Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About idelconsulting
About idelconsulting
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
a week ago
20Posts
4Likes
2Solutions
Sep 19, 2020Last Visited
User
Activity
User
Profile
Latest posts by idelconsulting
| Subject | Views | Posted |
|---|---|---|
| 389 | 05-02-2020 04:23 PM | |
| 1026 | 03-10-2020 04:37 PM | |
| 1104 | 03-10-2020 11:19 AM | |
| 1511 | 12-23-2019 04:20 PM | |
| 1538 | 12-23-2019 12:43 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 03-10-2020 04:37 PM | |
| 1 | 03-27-2018 11:39 AM | |
| 1 | 03-27-2018 12:03 PM | |
| 1 | 01-19-2014 12:27 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 09-08-2011 03:05 PM |
| Date Last Visited | a week ago |
| Total Messages Posted | 21 |
| Total Likes Received | 4 |
05-02-2020
04:23 PM
Dear all,
trying to get MISP working in the latest version without much success so far.
Repeated the steps from the previous version where I had it working, but now I'm getting:
COMMIT FAILED: Class mmmisp.Miner in ... not safe to load
... View more
- Tags:
- MISP
03-10-2020
04:37 PM
1 Kudo
Thanks, wasn't really clear from the CLI TAB expansion. I managed to get it working again by following the steps in: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC Regards, Andreas
... View more
03-10-2020
11:19 AM
Dear all, lost access to the WebGUI. opaque: websrvr: Exited 4 times, waiting 1770 seconds to retry Before that I received another email from the firewall: opaque: Shared certificate xxx and corresponding key have expired. (OK, I know, my fault) So I suspect that this is the reason for the web server failing. All instructions I found so far talk about issuing a new self-signed certificate from the WebGUI. How do I do that from the CLI? request certificate generate name "paab.xyz.local" certificate-name "paabself" algorithm RSA 2048 returns Invalid syntax Regards, Andreas
... View more
- Tags:
- certificate
- webgui
12-23-2019
04:20 PM
Actually all good. Didn't realize initially that my self signed certificate (generated on the PA) was valid for more than 825 days. Issued a new one and all OK now.
... View more
12-23-2019
12:43 PM
Dear all, was anyone able to generate a certificate satisfying the new requirements from Apple for IOS 13? https://support.apple.com/en-us/HT210176 I have no problems generating the correct Subject Alternative Name extension, but no idea so far how to satisfy: TLS server certificates must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID. Regards, Andreas
... View more
- Tags:
- global protect
- ios
03-27-2018
12:03 PM
1 Kudo
I added a comment to that other discussion.
The instructions required a couple of minor changes:
I exported my root CA certificate and the forward trust CA certifiacte from the PA.
Exported CA PEM files needs to be in:
/opt/minemeld/local/certs/site
with the extension .crt
Then, run
sudo -u minemeld mm-cabundle-update
Last step is restarting the engine from the System menu.
Now for me everything is working fine.
Regards,
Andreas
... View more
03-27-2018
11:39 AM
1 Kudo
I got it working now.
Changes required:
Trusted CA PEM file needs to be in:
/opt/minemeld/local/certs/site
with the extension .crt
Then, after running
sudo -u minemeld mm-cabundle-update
you need to restart the engine from the System menu.
Now everything looks fine.
Regards,
Andreas
... View more
03-26-2018
02:19 PM
Hi @lmori,
I tried that, but so far it didn't work.
First, shouldn't that be: sudo -u minemeld mm-cabundle-update ?
Second:
I exported my forward decryption certificate from my PA in PEM format and created a file
pa820SubCA.crt
in
/opt/minemeld/local/CA/site
Then I ran:
/opt/minemeld/local/certs$ sudo -u minemeld mm-cabundle-update 2018-03-26T23:14:19 (101237)cacert_merge.main INFO: config: {'cafile': ['/opt/minemeld/local/certs/site/'], 'dst': '/opt/minemeld/local/certs/bundle.crt', 'config': '/opt/minemeld/local/certs/cacert-merge-config.yml', 'no_merge_certifi': False} WARNING: old python version (< 2.7.9) - certificate verification not performed
I'm seeing
/opt/minemeld/local/certs$ ls -la total 312 drwxr-xr-x 4 minemeld minemeld 4096 Mar 26 22:50 . drwxr-xr-x 9 minemeld minemeld 4096 Mar 26 23:00 .. -rw------- 1 minemeld minemeld 296399 Mar 26 23:14 bundle.crt drwxr-xr-x 3 minemeld minemeld 4096 Mar 26 22:38 CA -rw-r--r-- 1 minemeld minemeld 25 Oct 2 14:17 cacert-merge-config.yml drwxr-xr-x 2 minemeld minemeld 4096 Oct 2 14:18 site
I don't see my certificate getting added in bundle.crt
Did I miss anything?
Regards,
Andreas
... View more
03-26-2018
02:13 PM
Hi @xhoms
thanks a lot. But so far that didn't work.
I'll ask a question on that other discussion you mentioned.
Regards,
Andreas
... View more
03-24-2018
05:55 PM
Dear all,
first of all, thanks a lot to all contributors for this great project.
Quick question: I configured my Minemeld instance in my local network and I also have SSL interception configured on my PA.
For the moment I had to exclude the IP of the Minemeld instance from SSL interception because of error messages. I assume that's because Minemeld doesn't trust my forward decryption certificate.
How can I add that to Minemeld?
Regards,
Andreas
... View more
03-20-2018
02:43 PM
My ISP confirmed that I need to use DHCPv6 with prefix delegation. I suppose this is not supported by Palo Alto? Regards, Andreas
... View more
03-18-2018
02:33 PM
Dear all, I'm ttrying to get IPv6 up and running but so far without much success. My ISP assigend a /48 range to me and they are saying I need to use DHCP. AFAIK, DHCPv6 is not supported, but NDP is. Assume my IPv6 prefix is abcd:1234:5678::/48 So I enabled IPv6 on the public interface and set the interface IP to abcd:1234:5678::/48 Enabled Interface ID as Host, Anycast, RA Also enabled router advertisements. Something seems to be wrong as I'm getting: An inconsistent router advertisement was received from address ... Any idea how to debug that further? Do I need to ask the ISP for the default gateway IPv6 address? For IPv4 I'm getting that via DHCP and added that as the default route to the VR. What also concerns me is that when I do a packet capture for IPv6, all the router advertisements appear in the received but also in the dropped logs. Is there anything missing so that the RA packets actually reach the firewall? Regards, Andreas
... View more
09-14-2017
02:56 PM
Dear all, I recently had problems with updates from the Windows store and was debugging for a couple of days without much success until someone pointed me to a setting in PA causing the problems: skip-block-http-range In an older thread it is recommended to set this to no in order to avoid multithreded downloads. I assume the default was yes. Can't get the CLI manuals at the moment. I never changed that setting, but apparently the default had changed recently to "no". This caused the downlaod to fail: The Webserver states: Accept-Ranges: none But the GET request still tries: Range: bytes=0-11199 Accept-Ranges: none is inserted by PA if skip-block-http-range is set to no Setting it to yes solved my download problems. Regards, Andreas
... View more
06-04-2016
01:55 PM
Hi all,
I'm lost configuring my PA-500 for IPTV using multicast.
My provider has a new option for IPTV.
They stated that in order to test the configuration one should try to open:
https://www.fiber7.ch/documents/129/Big_Buck_Bunny_Stream.xspf
So far I was not able to get this to work.
I understand that one needs to enable multicast on the virtual router.
I enabled it for the internal interface with IGMP enabled.
Whenever I add the external interface with PIM enabled I get an error message when validating the configuration
Failed to get IP address for interface ethernet1/1. (Module: routed)
Any hints appreciated how to get IPTV with multicast to work.
Regards,
Andreas
... View more
01-19-2014
12:27 PM
1 Kudo
Dear all, a potential FTTH provider requires a special option for the dhcp client in order to work. CISCO setting like: ip dhcp client class-id 100008,0001,Cisco,e02f.6d21.xxxx,15.3(1)T,FCZXXXXX XXX Is there any change to set the dhcp class-id for the dhcp client? I couldn't find anything in the manual. Regards, Andreas
... View more
12-26-2013
10:35 AM
Hello tasonibare, thanks a lot for your answer. It turned out to be simpler than I expected. All I needed was a NAT rule similar to what you showed without any PBF rules. In addition I just had to add the DMZ zone as a source zone to the outgoing source NAT and everything worked as expected. (OK, almost. I lost a couple of hours before I figured out that my DynDNS IP used as a FQDN address object was wrong). Regards, Andreas
... View more
12-19-2013
01:12 PM
Dear all, I'm trying to move from my initial vWire deployment to L3 in order to get rid of my SSG5. Later on I'll also get rid of my SA-2000. Current layout: ISP (dynamic IP) - PA vWire - SSG5 - PA vWire - Intranet | SA-2000 I'm clear how to set up NAT to access the Internet from my internal network. What I'm a bit unclear is how to set up my DMZ. Currently the SSG5 forwards all traffic incoming on port 443 to the SA. App filter in place on the external vWire to allow only Active Sync and Secure-access including inbound decryption. In my understanding I need to configure PBF to forward e.g ingress traffic arriving at the dynamic untrust interface on port 443 to the DMZ interface, correct? I assume this also means destination NAT (bi-directional?). Can I still filter by application? Some notes mention that PBF and app filter don't work together. Is there a way to change the port too? Assuming I want to keep 443 for future remote access via the PA, can I configure a way to translate untrust IP/444 to DMZ IP/443? Regards, Andreas
... View more
08-30-2012
01:09 PM
Hello Ameya, thanks for the links. I knew most of it but not all. The Application DB is the latest version. In this case I'm observing mainframe traffic, there are not many mainframe apps in the application DB. 😞 Regards, Andreas
... View more
08-30-2012
10:02 AM
Hi, I'm getting a lot of unknown-tcp on the internal network and would like to capture some packets to get an idea what this is. I tried: debug dataplane packet-diag set capture trigger application from unknown-tcp to unknown-tcp but I don't get any packets so far. I also tried from none to unknown-tcp, same result, nothing captured. Any idea what I'm doing wrong or a better idea how to capture that unknown traffic? Regards, Andreas
... View more
- Tags:
- packet-capture
Labels:
- Labels:
-
App-ID
-
Troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
