About abjain

Probing is a mechanism for firewall to verify if a user is still linked to a certain IP address. The LDAP server creates user-to-ip mappings where WMI probing actively verifies a user is still valid.    If the probing cache gets too full. Firewall has a limit to how many IPs it can probe at a givem point of time.   If the probing interval is too aggressive you have more chances of running into this issue. You can adjust the probing interval to a more appropriate value to avoid this.  ... View more

I see a similar issue in the database and looks like its addresses in 8.0. Is it possible to give 8.0.X a try? I woul suggest to open a TAC case so that they can help investigate more and if applicable request a backport in 7.1 ... View more

You can set the system setting target-dp to each one: (applicable to platforms with multiple DPs)   set system setting target-dp dp0 show session info set system setting target-dp dp1 show session info set system setting target-dp dp2 show session info set system setting target-dp none   Extract values from each and then add.  ... View more

"> show session info " output contains current throughput, packet rate etc. You can fetch this via xml api and plot it. However this is not historic or average value and shows the value at that point.   You can also use netflow to send interface based statistics. : https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-logging/monitor-the-firewall-using-netflow.html   CLI can be used as well to check live packet rate on each interface: https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Check-Throughput-of-Interfaces/ta-p/58812   However this is not something you can fetch using a monitoring tool.   ... View more

Could you check the GP client logs, PanGPS.log and PanGPHipMP.log and see if it is reporting any errors.   It could be a software isssue, I would suggested to open a TAC case for the same. ... View more

On Panorama, commit link will stay active even if any device group or template devices are out of sync. Can you confirm that all your firewalls managed from Panorama are in sync? ... View more

What kind of features are you using on the firewall?   1. Captive Portal? 2. Security Profiles? 3. Security policies with applications? 4. SSL decryption?   Have you tried creating a trust to untrust allow all policy and see if it works?   We have seen Palo Alto GUI interface or GP or Captive Portal Page returning 502 bad gateway some times. Is it possible that this traffic is getting redirected somehow to Palo Alto Interface?     ... View more

Hi,   Could you enable debug on GUI:   https://<ip-address>/debug https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Run-a-PAN-OS-Web-UI-Debug/ta-p/58117   Then do the changes you are talking about from GUI, and then refresh the debugs.   If the debugs dont give much idea, please open a case with TAC. This may be a software issue they can help take a look into.   BR   ... View more

Are you able to perform a capture and packet-diag for the BFD packets from Zone B to Zone A? If yes please attach them here. If you have a TAC case please give me the number. I can help take a look.   ... View more

Hi,   More details on design and network topology would help to suggest better. In general, it is hard for you to decide which route to accept in OSPF. You can ofcourse put your PA as a Total Stub so that it wont accept any Type3,4,5. However you need to design it properly as other OSPF speaking neghbors will also be affected.   -BR     ... View more

  Hi,   You can use the following command:    > debug system interface-xcvr-info aux-1           Identifier           : 0x03 (SFP)         Extended identifier : 0x04 (GBIC/SFP defined by 2-wire interface ID)         Connector           : 0x07 (LC)         Transceiver codes   : 0x00 0x00 0x000x01 0x00 0x00 0x00 0x00                             :   => Ethernet: 1000BASE-SX         Encoding             : 0x01 (8B/10B)         BR, Nominal         : 1300MBd         Rate identifier     : 0x00 (unspecified)         Length (SMF,km)     : 0km         Length (SMF)         : 0m         Length (50um)       : 550m         Length (62.5um)     : 270m         Length (Copper)     : 0m         Length (OM3)         : 0m         Laser wavelength     : 850nm         Vendor name         : OEM                       Vendor OUI           : 00:00:00         Vendor PN           : PAN-SFP-SX               Vendor rev           : 2.0   > show system state | match aux-1   cfg.aux_intf.map: { 'aux-1': eth5, 'aux-2': eth6, } cfg.ha.net.s0.out-of-band: { 'additional-ha1': [ ha1-b, aux-1, aux-2, ], 'aux-1': eth5, 'aux-2': eth6, 'default-ha1': ha1-a, 'default-ha2': hsci, 'default-ha3': hsci, 'ha1-a': eth1, 'ha1-b': eth2, 'hsci': sys.s1.ha1., 'management': eth0, 'mirror': [ ha1-a, ha1-b, hsci, ], } cfg.net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'ip-type': static, 'ipaddr': , 'ipv6addr': , 'mtu': 1500, 'netmask': , 'onboot': True, 'routes': { 'default': , }, 'table': aux-1, 'up': True, 'v6routes': { 'default': , }, } net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'hwaddr': d4:f4:be:c3:9f:e2, 'ifindex': 7, 'ip-type': static, 'ipv6linklocal': fe80::d6f4:beff:fec3:9fe2/64, 'mtu': 1500, 'onboot': True, 'routes': { 'default': , }, 'running': True, 'table': aux-1, 'up': True, 'v6routes': { 'default': , }, }           > show system state | match eth5   cfg.aux_intf.map: { 'aux-1': eth5, 'aux-2': eth6, } cfg.ha.net.s0.out-of-band: { 'additional-ha1': [ ha1-b, aux-1, aux-2, ], 'aux-1': eth5, 'aux-2': eth6, 'default-ha1': ha1-a, 'default-ha2': hsci, 'default-ha3': hsci, 'ha1-a': eth1, 'ha1-b': eth2, 'hsci': sys.s1.ha1., 'management': eth0, 'mirror': [ ha1-a, ha1-b, hsci, ], } cfg.net.s0.eth5.acl: { 'peers': [ ], 'services': [ ssh, https, icmp, ping, icmp, ], 'v6peers': [ ], } cfg.net.s0.eth5.acl-extra.ha: { 'direct': { }, 'services': [ ], } cfg.net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'ip-type': static, 'ipaddr': , 'ipv6addr': , 'mtu': 1500, 'netmask': , 'onboot': True, 'routes': { 'default': , }, 'table': aux-1, 'up': True, 'v6routes': { 'default': , }, } cfg.net.s0.eth5.hwcfg: { 'mode': 1, 'setting': 1, } net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'hwaddr': d4:f4:be:c3:9f:e2, 'ifindex': 7, 'ip-type': static, 'ipv6linklocal': fe80::d6f4:beff:fec3:9fe2/64, 'mtu': 1500, 'onboot': True, 'routes': { 'default': , }, 'running': True, 'table': aux-1, 'up': True, 'v6routes': { 'default': , }, } net.s0.eth5.hwcfg: { 'advertised': [ 1Gb/s-full, auto, ], 'link': Up, 'mode': Autoneg, 'setting': 1Gb/s-full, } net.s0.eth5.stats: { 'rx-bytes': 0, 'rx-compressed': 0, 'rx-drop': 0, 'rx-errs': 0, 'rx-fifo': 0, 'rx-frame': 0, 'rx-multicast': 0, 'rx-packets': 0, 'tx-bytes': 0, 'tx-carrier': 0, 'tx-colls': 0, 'tx-compressed': 0, 'tx-drop': 0, 'tx-errs': 0, 'tx-fifo': 0, 'tx-packets': 0, }     Regards   ... View more

Hi,   I guess having NATs in Shared gateway will be more appropriate. If you configure NAT on vsys, there will be routing considerations on the Shared gateway vsys.   Here is an article for a bidirectional NAT involving shared gateway: https://live.paloaltonetworks.com/t5/Configuration-Articles/Configuring-Destination-NAT-using-a-VSYS-with-Shared-Gateway/ta-p/55187   Please see if it helps. You can approach TAC if need any specific help.   Best Regards, Abhishek ... View more

Hi,   Did you had a chance to look at https://live.paloaltonetworks.com/t5/Management-Articles/DNS-Suffix-is-not-Listed-under-GlobalProtect-Network-Adapter/ta-p/58001   If this is already verified, could you check if the issue is specific to any Client OS/ GP version?   BR ... View more

As I understand syslog facility is used on the syslog server to decide which log goes into which file. Facility will not help to increase or decrease the level of logging on the firewall.   As per RFC: https://tools.ietf.org/html/rfc3164 following are the facility codes defined:     Facility code Keyword Description 0 kern kernel messages 1 user user-level messages 2 mail mail system 3 daemon system daemons 4 auth security/authorization messages 5 syslog messages generated internally by syslogd 6 lpr line printer subsystem 7 news network news subsystem 8 uucp UUCP subsystem 9   clock daemon 10 authpriv security/authorization messages 11 ftp FTP daemon 12 - NTP subsystem 13 - log audit 14 - log alert 15 cron scheduling daemon 16 local0 local use 0 (local0) 17 local1 local use 1 (local1) 18 local2 local use 2 (local2) 19 local3 local use 3 (local3) 20 local4 local use 4 (local4) 21 local5 local use 5 (local5) 22 local6 local use 6 (local6) 23 local7 local use 7 (local7)   Whereas the severity under the Log forwarding profile helps to decide what kind of logs you want to send to the syslog server.   You can choose to send different severity logs to the same syslog server with different facility values, so that they can be handled separately by the server. I hope this helps.   -BR ... View more

Please read this document for understanding how Dos protection works: https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-DoS-Protection/ta-p/54562   You need to look at aggregate profiles and classified profiles for understanding how will firewall classify dos attack in case of DDOS. ... View more

Could you share more details of your requirement along with some topology? That way we can make more suggestions ... View more

I think you are past the query obout priority, but I dont see how priority will affect anything here. Priority on OSPF interfaces is to influence the DR/ BDR election. In this case I think metric should be used to influence which path should be used.   I am assuming you have a topology like this.   PAN ------ PE ---- MPLS (BGP) ---- PE------ Remote Site   \ -------------- OSPF over IPSEC --------------/   In this case you can ask PE to run BGP with PAN firewalls and then you can use administrative distance for BGP learned routes to be preferred over OSPF learned routes over the tunnel. Also from the PAN firewalls you will have to redistribute the local routes to BGP peers.   Or if you are interested in running OSPF on PAN, then you can do the same, provided the PE router and the PAN share a common network. In this case, you cannot let the OSPF over IPSEC and OSPF to PE run in same virtual router as it will cause the OSPF to advertise your link to PE over IPSEC, which will cause tunnel to flap.   You will need to have to use another virtual router for the OSPF to PE. You can still use the same area as the one for IPSEC ospf. ... View more

Hi,   For the use of special caharacters in GP, there was a bug reported which is fixed in 7.0.2 onwards. This seems to be an issue in 7.0.1 only.   https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os-release-notes/pan-os-7-0-2-addressed-issues.html   -> Bug 82675   For case senstitive usernames, please report this to support team.     BR ... View more

Could you verify the licenses are proper and installed and updated in the support portal?   Also please enable debug mode on management server and collect the logs:   > debug management-server on debug > tail follow yes mp-log ms.log   Now do a Check Now from GUI or "request content upgrade check" from another CLI to see what are the logs showing.   At the end set the management-server debug to info level:   > debug management-server on info    If licenses are properly installed, and logs do not show enough information, kindly open a support case ... View more

Hi,   In your case, when ISP connected to PA is down, is all the forward traffic (Client-> Internet) still going through the Palo Alto?   Two things are possible:   1. When Palo Alto forwards traffic back to Cisco, it sends a ICMP redirect to the L3 switch. I don't think PA does that. 2. Palo Alto sends traffic to Cisco, which forwards it out to Internet, but the reply traffic is forwarded directly by Cisco to L3 switch.    In case 2 above, Palo Alto will only be seeing half of the traffic and this is a scenario of asymmetric routing. Palo Alto session will not see a SYN/ACK so the session does not matures and times out after 5 seconds (Default TCP init timeout).   You can do two things,   1. Allow asymmetric bypass on the PA firewall and disable TCP Reject Non SYN:   # set deviceconfig setting tcp asymmetric-path bypass #  set deviceconfig setting session tcp-reject-non-syn no # commit   2. Do a hair pinning NAT, so that when PA firewall forwards the traffic to Cisco, it does a source NAT on this traffic, so that the Cisco will see traffic coming from PA, and hence will forward reply packets to PA. For this create a source NAT rule from trust to trust zones doing a source NAT on e1/1 IP.   Regards ... View more