About pankaku

pankaku · ‎10-12-2016

yes it is possbile. Check the following doc: https://live.paloaltonetworks.com/t5/Migration-Articles/How-to-perform-a-device-config-import-into-Panorama/ta-p/67742

pankaku · ‎10-03-2016

Check following doc: https://live.paloaltonetworks.com/t5/Management-Articles/Connect-Linux-Machine-to-Global-Protect/ta-p/77307 It have been tested on ubuntu 14.04 try on ubuntu 14.0.4 it should work.

pankaku · ‎09-28-2016

If security policy have log at session start or/and log at session end then logging will happen regardless of log.

pankaku · ‎09-28-2016

Please check the doc it will be helpful: https://live.paloaltonetworks.com/t5/Configuration-Articles/Apply-QoS-for-Youtube-and-streaming-media/ta-p/66036

pankaku · ‎09-27-2016

Tech support file will have your all configuration. But all the private keys,password will be removed from the config.

pankaku · ‎08-30-2016

You are not typing complete command. Use ? or pres tab twice to get avail options. test vpn ike-sa gateway <name> show vpn ike-sa gateway <name> test vpn ipsec-sa tunnel <name>

pankaku · ‎07-29-2016

Could you please share the output of the command: show system info It could be a bug in which if firewall is up for around an year or so it may loose use-ip mapping.

pankaku · ‎07-08-2016

Could you refresh with that command and paste the output of the command. tail lines 100 mp-log ms.log

pankaku · ‎07-07-2016

Yes you can see the screenshot it is test on 5060 box.

pankaku · ‎07-07-2016

You can have one VR. Prefer one BGP peer and if that BGP peer goes down then it will automatically start using second ISP Check this KB https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Prefer-a-BGP-Peer-for-Installing-a-Received-Prefix-in-the/ta-p/60071

pankaku · ‎07-03-2016

Yes.

pankaku · ‎07-03-2016

This could be a false positive.

pankaku · ‎07-03-2016

If you do a traceroute from the firewall what'sthe latency? If you bypass the firewall and plug a laptop directly what's the latency? Is it a new setup or it started happening suddenly?

pankaku · ‎07-03-2016

Please share the output of the command show job id 54836 Do another command and share the output of the command tail line 100 mp-log ms.log

pankaku · ‎07-03-2016

Palo Alto have certificate store and in that store we keep root CA certs. The Root CA of the website that you are visiting is not there in the store that's why you are getting that untrusted cert. If you google for the root ca usertrust RSA certification authority you will find people are complaining about the cert.

pankaku · ‎06-30-2016

SSH decryption cannot control the traffic/command going inside the ssh tunnel.

pankaku · ‎06-29-2016

Yes it is possible check the screenshot. Test in 5k series box

pankaku · ‎06-29-2016

https://live.paloaltonetworks.com/t5/Threat-Articles/Where-to-Get-a-Suspicious-DNS-Query-for-Testing-DNS-Sinkhole/ta-p/66048

pankaku · ‎06-29-2016

what is the service route for palo alto updates, DNS? Is the management traffic going through palo alto data interface? If yes try to create a policy on top to allow the traffic from management ip and alos check if you have proper nat rule. Check if you are able to resolve domain to ip or not.

pankaku · ‎06-29-2016

It could be the value specified in the following field: If you run the command "show routing route" how they are appearing as static.

pankaku · ‎06-29-2016

Try importing the Root ca public cert on firewall and then try. If that fails then you have to renew it on server and then import it on firewall.

pankaku · ‎06-29-2016

Let me clarify what i understand. You are able to ping from firewall's interface but not from GP tunnel interface. If that is correct then try following doc: https://live.paloaltonetworks.com/t5/Management-Articles/GlobalProtect-Users-and-Internal-Resources/ta-p/65354

pankaku · ‎06-28-2016

yes that's correct. I will let us know if we have reachability from firewall tunnel inteface to aws resources. Also try to ping from firewall's any other interface to aws resources.

pankaku · ‎06-28-2016

Do you have proper security policy in place to allow GP user to access AWs resources? Try assiging ip address on tunnel interface give ip address to tunnel interface in the pool that you are assiging to GP client and then try to ping from tunnel interface to the AWS resources. Try to ping from firewall any interface to any aws resource check if the ping is working or not.

pankaku · ‎06-28-2016

Console and management interface are the only options. If firewall are in Acitve-active then we may use data interface to access firewall.

pankaku · ‎06-28-2016

Upgrade the panorama first otherwise firewall will appear disconnected on panorama. If you upgrade panorama to 7.0.x and firewall is on 5.x.x it works but there are new feature that you should not use if you use them you will not be able to commit on firewall so its good to keep panorama and firewall on smae base version. Hope this helps!

pankaku · ‎06-23-2016

We cannot limit that but if a user login from another system his use ip mapping will get changed so according to user-ip mapping user will be mapped to only one IP.

pankaku · ‎06-20-2016

Check following documents: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-GlobalProtect-Client-to-Get-the-Same-IP/ta-p/63120 https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/globalprotect-features/static-ip-address-allocation

pankaku · ‎06-20-2016

Under HA configuration uncheck the option which is enable config sync.

pankaku · ‎06-17-2016

May be the text file have some issue or it may be the issue with the firewall. Try creating a new txt file and check if not then please open a case with support.

Date Registered	‎04-18-2015 06:03 PM
Date Last Visited
Total Messages Posted	356
Total Likes Received	77

Enterprise

Prisma

Cortex

About pankaku