About Vijaygvasan

Hi Team,   I have few queries to be addressed.   We have changed the SSL/TLS version using CLI to TLS 1.2 but when we run the scan we can see TLS 1.1 is also running at the back-end. We need to check which SSL/TLS version is running using CLI of the Firewall. What command needs to be used to check the current TLS version of the firewall? in CLI   Secondly: We need to know which SSL/TLS cipher is recommended. From our security team point of view we need to disable the below mentioned ciphers (DH & RSA) algorithms. If we disable these two will there be any issue? How to disable them? Steps and commands to disable through CLI? Will the firewall work intended even after disabling DH and RSA? What are the recommended SSL/TLS cipher for the firewall?   Thirdly: We need to know what is the current SSH Cipher its taking for the SSH of the firewall how to find which one is currently being used.   Let me know on the above Cheers!   ... View more

Hi,   I have a requirement where two scenario, Branch office and Head Office.   ++Branch office has Sophos firewall and Head office have Palo alto firewall. ++Branch office users are enforced with using Global Protect when they are outside of the organization that is BO(Work From Home). Which the GP will directly connect with HO. ++When the same user is entering the premises that is (LAN) of the Branch Office, since they are entering different network their GP needs to disable automatically since the GP is enforced. ++What could be the possible way that when a user Gets to the Branch office and their GP gets disabled and once they leave the organization GP needs to be enforced. What could be the possibilities.   Share the same here so that it will be helpful for me. Cheeerss... ... View more

Hi Team   I have a concer where we have a scenario. (Branch office )Sophos -----------ipsec----------- PA(head office)   Could Sophos users that is branch office inhouse users connect to GP configured in Palo Alto firewall which is in head office. This communication should be via internal gateway not the external gateway. We have IPsec tunnel in place aldready. When users connect to Sophos firewall (BO users) will become (BO inhouse users) this set of user need to connect with GP configured on (Head office ) PA firewall.  If this is configured will the branch office users be able to access Branch office services? Will the above mentioned set up will work?  Post the possibilities.     ... View more

We need to block SIP ALG on our firewall which is running 10.0.7. Which does not have the option to disable under object---->Application---> SIP. I came across with this document https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEsCAK   which stated to disable the SIP ALG but as this PAN OS doesnt have the option please share the same.   Let me know the possibilities.   Cheers!! ... View more

Hi Team,   We are facing an issue with respect to S4 Fabric-2 Core alarm true some times devices produces some loud for few minutes and comes back to normal attached few details having here.   S4 Fabric-2 Core True 95.80 -5.00 95.00   env.s4.thermal.8: { 'alarm': True, 'avg': 95.600, 'card-shutdown': False, 'desc': Fabric-2 Core, 'desc-detail': Temperature @ FE3600_2 Core, 'fan-min': 50.000, 'hyst': 5.000, 'i2c-failures-count': 0, 'i2c-failures-status': False, 'max': 95.000, 'min': -5.000, 'notified-avg': 97.200, 'samples': [ 96.000, 96.000, 96.000, 95.000, 95.000, ], 'shutdown-temp': 114.000, }   I just want to know what is Fabric core and whats its use. what can be done to minimize the temparature     ... View more

We have recently added a user in the server list. We are able to see the user in LDAP but when it comes to firewall we are not able to see the user in security policy. When i checked the user with following command show user ip-user-mapping all | match user name I am not able to find that user as well. As a trouble shooting can i restart the user mapping software at firewall end and check?   Cheers ... View more

We are facing issue with connectivity using GP in I Phone devices. We are getting the below error. gateway apple T the network connection is unreachable or the gateway is responsive check the network connection and reconnect We tried installing new set of certificate with pkcs format on iPhone yet it is not working. We checked the Monitor log where the portal login was successful but we got the above error. What could be the issue with that. Current IOS is 14 and the GP is under 5.2. This was working fine two days back after the certificate got expired we renewed the certificate but not able to connect to internal network.   Cheers. ... View more

Hi Folks,   We are trying to configure MFA under Radius using Cisco DUO. We have done the configuration for MFA in firewall for the same. Now we are facing some problem such as 'Reason: Invalid username/password. auth profile \'Duo_Auth\', vsys \'vsys1\', server profile \'Duo_Radius\', server address Failed to communicate with any Active Directory server\' From: x.x.x.x' This is the error coming in system log. Also when we tried to login with CLI using test authentication authentication-profile auth-profile username & passwork. We received this below error message. Target vsys is not specified, user "username" is assumed to be configured with a shared auth profile. Do allow list check before sending out authentication request... name "username" is in group "all" Egress: No service source route is set, might use destination source route if configured Authentication to RADIUS server at x.x.x.x:1812 for user "Username" Authentication type: PAP Now send request to remote server ... Authentication failed against RADIUS server at x.x.x.x:1812 for user "Username" Authentication failed for user "Username"   What could be the cause here let me know what could be done next.   Cheers   ... View more