Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About howardtopher
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About howardtopher
10-07-2021
29Posts
7Likes
2Solutions
Oct 07, 2021Last Visited
User
Activity
User
Profile
Latest posts by howardtopher
| Subject | Views | Posted |
|---|---|---|
| 653 | 10-07-2021 01:00 PM | |
| 717 | 10-05-2021 07:27 AM | |
| 777 | 10-04-2021 12:03 PM | |
| 10705 | 06-21-2019 06:36 PM | |
| 6394 | 11-07-2018 12:43 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 3 Likes | 09-11-2018 11:24 AM | |
| 1 Like | 09-06-2018 06:45 PM | |
| 1 Like | 02-16-2017 09:25 AM | |
| 1 Like | 08-26-2015 10:51 AM | |
| 1 Like | 08-21-2015 01:31 PM |
User Badges
Community Statistics
| Member Since | 05-18-2015 07:06 PM |
| Date Last Visited | 10-07-2021 04:20 PM |
| Posts | 29 |
| Total Likes Received | 7 |
10-07-2021
01:00 PM
Interesting. I checked the same commands on my firewall and it also shows ifindex 7. However, when I do the snmpwalk or look in the monitoring system, ifindex 7 shows up as ethernet1/3. It also shows "admin down" and "no connector", which is correct for ethernet1/3 as I'm not using it. It's really strange. 🙂
... View more
10-05-2021
07:27 AM
I have aux-1 enabled because that's the one I'm using. I don't need aux-2 so it's not enabled. The snmp walk that I ran was after enabling aux-1. I ran it again just to be double sure, and aux-1 is not there.
... View more
10-04-2021
12:03 PM
Is it possible to see the aux ports on a PA-5200 series firewall through the SNMP interface mib? These are currently the interfaces that show up, the aux ports are not there. This is on 9.1.11, PA-5250 to be specific. ifName.1 = STRING: ha1-a ifName.2 = STRING: ha1-b ifName.3 = STRING: hsci ifName.4 = STRING: mgmt ifName.5 = STRING: ethernet1/1 ifName.6 = STRING: ethernet1/2 ifName.7 = STRING: ethernet1/3 ifName.8 = STRING: ethernet1/4 ifName.9 = STRING: ethernet1/5 ifName.10 = STRING: ethernet1/6 ifName.11 = STRING: ethernet1/7 ifName.12 = STRING: ethernet1/8 ifName.13 = STRING: ethernet1/9 ifName.14 = STRING: ethernet1/10 ifName.15 = STRING: ethernet1/11 ifName.16 = STRING: ethernet1/12 ifName.17 = STRING: ethernet1/13 ifName.18 = STRING: ethernet1/14 ifName.19 = STRING: ethernet1/15 ifName.20 = STRING: ethernet1/16 ifName.21 = STRING: ethernet1/17 ifName.22 = STRING: ethernet1/18 ifName.23 = STRING: ethernet1/19 ifName.24 = STRING: ethernet1/20 ifName.25 = STRING: ethernet1/21 ifName.26 = STRING: ethernet1/22 ifName.27 = STRING: ethernet1/23 ifName.28 = STRING: ethernet1/24
... View more
06-21-2019
06:36 PM
Crap. I wish I had seen this or any notice anywhere before about 2 hours ago. I would have gone to 8.1.7. I only get one maintenace night a year to do these upgrades and now I'm probably stuck with this mess till next June. I've already dealt with globalprotect tunnel warnings that IPv6 is ignored (this here), and now this. My warning list is massive. I guess I could try and sneak in a 3am upgrade on a holiday when we're closed. Perhaps July 4th.
... View more
11-07-2018
12:43 PM
Our PAN-OS is 8.0.10. Maintenance night is next Friday, we'll jump to 8.0.13 at that point unless 8.0.14 gets released before then. Globalprotect is 4.1.5. I tried setting the timeout to 1 second and retries to 1 in the server profile, but that didn't make a difference. The globalprotect client says "connecting..." for a good 30 seconds before giving up (I haven't timed it, but it's feels long). The CLI fails over to the second server in the 1 second timeout that's configured.
... View more
11-07-2018
10:15 AM
For globalprotect I have a radius server profile with two servers in it. I have noticed that all authentication goes to the first server in the list all the time. And that works. However, in testing, I have shut off the first server and the firewall never tries to send authentcation to the second server. If I use the "test authentication" command on the firewall CLI, it does fail over to the second server and authentication succeeds. If I go back to the globalprotect client and try again, the firewall only tries the first server and authentication fails. I have verified this with packet captures on the actual radius servers. This seems to be incorrect behavior. Is it possible that there is a known bug about this? I'm using the same authentication profile in the globalprotect portal configuration as I am on the test CLI command.
... View more
09-11-2018
11:24 AM
3 Kudos
So here's what I ended up doing. One portal. It's on a floating IP that floats from firewall to firewall as needed. Two gateways, one for each firewall. IP is on the interface itself, not floating. Each gateway has its own block of IPs for VPN terminations. Portal is configured to have both gateways with equal priority (let the client decide where to connect). So far this is the cleanest and removes the routing problem. The only issue is that failover is not clean for users that are currently connected as the client has to terminate one tunnel and reconnect to the other gateway, but it does work.
... View more
09-07-2018
10:17 AM
Yes, the DNS will round robin, but the expectation is that if a gateway/portal had gone offline users would still be able to get to the remaining one. There might be a delay as the connection times out and DNS gets hit again, Just a thought, but configuring a double of everything is a big pain.
... View more
09-06-2018
06:45 PM
1 Kudo
I'm having a hard time finding much, if any, documentation on this scenario. I've tried a couple ways of doing it and they work, but I'm trying to figure out what the best way to do it while being as redundant as possible. What I like the best so far is to have the portal and a gateway up on a floating IP so it can bounce from one firewall to the other as needed. However, doing that adds a route to the virtual router on both firewalls for the tunnel (client) addresses. If a client connects and gets terminated to the tunnel interface on firewall 1, accesses a service, and then return traffic comes back into firewall 2, it dies because it thinks the client is on that tunnel interface, when it isn't. Does that make sense? If there was a way to have the tunnel interface also follow the floating IP that would be great. This would only install the route on the firewall that needs it. Another way I thought of doing it is a portal and gateway on firewall 1, and a portal and a gateway on firewall 2. Then in my DNS, the portal DNS record (vpn.domain.com) answers with both portals and the gateway DNS record (gw.domain.com) answers with both gateways. That doubles the configuration that has to be made, but solves the route being installed on both firewalls when clients are only connected to one firewall. Is there a proper way to do this?
... View more
07-27-2018
02:14 PM
New to SSL Inbound Inspection here. Running 8.0.10 at the moment. Have a pair of 5050s running in active/active HA. I think I have everything configured properly as it appears to be working, mostly. When I initiate a connection from client to server and then look at traffic logs, one firewall decrypts traffic fine, the other one has a bunch of "decrypt-error" messages. If I initate a new connection, the firewall that had the errors now decrypts fine and the one that was working has the decrypt-error messages. It almost appears like which ever firewall "owns" the session decrypts ok and the other "peer" gets all the decrypt-error logs. Is this normal or have I done something incorrectly?
... View more
08-16-2017
11:56 AM
When making changes to firewalls through panorama, there is a history of those changes made. When you go to the dashboard there is a widget that shows the last handful of config changes, so I know they are there. Where in panorama can I go to view the history of that log? There is no "configuration" section under the monitor tab like there is for a normal firewall.
... View more
07-31-2017
01:13 PM
That's unfortunate. I was hoping to add that interface to my "outside world connectivity" dashboard, but I guess that won't be happening.
... View more
07-18-2017
10:46 AM
Using physical PA boxes, this works fine. However, with the VM version (at least in Azure) it does not. Only the mgmt interface shows any traffic when reading interface statistics through SNMP. Is this a known issue? ethernet1/1 is the untrusted interface and I'd like to chart utilization of it, but it just stays 0. IF-MIB::ifInOctets.1 = Counter32: 271149367 IF-MIB::ifInOctets.2 = Counter32: 0 IF-MIB::ifInOctets.3 = Counter32: 0 IF-MIB::ifInOctets.4 = Counter32: 0 IF-MIB::ifInOctets.5 = Counter32: 0 IF-MIB::ifInOctets.6 = Counter32: 0 IF-MIB::ifInOctets.7 = Counter32: 0 IF-MIB::ifInOctets.8 = Counter32: 0 IF-MIB::ifDescr.1 = STRING: mgmt IF-MIB::ifDescr.2 = STRING: ethernet1/1 IF-MIB::ifDescr.3 = STRING: ethernet1/2 IF-MIB::ifDescr.4 = STRING: ethernet1/3 IF-MIB::ifDescr.5 = STRING: ethernet1/4 IF-MIB::ifDescr.6 = STRING: ethernet1/5 IF-MIB::ifDescr.7 = STRING: ethernet1/6 IF-MIB::ifDescr.8 = STRING: ethernet1/7
... View more
05-02-2017
02:16 PM
I just upgraded our panorama to 8.0.2. We don't have any external log collectors and only store logs locally on panorama. I'm don't seem to be able to start the log migration process. The error it gives is the serial numer is invalid. I'm using the panorama serial number in the command. Am I doing something wrong? Do I have to convert to "panorama mode" first? > request logdb migrate lc serial-number xxxxxxxxxxx start Server error : xxxxxxxxxxx is invalid serial-number.Current target-vsys is none request -> logdb -> migrate -> lc -> serial-number is invalid
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-07-2021
04:20 PM
|
Likes From
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
