About akhan

Hi Thiago, The answer to your question is YES.  If panorma was to stop working, you can still manage the firewall from the firewall's own web interface. Thanks, Ahsan ... View more

Hi, Please contact your local PAN Sales Representative to submit a Feature Request. Thanks, Ahsan ... View more

Hi Kal, If the certificate is in .crt format, that means its already in PEM format.  PEM certificates usually have extensions such as .pem and .crt.  Since its in .crt, I beleive you only have the certificate and not its associated key.  You can confirm by opening the .crt file in notepad.  If you only see characters dilineated by -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----, that means that this is just the certificate.  To import PEM format certificate, we require the associated key file also.  Normally the certificate and its key are both in the same file in .pem certificates.  The key part is dilineated by ------BEGIN RSA PRIVATE KEY----- and ------END RSA PRIVATE KEY-----. Here is what you need to do: - Go back to the IIS server and re-export the certificate in .pfx format (pkcs12) You now have 2 options. 1. Import the .pfx file as it is into PAN by chossing the pkcs12 format during import. 2. Convert the .pfx into .pem and then import the .pem certificate onto PAN.  The following doument describes option 2 towards the end of the document: https://live.paloaltonetworks.com/docs/DOC-1223 Thanks, Ahsan ... View more

Hi Kalyanram, A few questions here: 1. What format is your certificate in? (.pfx, .pem? ) 2. When trying to import the certificate onto PAN, what file format have you chosen on PAN? Thanks, Ahsan ... View more

Since the client can ping the server, this does not seem to be a routing issue.  This could be a security policy issue.  Do you have a security policy that allows pings from the server to the client?  Also, try the following: 1. Start a continuous ping from the server to the client. 2. Open a CLI session to PAN and run the following: > show session all filter source <server-ip> destination <client-ip> You should see some ping sessions here.  Are they in the ACTIVE state or DISCARD state?  If you see sessions in ACTIVE state, try disabling the windows firewall on the client if not already disabled. Thanks, Ahsan ... View more

Hi, From the error messages: it seems that when using the address 10.2.69.100 in your polcies, you have added an extra whitespace.  Hence the address is read  as '10.2.69.100 ' instead of '10.2.69.100' (notice the space at the end of the ip address).  Try removing the whitespace and then do a commit. Thanks, Ahsan ... View more

Hi Robert, By default, PAN will only generate logs for traffic that matches a defined security policy.  If traffic from one zone to another is not explicity allowed by a security policy,  it is blocked by an implicit deny policy (not visible in security policies) and these denys will not be logged in the traffic logs.  For troubleshooting purposes, we can setup a cleanup rule to log traffic that would be implicitly denied. The cleanup rule would look like: Source Zone: Trusted Source Address: any Destination: Untrusted Destination Address: any Application: any Service: any Action: Deny Make sure that the cleanup rule is at the bottom of your security policies.  Security policies are read from Top to Bottom. - Once changes have been committed, you can check the traffic logs under Monitor-> Logs-> Traffic.  From there you can click on the source IP address and filter the logs based on it.  This would show us if any traffic from the Aspera client is being denied.  You can then modify the security policies to allow the traffic being denied. Thanks, Ahsan ... View more

Hi Robert, You configurations look fine.  You might want to configure a clean-up (src zone: trust, dst zone: untrust, action deny) rule at the bottom of your security policies in order to determine what traffic is being blocked by PAN.  You can then filter the traffic logs based on your Source IP address to check if anything is being blocked.  I would also suggest checking your URL filtering logs and threat logs to make sure nothing is being denied there. Thanks, Ahsan ... View more

Hi Robert, From the description of the error message, it seems that the control connection over TCP is established, but the data connection, using UDP 33001 cannot be   established.  To resolve this, you first need to create a service under Objects -> Services.  Create a service called "Aspera" for protocol UDP and destination port 33001 (do not define a source port as it will probably be random). Then create a security rule under Policies -> Security like the following: Source Zone: Trusted Source Address: Define private source addresses you wish to allow through the firewall or set to "any" to allow everyone. Destination: Untrusted Destination Address: Any, or a specific Aspera IP address(s) if known. Application: any Service: Aspera Action: Allow This rule should be placed above your deny rules. Thanks, Ahsan ... View more

Hi Bob, To answer your question of why "Source Zone: Internet , Destination Zone: Internet"?  Such a NAT policy would be defined to allow traffic from your Internet Zone to a server on one of your Internal Zones.  NAT policies are created with the pre-NAT IP addresses in mind.  In other words, when configuring NAT rules, we think of how PAN sees the incoming packet before NAT is applied.  Since the source IP will be a random public IP in most cases, PAN knows that public IP addresses are situated on the Internet Zone (because the default route would be pointing out the Internet Zone interface).  Hence we select Internet as the source zone.  For destination zone, when a packet comes in, the destination IP address would also be a public IP address.  Hence we select Internet zone again as the destination zone keeping in mind that before NAT is applied, the destination IP address belongs to the Internet zone interface. You can refer to the following document for how NAT is setup on PAN: Example #2 illustrates to to configure NAT for an internal server.  Again the point to remember when configuring NAT rules is: Consider where the pre-NAT ip-addresses are situated with respect to PAN. Thanks, Ahsan ... View more

Hi Michael, To map the Mail Server Private IP: y.y.y.50/32 to the Mail Server Public IP: x.x.x.12/32, you bi-directional NAT configurations should look like this: NAT_Policy_1 Orginal Packet Source Zone: trusted Original Packet Destination Zone: untrusted Original Packet Source Address: y.y.y.50/32 Translated Packet: Static IP Translated Address: x.x.x.12/32 Bi-Directional: yes Changes higlighed in BOLD. Also make sure that your more specific NAT entries (statics, bi-directionals) are at the top of the NAT policies and you more generic outbound NAT policies are at the bottom. Thanks, Ahsan ... View more