About apasupulati

DuvallDav · ‎06-28-2020

Hi guys, I had this same problem over the weekend however it wasn't the content packages that were at fault. Panorama was pushing to a device group and in my instance, the firewall wasn't getting the config and showing as "failed error: threat database handler failed" There was a piece of config on Panorama that was pushing out to the firewall that it didn't like. Once this was resolved in the device group, I was then able to re-push again. To test this you can push to a singular device to see if the error comes back.

glrixton · ‎05-14-2020

Howdy, I just wanted to pipe up and say thanks for this. With it, myself (firewall/networks) and our in-house phone/networks guy were able to build out a solution new to our environment. It saved us a TON of time. 2 x 5220 active/passive (8.1ish) and an Avaya 9641gs test phone.

Naresh41 · ‎07-23-2018

Hi, can you please share the document for Routing Between Virtual Routers in Same Firewall. i need to setup same in our enviorment. Regards Naresh Kumar

googol · ‎07-28-2016

Nope, told it was not supported by Palo Alto and that it is a feature request. From my understanding, bunch of people have voted for it. Feature request #1844 --- Avaya IP Phones and VPN with PAN Have your SE vote for it everyone!!

apasupulati · ‎01-02-2014

Suhaimi, No, Ldap server is configuration is required to pull user-group mappings, not in this case. If you're sure about the service account privileges( Be sure the user is part of the Distributed COM Users, Server Operators and Event Log Readers groups. ), can you ensure the status of the AD shows up as 'Connected' on the firewall? You can run the following command to check the statistics as well- > show user server-monitor state all > show user server-monitor statistics Also, please ensure the firewall is connected to all the DC's the users are logging on to. User-ip-mappings are retrieved by the firewall by reading successful logon events from the security logs on DC. You can run 'set l' on the windows command prompt and that will show the DC user is logging onto. If all this is in place, looking at the userid debug logs should help. > debug user-id on debug > debug user-id set userid servermonitor > debug user-id set userid basic > debug user-id log-ip-user-mapping yes > tail follow yes mp-log useridd.log To turn these off- > debug user-id log-ip-user-mapping no > debug user-id unset all >debug user-id on info This will be a helpful document for you: https://live.paloaltonetworks.com/docs/DOC-5662 Hope that helps, Aditi

apasupulati · ‎12-31-2013

Also, if you're new to deploying User identification on the firewall, here's a good document to get a good understanding on how it works - https://live.paloaltonetworks.com/docs/DOC-5939

killerkhan · ‎11-13-2013

VinceM, I cannot find this Quick start Guide Global Protect V2 on PA Support site, I found one but its in japanese. apasupulati, I read this document https://live.paloaltonetworks.com/docs/DOC-2904 and its got some good info, yet not complete info. I also read the https://live.paloaltonetworks.com/docs/DOC-2020 and its also good doc but most of its screenshots are for 4.x and the document is still missing complete instructions. The issue I have is I have followed all these documents and to my knowledge configured everything the way it should be but yet when I try to access the external IP of my firewall I dont get the portal page and also port 443 on the external interface is not responding to any port checks. I see documents that say you have to enable https mgmt profile to the external interface, i also see docs that talk about you need routing to be configured between tunnel.1 interface and trust, I also see docs about giving the tunnel.1 doc an ip address, also there are different docs about server cert or server cert with ca on PA box. so my problem is that there are documents all over the place with each document different info from the others, I am just trying to find out if there is a single doc or something that exists that walks you through from head to tail on configuring this GP on a small scale for user VPN access only. on top of all that, how to on split tunnel VPN would be a good help. thank you

_slv_ · ‎01-02-2014

From PAN 5.0.10 fixes log: 57816—Groups were not displayed in the Allow List dropdown selection of an Authentication Profile. This was due to changes made for an issue addressed in PAN- OS 5.0.7 (49237). This issue has been fixed so that groups are displayed in the Allow List dropdown selection of an Authentication Profile for single-vsys devices. Maybe it will be usefull for You Regards SLawek

apasupulati · ‎10-22-2013

Hello, The PAN firewall should allow the reverse telnet traffic to traverse the firewall, but we don't support reverse telnet to be enabled on the firewall. Thanks, Aditi

wijasa · ‎10-25-2013

Yes... you have right! I has not checked include/exclude list on firewall, only on agent, and on firewall was only one include subnets (from with users/IP are correct discovered). But this signifies that mechanism acts presently different/bad (In PANOS 5.0.7) After rush hour i will update fw and check it. Thanks and regards. Adam

glasater · ‎05-08-2014

You acutally should be able to do a Destination NAT with subnets but the Original Packet Destination Subnet would need to be the exact same subnet in the Destination Translated Packet Subnet. So for example if you have the Original Packet Destination Address subnet as a /24, the translated packet Destination address would need to be a /24. This would make each address have a one to one, which is required for the Destination NAT translation.

apasupulati · ‎10-22-2013

Hello, With IPsec mode enabled for GP, the client will make an ipsec connection first and use SSL connection as a fall back. Aditi

shasnain · ‎10-10-2013

This issue was reported and Bright cloud was notified and fixed with URL version 4184. So far we have not seen any issues with the new release and seems to have resolve the issue.

mbutt · ‎10-16-2013

Following docs explains how to enable it and how it works. https://live.paloaltonetworks.com/docs/DOC-1128 https://live.paloaltonetworks.com/docs/DOC-4882 . Hope this helps. Thanks Numan

panos · ‎10-10-2013

Traffic and threat syslog will not come until you configure from security rule.Just remove forwarding from rules.

dieter_b · ‎10-10-2013

Depends on how they log on. Does the user have full access permission to the 2nd mailbox ? If so, you can make everything work with the same credentials. Or does the 2nd mailbox actually require logging on to it ? If so, you again have a logon event that will be picked up by UserID. In a AD environment, using different logins to different resources, is not really best practice for me. Give a user one account and make sure he can access whatever resource he needs with that account. You shouln't bother your users with several logins. Obviously this doesn't apply to users who do administrative tasks, where the admin account should be strictly separate from their everyday user account. I hope you get it sorted out...

soporteseguridad · ‎10-08-2013

I dont have LDAP Proxy enabled. telindus@fw1orgt(active)> show user group-mapping state all Group Mapping(vsys1, type: other): UIA Bind DN : cn=explotacio,ou=Noestandard,ou=ORGTusers,dc=orgt,dc=ad,dc=diba,dc=es Base : dc=orgt,dc=ad,dc=diba,dc=es Group Filter: (None) User Filter: (None) Servers : configured 3 servers 10.1.1.8(636) Last Action Time: 599 secs ago(took 2 secs) Next Action Time: In 3001 secs 10.1.1.249(636) 10.1.1.16(636) Number of Groups: 594 ----------------------------------------------------------------------- telindus@fw1orgt(active)> show user group-mapping statistics Name Vsys Groups Last-Action(secs) Next-Action(secs) --------------------------------------------------------------------------- UIA vsys1 594 627 secs ago(took 2 secs) In 2973 secs telindus@fw1orgt(active)> show user group-mapping statistics Name Vsys Groups Last-Action(secs) Next-Action(secs) --------------------------------------------------------------------------- UIA vsys1 594 632 secs ago(took 2 secs) In 2968 secs

KiCheon.Lee · ‎10-07-2013

I have seen capturing files after input this CLI command. Thanks.

RohJaewoong · ‎10-07-2013

Hi Aditi, Thank you very much. I solved the issue from your answer and It's a very cool feature for User-ID deployment Have a nice day! Thanks again. Regards, Roh

apasupulati · ‎10-06-2013

Hello, I've only seen this done through cli tools, using the filename in the URL does a GET request, instead you need to do a POST to submit data to the resource. Have you tried using curl or wget to import the file? example: curl --form file=@userdata.xml "http:// <firewall>/api/?type=user-id&action=set&key=XXXXXX" Your response should be - <response status="success"> <msg> <line>userdata.xml saved</line> </msg> </response> FYI: there is a known bug on files could not be uploaded to the firewall using CURL with the XML API was fixed in 5.0.4. Refer to page 17 & 18 of the following article for the input file format: https://live.paloaltonetworks.com/docs/DOC-4126 Hope that helps! Aditi

kfindlen · ‎10-15-2013

Here is the correct call to modify the phash value of an administrator. http:// <firewall>/api/?type=config&action=set&key=<key>&xpath=/config/mgt-config/users/entry[@name='username']&element=<phash>password</phash> Replace the <firewall>, <key>, username, and password attributes to appropriate values. Once the call is made you should be able to see the changed value via the get API call but the change will not take effect until a commit is completed. You can also use an API call to generate the password hash. http:// <firewall>/api/?type=op&cmd=<request><password-hash><username>user</username><password>password</password></password-hash></request>

MarkTan · ‎10-07-2013

Thanks for all the input everyone! Does anyone know of documentation besides the one posted above that can better explain QoS profiles? I keep trying to test QoS in the labs and whenever I set up my profile and QoS settings, it gives me an error that states "the regular traffic guaranteed bandwidth is less than the sum of the total guaranteed bandwidth of its children." I tried modifying my bandwidth settings, but I'm not sure what to change. I know that the max/guaranteed bandwidth for each class has to be less than or equal to the max/guaranteed of the profile, but is there any other rules that I should know about?

mario11584 · ‎11-21-2013

Thanks again for the help. I just went ahead and created a second rule with a service using the ports 60000-65000 right after the policy I mentioned previously using web-browsing. My thought is traffic for 60000-65000 won't match the previous policy but will match the very next one which contains these ports. Seems like it's working! Thanks again!

Rjschultz · ‎05-19-2014

Can someone clarify for me the setup for a "dynamic-ip-and-port" source nat on an active/active cluster? The traffic for this particular rule must be source natted to a particular x.x.2.15 address when traversing through either device and should work when either member is down. Please specify the A/A bindings required for the rule, and scenarios with and without floating IPs on the outside. Thank you. -Johnny

cmateam · ‎09-23-2013

Was just having the same problem. Turned out to be a return route as apasupulati suggested in item #3 of his post. Similar setup here in this post: Client VPN traffic and routing over IPsec Tunnel

apasupulati · ‎09-18-2013

You should be able to export the config from the Panorama VM and import it to the M-100 with no issues. Configuration like the Collector groups, managed collectors, preference lists may need to be configured after loading the VM's config to the M100 for log forwarding. 1.Save and export the Panorama VM config 2. You may edit the device IP address and hostname on the xml file and import this to the M100. 3. Load the imported config file to the M100 and commit. 4. Configure Managed log collectors and Log collector groups for log forwarding from devices. Once migration is complete, configure the firewalls to point to the M100 for log forwarding. Please refer to the below articles as well: https://live.paloaltonetworks.com/docs/DOC-5057 https://live.paloaltonetworks.com/docs/DOC-4207

apasupulati · ‎09-18-2013

As you can see from the log details, the session start time was at 10:42 and you have the log option set to log at session end (Type: end), log generated time: 12:09. So as pointed out by Anon, these might be the old sessions which timed out much later and a log was generated at session end. Thanks, Aditi

mario11584 · ‎11-18-2013

I think I found what I am looking for. Clicking on the magnifying glass next to signature shows the release the signature was included in. This should work by comparing it to our current version. Thanks a ton!

panos · ‎09-21-2013

You are afraid about split brain. use backup for management with selecting Heartbeat backup. I already did what you want to do without preemptive option.just manually flap, powered off the main device.After powering on manually switched the devices again.

jholmes · ‎09-18-2013

Sorry for the delayed response. I have the Panorama VM v5.1.2, and recently had a mgmt service crash last week. It appears that all of the preconfig'ed reports are the issue, as they are not running or generating data beyond when the mgmt service crashed due to virtual memory limits exceeded. I have an open support case for the mgmt service issue, and believe this is related since the timelines all fit. Here is a screenshot for reference

Date Registered	‎10-18-2011 01:44 PM
Date Last Visited	‎08-06-2020 04:41 PM
Total Messages Posted	87
Total Likes Received	43

Online Status	Offline
Date Last Visited	‎08-06-2020 04:41 PM

Strata

Prisma

Cortex

About apasupulati