About Mystique

Mystique · ‎02-02-2015

If OS version 6.0 and above then, tail follow yes mp-log pan_dhcpd.log or tail follow yes mp-log dhcpd.log

Mystique · ‎01-21-2015

Please try the steps as described in below document to test the connectivity issues: CLI Commands for Troubleshooting BrightCloud URL Database Download I did a quick test in the lab firewall and I am seeing same issue admin> request url-filtering upgrade brightcloud BrightCloud URL filtering database update initiated admin> tail follow yes mp-log pan_bc_download.log Jan 21 09:46:43 Loading BrightCloud URL categories... Jan 21 09:47:54 ip 23.21.220.40 message RT time 59.825 Jan 21 09:48:54 ip 23.21.130.104 message RT time 60.044 Jan 21 09:49:55 ip 54.225.204.169 message RT time 60.663 Jan 21 09:50:55 ip 50.19.230.248 message RT time 59.964 Jan 21 09:51:00 Best IP for service.brightcloud.com is 23.21.220.40 Jan 21 09:51:00 Connected to Brightcloud update server service.brightcloud.com, initiated by 10.66.18.89 Jan 21 09:51:59 Cannot receive data from 'service.brightcloud.com:80' to download BrightCloud URL database Jan 21 09:52:02 Error downloading latest URL database

Mystique · ‎01-20-2015

please check authd logs for any issues related to authentication by using below cli command > tail follow yes mp-log authd.log If the end user is getting some sort of block page then check traffic and URL logs under Monitor --> Logs

Mystique · ‎01-16-2015

Same applies for modifying existing security policy. See below. For e.g. trust-to-untrust is existing security policy, then you can add application filter by navigating to Application tab under existing security policy

Mystique · ‎01-16-2015

Please refer to this document How to Create Application Filter to Block High Risk Applications Note: Please mark answers as "correct answer" or "helpful answer" if it helped in anyway.

Mystique · ‎01-14-2015

There is an existing feature request for this. FR ID 1370 - URL Column length limit in reports Please contact your SE to vote for it. Note: Please mark answers as "correct answer" or "helpful answer" if it helped in anyway. Thanks

Mystique · ‎01-14-2015

Please refer to this document to understand in detail how PAN will detect Bittorrent traffic How does detection of Bittorrent work on the PAN

Mystique · ‎01-14-2015

There is no settings available to truncate URLs for reports. The dataplane can handle hostnames up to 62 characters for BrightCloud and up to 255 characters for PAN-DB. If you are using PAN-DB, then you will see string upto 255 characters long. Helpful discussion and document Re: URL length limitation in PAN-DB Long URLs Categorized as Unknown

Mystique · ‎01-12-2015

Hello Lewis, Thanks for the update. Rebooting the device might not fix the issue. Temporary fix is to remove corrupted files from root and permanent fix is to upgrade to 6.0.2 or later version. Note: Please mark answers as "correct answer" or "helpful answer" if it helped in anyway. Thanks

Mystique · ‎01-09-2015

Hello, This is a known bug ID 62321 and fixed in 6.0.2 build. For workaround, TAC will need to delete some corrupted mongodb journal files manually from root. Please continue to work with support to purge few files from root to gain access. Hope this helps

Mystique · ‎01-08-2015

Hello, This is non-configurable option and it is an automated process. You can use run now to generate the report right away.

Mystique · ‎01-07-2015

You can just click on + (add filter) symbol under Monitor --> Traffic or Threat or URL etc. and then use Add log filter to get desired results. Helpful doc: How to Add, Save, Load, and Clear Log Filters

Mystique · ‎01-06-2015

This error - Error: Failed to parse security policy was clue for issue being with security policy. Glad to know upgrade was successful. Have a great day ahead!!

Mystique · ‎01-06-2015

I can see the whole group name as below from cli command output cn=all students,ou=groups,ou=students,dc=cadets,dc=cbchs,dc=org Can you please try to delete the security rule in which this group name is being used and then commit. If commit is successful, then reconfigure the security rule again. Hope this helps. If not then you might want to open a support case to further troubleshoot the issue live.

Mystique · ‎01-06-2015

can you send output of below command from PA FW CLI active or passive device: > show user group list

Mystique · ‎01-06-2015

Hello Robertsa, Is this HA pair and is the commit failing only on passive device ? If so, then please make sure root CA certificate is not missing on the passive device. If its missing, then manually reconfigure it and then sync the devices and commit again. Hope this helps

Mystique · ‎12-31-2014

Hello, If you can login to panorama using SSH, then please share output of below command to confirm if the issue is related to not having enough space left on either of the disk > show system disk-space

Mystique · ‎12-05-2014

Other alternative is to configure a pre-shared secret based authentication method. Either way you will need to use some kind of authentication method. Same document, please refer to page 8-9 Configuring a Pre-Shared Secret on the GlobalProtect Gateway 1. On the GlobalProtect Gateway, navigate to Network > GlobalProtect > Gateways and create a new Gateway configuration or modify an existing Gateway. 2. From the General tab, enable Tunnel Mode and then select Enable IPSec and Enable X-Auth Support. 3. Enter a Group Name. 4. Enter and confirm the Group Password. 5. Click Ok and then commit the configuration. Configuring a Pre-Shared Secret on the Android Device 1. On the Android device, open Settings > Wireless and networks > More > VPN. 2. Click Add VPN network. 3. Enter a descriptive name for the profile in the Name field. 4. In the Type drop-down, select IPSec Xauth PSK as the type. 5. In the Server address field, enter the address of the GlobalProtect Gateway. 6. Enter the group name configured previously in the IPSec identifier field. 7. Enter the group password in the IPsec pre-shared key field. 8. Save the configuration. 9. To establish a VPN, go to Settings > Wireless and networks > VPN and select the new VPN profile. 10. Click Connect and you will be prompted for your username and password. Once authenticated, the VPN will be established.

Mystique · ‎12-05-2014

Hello Niuk, For certificate based auth using droid phone, you must manually export and import the certificates. Please refer to this document GlobalProtect Configuration for the IPSec Client on Android Devices Page 5 Hope this helps.

Mystique · ‎12-03-2014

Hello Dannon, The DCOM errors are most probably due to WMI probing for IPs that are not responding. Can you please disable WMI probing under user-ID setup and test to see if the system error messages stopped ? On PAN User-ID agent, go to setup --> click edit --> client probing --> uncheck WMI probing checkbox Helpful doc: User-ID Agent Generating DCOM and Kerberos System Errors

Mystique · ‎10-27-2014

You can use xml api to monitor the tunnel status. Please refer to below document: How to Monitor VPN state through XML API You can also setup profile for system logs to be forwarded via Email or SNMP Trap by creating log setting profile under Device --> Log setting --> System --> select severity Whenever a tunnel is down, then system logs are created for the specific tunnel. Please note this could possibly flood your emails if you select forwarding for all types of severity. There is no way to filter the system logs only for tunnels before forwarding via Email or to syslog server Hope this helps.

Mystique · ‎10-27-2014

If there are any issues while using management interface then you can always look at the logs under > tail follow yes mp-log ms.log

Mystique · ‎10-08-2014

Hello Bob, Please refer to this document for configuring qos to limit bandwidth for bittorrent or any other applications. Qos policy can be configured to make it applicable to source user and application as shown below in screenshot#2 (youtube as example). https://live.paloaltonetworks.com/docs/DOC-3439 I had once tested in the lab for youtube application, please refer to below screenshots as sample configuration. In your setup, you might want to change the guaranteed and max egress bandwidth per requirements. Similarly, you can setup for bittorrent as application. Please also refer to this thread - Implementing QoS Hope this helps.

Mystique · ‎07-04-2014

Hello Gururaj, You can go to Firewall Migrations to get access to MT2.1 If in case you do not have access to above link, then please go to our partner portal and login. Click the link below to access the partner portal: NextWave Partners Program Please note that we provide limited support for the Firewall Migration Tool. If you need assistance, please contact your sales engineer. Hope this helps.

Mystique · ‎06-25-2014

Palo Alto Networks does not intregrate with Websense. It uses either Brightcloud or proprietary PanDB, for looking up the categories. You can use either Brightcloud or PanDB, if you want the PANFWs to perform any URL filtering. You will need licenses for the same.

Mystique · ‎06-25-2014

In case of CA like verisign or digicert, you need to import chained certificate signed by the Public CA This document is very helpful: How to Install a Chained Certificate Signed by a Public CA

Mystique · ‎06-24-2014

You can use this filter (addr notin 'ip address') to filter out the additional addresses in addition to the above subnet filter ( addr in 120.50.47.0/24) For e.g. ( addr in 120.50.47.0/24) and (addr notin '120.50.47.1') or you can use more subnet specific filters for e.g. just for range ex: 120.50.47.20 - 120.50.47.30, the filter will look like ( addr in 120.50.47.20/28)

Mystique · ‎06-24-2014

You can use filter as ( addr in 120.50.47.0/24) under Monitor --> Logs --> Traffic Hope this helps.

Mystique · ‎06-18-2014

Hello ecardona, The ISAKMP header is supposed to be 28 bytes, so I think this message is saying that a header received is smaller than 28 bytes. 'packet (5) shorter than isakmp header size.' Please share output of below command when you are trying to connect via VPNC client > tail follow yes mp-log ikemgr.log Thanks.

Mystique · ‎06-18-2014

Yes, you will need to turn off the VM in order to increase the size. Please refer to Page 27 of Panorama Admin Guide for detailed steps: Panorama Administrator's Guide 6.0 (English)

Date Registered	‎05-03-2013 07:20 AM
Date Last Visited	10 hours ago
Total Messages Posted	64
Total Likes Received	23

Online Status	Offline
Date Last Visited	10 hours ago

Strata

Prisma

Cortex

About Mystique