About zarina

zarina · ‎05-28-2014

It depends on the number of logs the panorama receives. This document might help you with the calculation: Panorama Logging Suggestions for PAN-OS 4.1 and 5.0

zarina · ‎10-18-2013

'ez' is the hardware chip present in 4000 platform which is responsible for offloads and QoS. FID is the file identifier descriptor which has the index to this session.

zarina · ‎10-08-2013

"highlight unused rules" shows the rules that are not used by the device since the start of the dataplane.

zarina · ‎09-27-2013

I was able to confirm this behavior in the lab: zones & comments get synced between the 2 devices. This is an expected behavior as the zones & interfaces get synced except for ip addresses in A/A setup. You can refer this document for a list of configs that sync between the peer units: https://live.paloaltonetworks.com/docs/DOC-5086

zarina · ‎09-27-2013

You can find the definition for incomplete here: https://live.paloaltonetworks.com/docs/DOC-1549 As for the traffic, you can also look at the sessions to see if there are any packets from server to client. You can view this data from GUI through Monitor -> Traffic logs -> Click on the magnifying glass and look for packets sent and packets received. From cli you can do: show session all filter <interesting traffic> and show session id <id>. You can also look at the global counters to see if there are any drops. You can alos refer to these documents for troubleshooting using counters & captures: https://live.paloaltonetworks.com/docs/DOC-2542 https://live.paloaltonetworks.com/docs/DOC-2310

zarina · ‎09-27-2013

You can get this list using API. Generate an API key for the session: https:// <ip_address>/api/?type=keygen&user=<username>&password=<password> and use it in the syntax below: https:// <ip_address>/api/?type=config&key=<obtained_from_above>&action=get&xpath=/config/predefined/application

zarina · ‎09-27-2013

Do you have the same issue when using a different browser? If you want to add the route from CLI: > configure # set network virtual-router vr1 routing-table ip static-route <name_of_route> + admin-dist adminitrative distance + destination Destination IP address/prefix + interface interface + metric metric value (path cost) > nexthop Next hop to destination > option Route entry option <Enter> Finish input

zarina · ‎09-19-2013

We will retain the DSCP tag of the ingress traffic. The tag will only be changed when traffic egresses through PAN using a policy which has DSCP tag option set.

zarina · ‎09-16-2013

You can goto Tools - Palo Alto Networks Blog and click on Submit App for Content team to develop a signature.

zarina · ‎09-16-2013

From the GUI: Dashboard -> System Information or Device -> Software : The PAN OS installed has the Currently Installed column checked

zarina · ‎08-07-2013

You can view the MP mappings through: > show user ip-user-mapping-mp all DP mappings: > show user ip-user-mapping all

zarina · ‎08-05-2013

Have you looked at this document https://live.paloaltonetworks.com/docs/DOC-4126 page 11: "..retrieve a dynamic report data using reporttype=dynamic, reportname=custom-dynamic-report, and cmd=report-definition where report definition is the XML definition retrieved from the xml api get"

zarina · ‎07-23-2013

Also, please make sure you have GP portal and GW license and also the GP data file is installed (Dynamic Updates -> GlobalProtect Data File).

zarina · ‎07-23-2013

Are you using self signed certificate for the portal & gateway? If not, can you make sure to include the entire certificate chain under Trusted Root CA section of portal config?

zarina · ‎07-23-2013

Do you see any hip profiles associated with the GP user: > show user ip-user-mapping ip <gp_ip> You can also verify the the hip database: > debug user-id dump hip-profile-database Also, can you look at the sslvpn logs and look for " POST /ssl-vpn/hipreportcheck.esp HTTP/1.1" > less webserver-log sslvpn-access.log

zarina · ‎07-23-2013

You can set the action to allow/deny URLs when the license expires: https://live.paloaltonetworks.com/docs/DOC-4329

zarina · ‎07-20-2013

Captive portal will only with with web based traffic: http and https (with decryption enabled).

zarina · ‎07-03-2013

QoS statistics graph shows you the usage of realtime bandwidth. If you want to monitor the bandwidth usage, you will need to use third party tools like Netflow or the templates listed here: https://live.paloaltonetworks.com/thread/4367?tstart=0

zarina · ‎07-03-2013

The ip-user mapping is received through the agent. If you need to use groups/users in the policy make sure to configure group mapping on the device: Device -> User Identification -> Group Mapping Settings

zarina · ‎06-28-2013

This will help you to view the config in different formats: https://live.paloaltonetworks.com/docs/DOC-1300

zarina · ‎06-24-2013

Looks like the CRL/OSCP check is timing out - look at Status: timed-out and hence the error message. Can you verify if there is any network latency in retrieving the crl list or reaching the server itself?

zarina · ‎06-11-2013

We do not have a mechanism to turn logging off for these profiles. If you need this feature, reach out to your SE to file a feature request.

zarina · ‎05-29-2013

you can look at indexgen logs for any error messages: less mp-log indexgen.log

zarina · ‎05-23-2013

The userid option is introduced in 5.0 and need to be enabled when you are using the agentless user id and also when distributing the mappings to other firewalls

zarina · ‎05-23-2013

We are working on this issue where when multiple sub interfaces are configured for DHCPv6, only one sub interface works. Please open a case with Support or your reseller to get further details/updates on this issue.

zarina · ‎05-23-2013

If the GP client is lower than 1.2.x, the command is PanGPUpdateer.exe -u for 1.2.x and greater, it is PanGPS.exe -u

zarina · ‎05-22-2013

Hope this document helps: https://live.paloaltonetworks.com/docs/DOC-2695 When GP is installed, we modify the gina dll which is why you are presented with a login. You can run the command listed in the document to restore the auto login.

zarina · ‎05-20-2013

We do not have a support for this feature at this time. Please contact your SE to file a feature request if you want this included in the future versions.

zarina · ‎05-17-2013

Yes. You should be able to select the loopback interface in your NAT policy

zarina · ‎05-15-2013

You can customize the captive portal authentication page but we do not support a redirection of the URL to a specific URL after authentication.

Date Registered	‎11-14-2011 01:02 PM
Date Last Visited	‎03-04-2020 02:10 PM
Total Messages Posted	210
Total Likes Received	89

Online Status	Offline
Date Last Visited	‎03-04-2020 02:10 PM

Strata

Prisma

Cortex

About zarina