About nextgenhappiness

@simsim    The pro is easy to setup to allow remote access to your network using RDP.. The con is without sufficient protection and monitoring in place (ie MFA, patch system, log monitoring), once the hacker gains access via RDP.  The damage that can cause is unlimited.     E   ... View more

Let's see, once I am able to RDP login to a host which is part of the AD.  The opportunity is endless.     I can start by following these steps which I just finish #2,   Reconnaissance Initial intrusion into the network Establish a backdoor into the network Obtain user credentials Install various utilities Privilege escalation/ lateral movement/ data exfiltration Maintain persistence Google "pass the hash" , "windows privilege escalation"      or I just drop a ransomware on the file servers to lock all the user data , etc. etc... ... View more

Let me understand your question,   Allow anyone from Internet able to connect to a system listen on Remote Desktop protocol on your network?    Is that what you are asking?   1.  How update is the system patch level? 2.  There could be a chance of non-publicly disclosure bugs on RDP can use a backdoor (also known as 0 days attack, which I disagree with that term). 3.  How is the password complexity and length?  Does it require multi factor authentication?   Is it a client cert based login authentication? 4.  If I am able to login to that host,  is that system part of Corp Active Directory?  How secured is the AD admin accounts? and more and more...     ... View more

thanks!  let's us know if the change helps! ... View more

How is the inter-vsys connection currently setup?    and the proposal fix look like? ... View more

Hello @MarcelBolleboom   ,   If your environment only have 2 vsys  and it won't get any bigger.  That is one way to resolve the inter-vsys performance issue.      Do you have a diagram that can help us understand the problem?       Have you able to identify the traffic pattern?  Is there a specific zone/subnet in one vsys that all the systems from the other vsys need to access?       ... View more

try change security policy rule 1 from untrust to trust  TO from trust to untrust ... View more

What does it show on the Cisco end?  What is the log on the Cisco switch show?   I ran into similar problem in the past, both were related to physical media issues (one time is SFP, one time is fiber jumper) ... View more

open a TAC case, includes a tech support and the CLI output.   TAC will send you a replacement FAN tray.  Here is the instruction on how to replace one ,   https://docs.paloaltonetworks.com/hardware/pa-5200-hardware-reference/service-the-pa-5200-series-firewall/replace-a-fan-tray-on-a-pa-5200-series-firewall     ... View more

You are welcome.  Glad to able to help out a fellow PAN users.     The long solution could be combined the two vsys into one.  Also, change the proxy into a router on a stick config.  Simply the traffic flow a bit..   ... View more

Hi,   Next time when you spoke to TAC, ask them about that.  My understand is  "show system statistics session" only present the sum of the DP, it does not take into account of the offloaded traffic.   If you have other graphs on the ingress or egress of the switchs/routers connected to the firewall.  You can calculate the approximate bit/sec to the firewall for processing.     ... View more

How much Gbit/sec of the data flow?  How many time does the traffic through the firewall?     If it is 1Gbit/sec, but the traffic pass the firewall twice, that counts as 2 Gbit/sec to the firewall.. ... View more

Which vsys is DMZ segment assigned to ?   Why are 2 vsys(es) needed?     This could be done with a single vsys with untrust zone, DMZ zone and LAN zone. ... View more

>> I would expect the firewall could handle this easily. The PA5050 has a troughput of 5 Gbit for next-gen. We are only handling 1 Gbit of traffic at the moment and ~ 220000 sessions .   Can you provide a simple diagram how is the traffic flow in term of the firewall zones/interface/address spaces in relation to the vsys?     > The traffic of one user flows 4 times trough the firewall (2 different VSYS) before reaching the internet. First to the proxy (2x) and then to the internet (2x). Maybe we should optimize this traffic flow so it will only pass 2x though the firewall.   A diagram will help..   > U are talking about app override. But if we disable all next-gen scanning on a rule this would do the same right? We already did this tot test if it would impact performance.   The firewall still perform appID, unless you appover it, that turns that rule into a L4 firewall. ... View more

>> Could it be that the hashing algorithm sends all sessions to DP1 based on the source IP of the proxy servers?   DP0 has dual tasks, function for new sessions creation and as a regular DP.    If the hash algorithm ( I never got a clear answer from PAN how the session distribution works on the 5000 series)  is favoring DP1, that is all.   >> Maybe it could help if we bypass the proxy servers so all clients will connect directly?   If you can reduce the # of sessions on the firewall, that should help..   You can also try app override for that firewall rule, that may help as well     ... View more

***  I would contact TAC to see if they have some better suggestions.   Q0:  how many sessions are generated by " RANGER_Prx-FTP-HTTP-HTTPS-01-02" ?   Q1: Does rule " RANGER_Prx-FTP-HTTP-HTTPS-01-02" have threat, wildfire, SSL decryption, URL enabled?   Q2: Can you try write an application override rule for  "RANGER_Prx-FTP-HTTP-HTTPS-01-02" , that will bypass all Layer 7 inspection.   Based on the rule name, it is allowing FTP, HTTP, HTTPS traffic.  It will be interesting to see the session counts during peak hours.  Since many of those HTTP and HTTPS sessions are short live and it could be high frequencies.    >> And why does DP1 shows 100% and DP0 only 40%. Shouldn't it be evenly distributed?   It has to do with the DP hashing algorithm,  since DP0 already needs to handle new session creation on 5000 series.  I believe to 5050 only has 2 DP.  That is pretty much the best it can do.       ... View more

Go back to that link above, in follow the step 2, and check if those sessions from show running resource-monitor ingress-backlogs, are offloaded or not   ff that session is not offloaded, that is the problem, where it causing problems on that specific DP.. ... View more

Hi,   https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dos-protection/dos-protection-against-flooding-of-new-sessions/identify-sessions-that-use-an-excessive-percentage-of-the-packet-buffer.html   Can you try run the following command, and identify the session to check if the traffic is intervsys traffic? ... View more

Hi,   I have done that in the past, just be prepare the stateful information may not get sync up due to the MTU difference.  Do this in a maintenance windows or low traffic time  The only reason why you will want to enable jumbo frame is your network is jumbo enabled.  If not, you may need to adjust the mtu on all the interfaces.   E ... View more

@SureshBalaji   It should be straight forward but it will take a bit of time of planning, if each vsys has their own untrust interface and address space, that should be pretty easy.  On the multi vsys one, security, nat polcies, etc are all in set vsys vsysX stazes.  Just need to change from set vsys vsys2 rulebase and update to set rulebase.  You can manually edit in XML (if you are comfortable) or you can do it via the set command set as well.   E     ... View more

@BPry    Change window is difficult to request.  Don't want to fill out additional paper works to explain what happened.    "Recommended" upgrade. takes 3 times long.   It takes 35 minutes for a firewall to reboot (I do miss the good old days work on screenos) and I have to do 6 upgrades instead of 2..  hmm.. that is a hard sales for me.     If I knew the TAC tricks,  1) try commit force, or 2) reboot the firewall on the version that you wanted.  That would have save so much time as well.   Just want to share my experience and hope to save others; time and stress.         ... View more

Hello @OtakarKlier ,   The issue is not related to HA2 config of the firewall, as TAC explained, something went wrong in auto commit.    Suggestion 1 , commit force. Suggestion 2, reboot the firewall.   I rolled back both firewall to 8.1.5 and upgraded to 8.1.13, then to 9.0.0, and then upgraded to 9.0.6.  HA2 link stay up.   Just want to share my experience to save others time and pain to do many many upgrades.   E ... View more