This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About panwmod
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About panwmod
04-20-2021
28Posts
13Likes
4Solutions
Apr 20, 2021Last Visited
User
Activity
User
Profile
Latest posts by panwmod
| Subject | Views | Posted |
|---|---|---|
| 3032 | 01-30-2013 06:55 AM | |
| 1083 | 01-24-2013 10:15 AM | |
| 22682 | 01-10-2013 06:08 AM | |
| 20987 | 01-10-2013 05:58 AM | |
| 3489 | 01-09-2013 08:11 AM | |
| 7723 | 01-08-2013 08:39 PM | |
| 7879 | 01-08-2013 09:43 AM | |
| 5781 | 01-03-2013 08:35 PM | |
| 4103 | 12-19-2012 12:33 PM | |
| 5069 | 12-15-2012 07:33 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 08-01-2012 05:13 PM | |
| 1 Like | 05-03-2011 06:20 AM | |
| 1 Like | 08-17-2012 07:50 AM | |
| 2 Likes | 07-19-2012 01:17 PM | |
| 1 Like | 01-08-2013 09:43 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 01-28-2010 02:56 PM |
| Date Last Visited | 04-20-2021 05:26 PM |
| Posts | 28 |
| Total Likes Received | 13 |
01-30-2013
06:55 AM
1 Kudo
You could also try to temporarily enable logging for all traffic, that will catch intra-zone traffic and the hard coded drop as well. set system setting logging default-policy-logging <value> (Value is 0-300 seconds)
... View more
01-24-2013
10:15 AM
Beside the CLI guide you can also try the following to determine the needed commands: Login via ssh set cli config-output-format set change to configure mode use the 'show' command to display the current configuration
... View more
01-10-2013
06:08 AM
Below the tail of a successful update check, maybe that gives you an comparison to your and a hint what might be wrong on your box. admin@PA4020> tail follow yes mp-log ms.log Self-signed certificate encountered. HTTP request sent, awaiting response... 200 OK Length: 3215 (3.1K) [text/xml] Saving to: `/tmp/.avinfo.xml.tmp' 0K 100% 21.2M=0s 2013-01-10 08:00:00 (21.2 MB/s) - `/tmp/.avinfo.xml.tmp' saved [3215/3215] Jan 10 08:03:14 Getting authorization info for user admin succeeded. NO_MATCHES NO_MATCHES --2013-01-10 08:04:06-- https://updates.paloaltonetworks.com/Updates/UpdateService.asmx/CheckForSignatureUpdate Resolving updates.paloaltonetworks.com... 199.167.52.13 Connecting to updates.paloaltonetworks.com|199.167.52.13|:443... connected. WARNING: cannot verify updates.paloaltonetworks.com's certificate, issued by `/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU= http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287': Self-signed certificate encountered. HTTP request sent, awaiting response... 200 OK Length: 4149 (4.1K) [text/xml] Saving to: `/tmp/.contentinfo.xml.tmp' 0K 100% 78.8K=0.05s 2013-01-10 08:04:50 (78.8 KB/s) - `/tmp/.contentinfo.xml.tmp' saved [4149/4149] NO_MATCHES NO_MATCHES --2013-01-10 08:04:51-- https://updates.paloaltonetworks.com/Updates/UpdateService.asmx/CheckForVirusUpdate Resolving updates.paloaltonetworks.com... 199.167.52.13 Connecting to updates.paloaltonetworks.com|199.167.52.13|:443... connected. WARNING: cannot verify updates.paloaltonetworks.com's certificate, issued by `/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU= http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287': Self-signed certificate encountered. HTTP request sent, awaiting response... 200 OK Length: 3215 (3.1K) [text/xml] Saving to: `/tmp/.avinfo.xml.tmp' 0K 100% 19.6M=0s 2013-01-10 08:04:58 (19.6 MB/s) - `/tmp/.avinfo.xml.tmp' saved [3215/3215]
... View more
01-10-2013
05:58 AM
Hi Paula, Telnet on you Palo Alto appliance uses the management interface as the source of the connection. If you can successful connect to updates.paloaltonetworks.com and staticupdates.paloaltonetworks.com on port 443, it will show the 'connected to <hostname>'. That confirms that there is no connectivity issue between the management interface and the update server. You mentioned that your licensing is up to date as well, which pretty much leaves to my knowledge only the 'service routes' as a possible issue. Check that Device > Setup > Services > Service Route Configuration uses 'use default' as the source for Palo Alto Updates. Other than that I suggest to open a ticket with support. Thanks Ulli
... View more
01-09-2013
08:11 AM
1 Kudo
Jochristian, I talked to my SE and he confirmed that there is a pending RFE matching the suggestion of mikand. He added me to that request and wanted to link this thread there as well. So no telnet, but a connectivity testing utility. Thanks Ulli
... View more
01-08-2013
08:39 PM
Greg's solution is actually the better on, it doesn't involve 'touching' all clients. Having the 'server' present his own and the intermediate CA allows the 'client' to confirm the authenticity of the server certificate with only having the root in his store. Using openssl you can easily confirm that your imported cert on the PAN the it is working correctly openssl s_client -CAfile <full path to root cert> -quiet -showcerts -connect <ip or fqdn of PAN>:6082 Thanks Ulli
... View more
01-08-2013
09:43 AM
1 Kudo
IMHO we are looking at a browser/ client issue here. Looks like you are using IE, the issuing CA 'Globalsign Organization Validation CA' needs to be trusted on your client. Try to import the intermediate CA into the 'Trusted Root Certification Authorities' store on you windows client. If the error disappears you can distribute the intermediate CA via GPO in your AD. Thanks
... View more
01-03-2013
08:35 PM
Hello Todd, Unfortunately this issue was never resolved. The only way to implement a 'clean' multiline login banner that shows up with the intended formatting on CLI and GUI login is to create it via web interface. Thanks
... View more
12-19-2012
12:33 PM
Mikand, Thank you for the constructive input. I still can't agree on the security issue of telnet being available in the OS. Before removing it from the OS it should be removed as a logon method to the Palo Alto itself. I consider the possibility to logon in 'cleartext' to the core security devices in my network as a major security issue. Luckily it can easily be disabled for the OS login. If somebody nevertheless manages to get unauthorized access to the Palo Alto box, he/she will have (or can grant him/herself) full access with or without a telnet client being present. The test command would be a valuable improvement for troubleshooting, but would not be able to fully replace a telnet client. Beside a quick port connectivity test, you can use it also to fully test smtp or http (or other none encrypted) communication assuming a little protocol knowledge. However, I would be willing to surrender telnet for (complete removal also as a logon method) for a connectivity testing tool that has the mentioned functionality. Cheers Ulli
... View more
12-15-2012
07:33 AM
1 Kudo
Jo, Thanks for your support. Seems that we are the only 2 people that are missing telnet. I doubt that it will be enough to convince Palo Alto to bring it back. Was worth a try. Cheers Ulli
... View more
12-13-2012
08:53 AM
"potential security vulnerability", seriously? I think I have other problems if somebody already has CLI access to my box than worrying about him having telnet access. Cheers Ulli
... View more
12-12-2012
01:54 PM
Hmm, not on my box as a logged on superuser. admin@PA-200> telnet Unknown command: telnet admin@PA-200> show system info hostname: PA-200 ip-address: 10.200.200.123 netmask: 255.255.255.0 default-gateway: 10.200.200.1 ipv6-address: ipv6-link-local-address: ipv6-default-gateway: mac-address: b4:0c:25 time: Wed Dec 12 15:51:34 2012 uptime: 23 days, 22:32:00 family: 200 model: PA-200 sw-version: 5.0.0
... View more
12-12-2012
01:36 PM
3 Kudos
Don't get me wrong, I really like PAN-OS 5, but why did they take my favorite troubleshooting tool away? The PA is the new device in our environment and if anything is not working all blame on the 'new guy'. User claims: 'since we have the new firewall I can't get to webpage xyz anymore' Admin: A quick telnet from the PA to xyz on port 80 is timing out? Admins answer: Sorry Sir, the webpage is either down or somebody upstream is blocking the access. Not even the firewall can get there. Actually, if they re-enable it (the underlying BusyBox certainly still supports it) it would be really cool if we could specify a source interface like for ping and traceroute. Am I the only one who's missing telnet or it it worth an RFE?
... View more
Labels:
- Labels:
-
Troubleshooting
09-04-2012
09:38 AM
I am using PAN OS 4.1.7 the settings below work fine for me. For the portal address select the interface and 'none' for the IP Address. For the portal just use your dns name.
... View more
08-17-2012
07:50 AM
1 Kudo
The following commands give you an idea about the connection status and the 'health' of your agents show user user-id-agent statistics show user user-id-agent state all A restart of the agents should not be necessary, a device server restart should bring up the communication again: debug software restart device-server
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks