About syadav

syadav · ‎08-22-2016

Hi Erez, You need to open the pcap (SCP/TFTP to a computer to view using Wireshark) and check if the DNS req. and response are seen with the DNS response having the answer to FQDN(s) configured. Sandeep.

syadav · ‎08-22-2016

Hi Erez, To start, you may want to check if the firewall is receving a response for the DNS queries by taking a pcap. Check if the DNS service route is via MGT or data interface and take tcpdump (MGT) or DP capture (Monitor > packet capture) Check the service route for DNS : Thanks, Sandeep.

syadav · ‎02-03-2016

@Javith , 1. Could you take a pcap on the MGMT/Data interface (depending on service route setup) to check what transaction is going between the PA FW and the update server ? and which side seems to terminate the session ? 2. You may also run the following command to check ms.log and devsrvr.log while you attempt to download the panOS version : > tail follow yes mp-log ms.log > tail follow yes mp-log devsrv.log

syadav · ‎02-01-2016

@KiCheon.Lee Following is the link for 7.0 : https://www.paloaltonetworks.com/documentation/70/globalprotect/globalprotect-admin-guide/globalprotect-overview/what-client-os-versions-are-supported-with-globalprotect.html#80765

syadav · ‎01-28-2016

@SOC_CSG You can create filter the traffic log for the DNS queries directed towards the Sinkhole address. You may create a report using traffic logs as well : https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/threat-prevention/identify-infected-hosts.html

syadav · ‎01-28-2016

@KiCheon.Lee Windows server OS are NOT yet supported for Global Protect Agent.

syadav · ‎01-28-2016

@jdprovine The traffic on PA would be seen as either ESP or ESP-UDP, can you check in the traffic logs on the PA if this traffic is seen ? To ensure you have PA as passthrough allow application "IPSEC" as suggested in below DOC : https://live.paloaltonetworks.com/t5/Configuration-Articles/Configuring-the-Palo-Alto-Networks-Device-as-an-IPSec/ta-p/58732

syadav · ‎01-27-2016

@johnshaik If the shadow rules are NOT reporting correctly, then it not something which you want as the warning helps in setting up the rules correctly. If you are just looking for the reason as why the difference, I would recomm opening a case with Tech support.

syadav · ‎01-27-2016

@johnshaik Can you check if the rules which are being shadowed actually a subset of the rule which is shawdowing it ? The idea is to check if the shadow warning is actually valid.

syadav · ‎01-26-2016

@soporteseguridad Yes, downlaoding and installing 7.0.1 and then downlaoding and installing 7.0.x

syadav · ‎01-26-2016

@gtomte Perhaps you can try "installing" 7.0.1 as well before installing 7.0.4. Have come across few scenarios where installing 7.0.1 before 7.0.x helped.

syadav · ‎01-26-2016

@Apadilla 7.0.1 is now the base image for 7.0, please try downloading 7.0.1 and then proceed to download and install 7.0.4.

syadav · ‎01-24-2016

@sib2017 If we assume that the tunnel is setup fine and only the traffic is failing, you should see UDP/ESP traffic on the Palo alto. Please check cisco documentation which exact port they use for this traffic. ESP protocol number is 50, you may filter with this as well.

syadav · ‎01-23-2016

@sib2017 If the VPN negotiations itself are failing, then you sould see the request coming from the IP of the PC. On the PA, you may check if any traffic is denied/dropped between the IP of the PC and the IP corresponding to the destination IP. Packet captures between these IPs would help.

syadav · ‎01-23-2016

@panos This is still a feature request.

syadav · ‎01-23-2016

@rbista Just in case you are looking for the status, this is still not possible. Currently considered as a feature request.

syadav · ‎01-22-2016

@ajrockn The "None:" prefix seem to indicate the Threats (and corres. Thread ID) for domains which are identified (as suspicious) by "Wildfire content signatures" > The range is as follows : Wildfire Suspicious DNS Signatures: 3800000 - 4000000 https://live.paloaltonetworks.com/t5/Threat-Articles/Threat-ID-Ranges-in-the-Palo-Alto-Networks-Content-Database/ta-p/59969 Hence "None:" prefix seems to be a notation placeholder for this threat ID range.You should be able to confirm this by your observation of the IDs in the logs.

syadav · ‎01-22-2016

@Amir.Borjian Yes, OS X El Capitan 10.11 is supported starting from 2.3.2 >> Refer to RN (section "Features Introduced in GlobalProtect Agent 2.3") https://www.paloaltonetworks.com/content/dam/paloaltonetworks-com/en_US/assets/pdf/framemaker/23/GlobalProtect-Agent-RNs.pdf

syadav · ‎01-21-2016

@ajrockn can you tell which field in the threat log, you are referring to ?

syadav · ‎01-21-2016

@euanbarker Since you plan to have 100 Mbps links for HA1 and HA2, it should be more than sufficient. Had it been the HA3 link (if the setup was an A/A HA) the case would have required more pondering !

syadav · ‎01-21-2016

@euanbarker Do you mean the bandwidth requirement for the communication between the HA1 and HA2 links of the HA ? If yes, I dont readily see any document stating this information (it is tricky for the vendor to publish any specfic values). The following DOC explains what is synchronized via which link (HA1/HA2). You will find that this is very less bandwidth intensive info (more than bandwidth, stablility and availability is important here) https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/documentation_tkb/568/1/HA_Synchronization_RevD.pdf Also, since this is not a Active/Active setup, there is not transfer of actual traffic between the nodes (via HA3) which might have required high bandwidth (or aggregated )HA3 link.

syadav · ‎01-21-2016

Hi JC, To avoid the certificate error when using Self signed certificate, at least you need to make sure that the "signing certificate" ie the self signed CA used to sign the portal and gateway cert is downloaded and added in the Trusted Root CA store of the end user machines. Though there can be more complications regarding certificates (like one mentioned in the DOC below) depending on exact implementation of the GP setup. It is difficult to conclude the reason without knowing the exact setup/config. https://live.paloaltonetworks.com/t5/Management-Articles/GlobalProtect-Gateway-Certificate-Error-When-Trying-to-Use/ta-p/57043 It would help if you could add the exact error message snapshot seen on the user machines and GP Agent and panOS version.

syadav · ‎01-20-2016

@Brandon_Wertz...seems I was spot on ! 😉 Regarding pcap log, On top of my head, I dont remember any particular log file which would log the pcap setting but following comand can be used to see the realtime setting : admin@PA-VM> debug dataplane packet-diag show setting -------------------------------------------------------------------------------- Packet diagnosis setting: -------------------------------------------------------------------------------- Packet filter Enabled: no Match pre-parsed packet: no -------------------------------------------------------------------------------- Logging Enabled: no Log-throttle: no Sync-log-by-ticks: yes Features: Counters: -------------------------------------------------------------------------------- Packet capture <<<<<<<<<<<<<<<< Enabled: no Snaplen: 0 -------------------------------------------------------------------------------- A painful way of achieving this would be writing a script and fetching this output periodically.

syadav · ‎01-19-2016

Hi Brandon, varrcvr is usually responsible for URL logging and pcaps, do you have any pcaps enabled on the firewall by any chance ? Also check for any core files : > show system files If the mgmt CPU hovers above 70% all the time, I would suggest opening a case with Technical support to investigate further.

syadav · ‎01-19-2016

Hi Burtond, As others have mentioned, NO license is required for setting up IPSEC VPN on Palo alto firewalls. Regarding setting up a VPN with Cisco, I would advise you to keep in mind that the "proxy-IDs" match (vice-versa) exactly as on Cisco since Cisco doesnt like 0/0 proxy IDs. This is a common gotcha when dealing with IPSEC between Cisco and other vendors (which support 0/0 proxy IDs)

syadav · ‎01-19-2016

Hi Marcos, Thanks for your response. Also make sure that if the Client certificate is generated on firewall you export it in format PKCS12. If this advice helps your case, please mark it as a solution so that it may help others.

syadav · ‎01-19-2016

Hi Santonic, The minimum Terminal server agent required for 6.1.x is 5.0.0. You may safely use any of 6.0.x Terminal Server Agents with 6.1.x panOS. For more information/confirmation check the "Associated Software Versions" section in the release notes of 6.1.x.

syadav · ‎01-18-2016

Hi Marcos, Please find the answers to your questions below : 1) I would recommend you to remove the older certificate from the personal store and add the new one. Certificate management is usually done with GPO, you may use the same to deploy/withdraw the certs. 2) Yes, in case the signing CA certificate is renewed, it needs to be imported on the client machines and added in the Trusted Root CA store. Please mark as a solution if it resolves your problem.

syadav · ‎01-18-2016

Hi Marcos, There are two possibilities for which you may be using the Device (locally) generated certificate : 1. Server Certificate for Portal and Gateway : In this case the signing CA cert is still the same and has not changed. Hence the end users would still be able to validate the new server certificates as they have the signing CA cert. 2. Client Certificate for Authentication of End users : If this certificate has expired and renewed then it needs to be imported on the local devices (clients). If not, they would not authenticate the local machine due to expiry.

syadav · ‎01-18-2016

Hi Brandon, It is less likely to be NAT exhaustion issue since other traffic like HTTPS (and other) like is working fine (which would also use source NAT). This seem to be a software issue which would require deeper analysis by the Tech support team.

Date Registered	‎03-19-2015 02:19 AM
Date Last Visited	2 weeks ago
Total Messages Posted	90
Total Likes Received	14

Online Status	Offline
Date Last Visited	2 weeks ago

Strata

Prisma

Cortex

About syadav