About jdprovine

jdprovine

@BPry Yes i keep very close eye on my PA and usually the dataplane runs well below 10% and closer to 5% or below. Its a PA 3050 on OS 8.0.16 which I am in the works to upgrade to 9 once the apocalypse ends. I don't think it is the globalprotect traffic and I think your right that smb traffic may be the culprit but I am having a hard time finding the exact cause. Maybe it has to do with the way that the users are now accessing our file server I am not sure. I have spent alot of time looking at logs, at the ACC and I have a TAC ticket open. There are times when things look normal, like first thing this morning the DP was only 3%, it has now climbed to 33% and will soon be at 60% way higher than the norm and has been on this consistent trend upward since May 12 2020. If you know of anything else I should look at let me know

jdprovine

@BPry that is what I thought ,but the dataplane CPU has been running high and spiking at 100% so I sent in a support file with the ticket I opened and then TAC said it was spiking due to decryption but I was sure I didn't have decryption configured and I don't. then I noticed there was some decrypted traffic for the globalprotect client which makes sense but we have 30-40 tops users at any given time on GP and have been running that way a over a month before I saw the CPU spikes. We have had spikes in the past but not like we do now and the overall dataplane CPU has increased from less than 10% to 50-60% since May 13th and i can't find the cause so I opened a tac ticket and they have gotten no where

jdprovine

@OtakarKlier @rmfalconer Yes I had looked at both of those and wasn't sure if they were still applicable since the os described is 6.1. The reason I asked is because I did not configure decryption and I checked and saw there was none configured on the firewall. I did not know if decryption occurs by default on some traffic like URL and globalprotect traffic, because when I check the traffic logs it does show some decrypted traffic. I have also been trying to hunt down some high CPU percentages on the dataplane and am having a hard time pinpointed the cause. TAC said it might be due to decryption of URL traffic but I can't find anything to confirm it.

jdprovine

I have never configured any type of SSL decryption so how do I check for it, what all can be configured to use it and is there decryption that occurs by default with no configuration

jdprovine · ‎12-17-2019

@BPry Do you mean using solarwinds or something to do a netflow collections on all the pa interfaces? Why not do firewall packet capture on the firewall?

jdprovine · ‎12-17-2019

@BPry I am seeing the dataplane cpu spike to over 90% for about 5 minutes and then drop to normal. It comes intermittently with not regularity to when it occurs. I have been doing the show running resource-monitor, show system statistics, and showing the 20 top applications and I can not find it. Any suggestions would be helpful

jdprovine · ‎11-08-2019

@BPry Hows it going? As always you have many good suggestions. I decided to change the action to drop. I currently don't have mine meld and doesn't that cost? I currently do not have a SIEM setup yet I may need to look into that

jdprovine · ‎11-07-2019

I am getting this alert Masscan Port Scanning Tool Detection' what can I do that will stop the scanning, I would think I would need to do more that alert and when I check the threat database it didn't really offer much

jdprovine · ‎08-22-2019

I can't believe 9 is out LOL

jdprovine · ‎06-27-2019

@BPry @OtakarKlier At the least I can block it through the threat prevention, but I don't know how it works, and it appears to started back when they put in the sip trunks last June. Shouldn't it be causing issues all the time with the phones?

jdprovine · ‎06-26-2019

I have recently been dealing with sip invite method request flood attempt show up not only in my threatsm but also making it impossible to make calls external or external to internal calls because its trying to call a number every 4 seconds and taking all my SIP connections available. Besides blocking it on the firewall and having the ISP deadroute the called or called number is there anything else I should do?

jdprovine · ‎06-20-2019

@RobinClayton And yes we are on a SIP trunk. When you say phone system provider do you mean cisco or the ISP that provides for our external lines?

jdprovine · ‎06-19-2019

@BPry I am totally new to Cube and phones in general,LOL I don't even know what expressway is. thanks for the suggestions I will check into it,

jdprovine · ‎06-18-2019

@BPry I am new to phones but I believe we do have a SBC - cisco cube, so I am wondering if the configuration is set way to broad and accepts way too much?

jdprovine · ‎06-18-2019

We have cisco IP phones, I would think it would be helpful to keep us from getting attacked so to speak

jdprovine · ‎06-18-2019

SBC is a session border controller, one other person mentioned it and this is the first time I have ever hear of it. It is specifically for phone systems?

jdprovine · ‎06-17-2019

Can rapid fire spam phone calls be blocked by the PA, they seem to be similar to a dial of service and they are making it possible for us to make outgoing calls or recieve incoming calls by using all our phone sessions? Is there a way to block them using the PA?

jdprovine · ‎05-09-2019

@MickBall Actually its not failing I was just wondering if there was a best practices way to configure it that would make it more efficient

jdprovine · ‎05-09-2019

@MickBall Hey there I'm back after my job change and reaper got all my setting migrated wasn't sure people would recognize me. We only have one VPN configured and every one uses the same one, we don't have nearly as many users as you do though but I really dislike the auto login, I prefer the on demand but I can see why it was setup the way it was to take human error out of the equation. I am just looking to make it work better

jdprovine · ‎05-07-2019

I was just wondering how other people have their globalprotect clients configured? Who used on-demand vs autologin. Who uses prelogin checks etc and what works the best

jdprovine · ‎12-21-2018

@Raido So you would bring the replaced one back on as the primary again? We only have 2 PA's and primary and a secondary.

jdprovine · ‎12-21-2018

@Raido So did you make new hardware the secondary or the primary again. Recently PA TAC told me to disable sync to peer on the secondary

jdprovine · ‎12-21-2018

@Raido Yes I would assume that the secondary would take over to, this hasn't actually happened I was thinking about the best way to deal with it. So you would let the secondary sync to the new hardware? No panorama

jdprovine · ‎12-21-2018

What is the best way to recover the primary PA 5050 if the hardware completely dies?

jdprovine · ‎12-20-2018

Apparently you can not affect the size of the OS partition or clean it up which makes sense, just log files and the OS images in the repository

jdprovine · ‎12-20-2018

@BPry @reaper Or another way to ask this, is it possbile to run out of space on the OS partition?

jdprovine · ‎12-20-2018

my guess there is no way to clean up the OS partition

jdprovine · ‎12-19-2018

Is there anyway to freeup space on the partition were the OS resides on the PA or is that automagically done when you upgrade the os. All articles dealing with clean up of the disk space has mainly to do with purging logs, the image repository, the configuration but not really the OS.

jdprovine · ‎12-19-2018

@reaper It was a typo on my part I entered svm instead of swm LOL 😉

jdprovine · ‎12-19-2018

@reaper @kiwi @BPry - oops its a typo svm instead of swm jprovine@PA220-test-mgt> debug svm status Invalid syntax. jprovine@PA220-test-mgt> debug svm status

Date Registered	‎04-01-2015 07:10 AM
Date Last Visited	Friday
Total Messages Posted	1,470
Total Likes Received	65

Online Status	Offline
Date Last Visited	Friday

Strata

Prisma

Cortex

About jdprovine