The fixes are described in the release notes (bug 43665, 44805, 47387) with the most recent is fix in 4.1.12/5.0.3. Do you have the same issue with all browsers(IE/Chrome/Firefox)? If the user is locked out of GP Gateway they can be cleared from CLI: > request global-protect-gateway unlock - Stefan

Member Since	‎07-19-2011 01:07 PM
Date Last Visited	‎03-22-2021 09:20 PM
Posts	133
Total Likes Received	50

Online Status	Offline
Date Last Visited	‎03-22-2021 09:20 PM

About sspringer

Re: Is there a way to tie the Cert auth to AD username for AD auth?

Re: Mgmt webgui kicks me out since panos 6.0

Re: Slow Performanced Based on Order of ACL Rules

Re: VM series promiscuous issue?

Re: GlobalProtect slowness

Re: request restart software

Re: Difference between apps and contents

Re: How to Fix - Error in getting locked users?

Re: does session drop when changing VR?

Re: SSL-VPN Portal not showing

Re: SSL Decryption Firefox issue

Re: VM series promiscuous issue?

Re: WildFire - Confidentiality Concerns?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Re: How to use Wildfire for Android APK

Re: Is there a way to tie the Cert auth to AD username for AD auth?

Re: Mgmt webgui kicks me out since panos 6.0

Re: Slow Performanced Based on Order of ACL Rules

Re: VM series promiscuous issue?

Re: GlobalProtect slowness

Re: Can't clear session from CLI

Re: Web Management DOWN?

Re: Wildfire & ZIP files

Re: how can I get entire session table?

Re: Custom URL category - URL filtering logs displays which category?

Re: In what partition is PANOS stored?

Re: GlobalProtect client pre-/post-connect commands?

Re: Qualys Scan alert on OpenSSH J-Pake

Re: URL resolving to unknown while know on brightcloud

Re: Locked user list

Network Security

Cloud Security

Security Operations

About sspringer