About panwmod

You can do this with a carriage return (aka CR aka character code 13). I am not really clear when that is a \r or ^M, but this worked on a mac using a iTerm. Now, realize that it is not actually the characters ^ (caret) followed by the letter M, that is only how it shows in the terminal. On a Mac I pressed and held ctrl, then pressed V (released) followed by M (released both ctrl and M). This results in the terminal that looka like the two characters ^M, but is actually a single character on the terminal. I know that is confusing, but long and short, it is not the two characters ^M.   Here is an example of how it looks like in the terminal.    admin@pa-220-1# set deviceconfig system login-banner "line 1^Mline 2^Mline 3" [edit] admin@pa-220-1# show deviceconfig system set deviceconfig system login-banner "line 1 line 2 line 3" [edit] admin@pa-220-1# ... View more

Also, make sure DNS if configured so the firewall can resolve updates.paloaltonetworks.com.     ... View more

Sure. I will check with support. Thank you all. ... View more

Beside the CLI guide you can also try the following to determine the needed commands: Login via ssh set cli config-output-format set change to configure mode use the 'show' command to display the current configuration ... View more

What you do is merge the certificate and the CA into one cert and upload.  Palo Alto will not join the chain together for you.  You need to join the certificates yourself then upload.  The Panorama will strip the second certificate, so you will need to upload locally.  Took a bit of time but again, works nicely.  So do something like.... cat mycert.crt myCA.crt > mycertchain.pem.  Then upload that with the key.  This works.  ... View more

Just throwing this one out there, but you can build a rule with specific source/destination traffic and then have the PA packet capture on that one specific rule: I've used this and it works... it's kind of a "ghetto tcpdump" way of doing it. The packet captures show up in the Monitor tab with a green arrow next to them, just as though a Threat rule that had 'packet capture' turned on had matched. ... View more

I am using PAN OS 4.1.7 the settings below work fine for me. For the portal address select the interface and 'none' for the IP Address. For the portal just use your dns name. ... View more

The following commands give you an idea about the connection status and the 'health' of your agents show user user-id-agent statistics show user user-id-agent state all A restart of the agents should not be necessary, a device server restart should bring up the communication again: debug software restart device-server ... View more

It's very useful and thanks. Joy, ... View more

This is certainly a valid work around and you will most likely not be able to find a better or more granular one. The self signed certificate is not the main problem here, it could be imported into the Palo Alto as a trusted CA. However, the server ip-addresses seem to use the same certificate (same fingerprint, same s/n) with the common name 'Elster HTTPS-Servlet' which will always result into a failed verification due to 'hostname mismatch'. Not enough, the certificate of www.elsterft.de is expired since Dec. 19. 2011 (as of today Aug. 11. 2012) Even if you would be able to overcome all these issues the ssl decryption will most likely still fail, because the server requires a mutual certificate authentication. Congratulation to the German tax authorities for this great implementation and the ISO 27001 certification. ... View more

Right so in this configuration, if 10.100.10.50 is going to anything in the (address group) it will get translated to 209.165.241.88.  And then ANYTHING hitting 209.165.241.88 from the outside will get translated to 10.100.10.50 according to my lab. What I wanted was for the source of the inbound to be limited to only the (address group). To accomplish this I need a second destination NAT for it to work how I want. Thanks again for the help! ... View more

As a sidenote regarding SPDY Kaspersky Anti-Virus 2013 use the following settings: Settings -> Advanced Settings -> Network Encrypted connections scan Scan encrypted connections: enabled Use HTTP instead of SPDY protocol: enabled The application does not apply heuristic analysis to data transferred over SPDY. ... View more

It work fine now after I change domain in LDAP Server Profile to have no .com Thank all ... View more

request system fqdn show shows the FQDN its ip-address the remaining TTL and the seconds since the last refresh ... View more

Just tried it on my test box running 3.1.7, seems to works as well. Thanks Ulli ... View more