About Chatri

Chatri · ‎10-30-2013

The NAT rule can be specified for Destination Address Object, which can be configured to be an FQDN address object. This setting should work as long as the Palo Alto is able to do a FQDN lookup succesfully for the specified FQDN. However, as long as the FQDN resolves to the same IP you may not be able to have them translated to different Inside servers. The reason being, if multiple FQDNs resolve to the same Public IP, having different NAT rules will create a conflict when setting the NAT rule. The firewall irrespective of whether we have the FQDN or actual IP will still store the IP in the running config, having multiple NAT rules with the same Ip will create a conflict.

Chatri · ‎10-15-2013

The best way to verify that would be do is from the CLI 1) Run the command set cli config-output-format set 2) PA-200>configure ( enter the configuration mode) 3) PA-200 # show ( just run the command 'show') This will show you the entire configuration, and then you can search fro the ip by using the character '/' on the CLI output, then search for the string ( which in this case would be your IP address that has been retired). Doing this will highlight any match for the IP address in the configuration. Using the key 'n' will keep showing you the next match for the ip in the config, you can keep doing that and figure out where in the config is that Ip being referenced. Hope this helps

Chatri · ‎09-17-2013

I would suggest the best idea here would be to involve your SE and re-evaluate your needs in terms of what PA platform would be the appropriate fit in the network.

Chatri · ‎09-14-2013

Hello Abrar, Unfortunately, there isn't a way to get more rows in an custom report, the maximum number of entries supported is in fact 500

Chatri · ‎09-12-2013

Hello Mat, To answer your first question: 1. When I click on 'load' next to a committed configuration in the list of backups, I dont understand where that loads to? (the message just says its loaded) Is it the configuration showing in the context in Panorama for that particular device (so when I go to that context will the candidate configuration be the one I loaded?) or is it loaded onto the actual device so if I log on locally will that be the candidate config? ---> When one clicks on load in the back up config sub tab...the config gets loaded on the device...it is as good as loading that version of config locally on the firewall. Regarding your second question: I tried to replicate it with a dataplane interface being used to connect to Panorama just as you have it set up...but do not see the same issue on 5.4 and 5.0.6 devices, it would be ideal to open up a case with support to track this issue, because as long as the devices are connected one should be able to load the config with the 'backups' load option.

Chatri · ‎09-12-2013

Hello, If you have a case with PA support open, could you mention the case number?

Chatri · ‎09-11-2013

I tried to replicate this issue and have not able to on any browser ( IE, Firefox and Chrome). Have you experienced the same issue with all browsers or is it just on Chrome? What version of Chrome are you using? But, to answer your question, there is no such known issue so far with the code 5.1.0. Can you try and see if you face the same issue with other browsers as well.

Chatri · ‎09-09-2013

If you Look at the sessions that are getting created for SIP and RTP you will be able to see if the NAT is being properly applied or not. Now, the SIP INVITE packet will have the internal address in the SDP payload, and PA will have to NAT the SDP payload using the SIP NAT 1:1 NAT rule ( If no App override is in place) One way Audio, would usually mean, either the PA is not doing the correct NAT on the Payload which would mean the RTP session that are opened up will have the Internal Address, in which case the remote end will not be able to route the response correctly. Or If there is application Override in place, then the PA will not do a NAT at all on the INVITE payload, which would mean that the RTP session ( Audio) will get opened up with the Private address of the call initiator. The best way to verify if the PA is doing the NAT correctly, is to capture This traffic at receive and transmit stage on the PA, then look at the INVITE packet ( layer 7 payload ) to see if the Proposed IP in the Transmit capture is NATted by comparing it to the receive capture INVITE payload. Note: If the clients are NOT NAT AWARE ( if the clients are not configured to know their NATted IP), then application override will not solve the problem. You can upload the captures here along with SIP and RTP session details and I can take a look. Hope that helps. Aditya

Chatri · ‎08-12-2013

Yes, you are correct in assuming that if you schedule the dynamic updates to be fetched only during the change controls windows to automatically upgrade the dynamic updates then this problem will not be something to worry about, as you can make changes to your rules based on any updated app after having tested during the change control windows. Hopr that helps.

Chatri · ‎08-11-2013

Will you be able to provide the following info: 1) The decryption rule 2) The session details ( show session id output) for the ssl session. 3) If possible pcaps. We will first need to determine whether the session is getting decrypted or not ( I assume its not as the app is still 'ssl;'). Then we look in to the rule that you have in place to determine why the session may not be getting decrypted. Pcaps will tell us exactly what the certs are that are being exchanged suring the ssl handshake. Although, I recommend opening up a TAC case as all of this can done in one troubleshooting session.

Chatri · ‎08-10-2013

Well, its hard to say why this was disabled as a default setting for a specific reason. But as far as the block page chewing up the sessions is concerned that definitely would not be an issue with the blocked applications, as the block page does not need additional sessions than the main browsing session, the block page is just pushed with a response page packet in the same session stream, so its highly unlikely that this would be an issue even with the non browser based apps. HTH

Chatri · ‎08-09-2013

So, I gather that the Cert that you are using is correctly set up with the FQDN as the common name. Now, in the client tab of the portal config, the gateway list...is that configured with the Ip or with the FQDN. Also, has the cert authority been specified as a "trusted root CA" in the set up?

Chatri · ‎08-09-2013

5.0.3 definitely had a lot of log indexing issues that usually cause restarts of MGT server as well as a few other userid issues which also caused the MGT CPU to spike. But as far as the log indexing issue goes that can cause high CPU issues, that will be fixed in 5.0.7. 5.0.6 although has a few fixes with respect to high CPU issues, waiting for 5.0.7 ( which should be out anytime in the next 12-13 days) will not be a bad option at all. HTH

Chatri · ‎08-08-2013

The interface that you are using to log in to the API browser or to put in the API request, you set up an interface management profile on that interface and specify permitted Ip addresses on it. That should help you achieve what you are trying to achieve.

Chatri · ‎08-08-2013

Have you tried restarting the user-id service on the machine on which the pan_agent is installed?

Chatri · ‎08-08-2013

Just running the command on the Active device should be enough and it should ideally not affect the traffic as device server is a module that belongs to the management plane.

Chatri · ‎08-08-2013

Detector threat pool is responsible for correlating the pattern matches ( on traffic that has been decoded by the content engine of the FW) and the action set. This is in a nut shell is responsible for alerting on any matched threat signatures.

Chatri · ‎08-08-2013

Actually to increase the application timeout, you may browse to the OBJECTS tab in the GUI>>>>> APPLICATIONS>>>>>search for FTP and then customize the application idle timeout. This should help you achieve what you are trying to achieve.

Chatri · ‎08-06-2013

Have you tried disabling all sorts of probes and enable 'server session read' ? That way the PCs will directly not be probed but the DC's server logs will be checked for open socket sessions any domain PCs has ( log on and log off will be seen). So . essentially we should still be able to dynamically monitor the user to IP enumeration without probing the PCs directly.

Chatri · ‎08-06-2013

Hello, Following document although does not talk about the working, it talks about the set up scenarios or deployment scenarios of the Vwire mode. I shall keep trying to find the requested detailed document that would walk you through the working of NAT and other L3 capabilities in Vwire https://live.paloaltonetworks.com/docs/DOC-2561

Chatri · ‎08-05-2013

Hello Wolfrene, PA is using a combination of the category of the URL, Known CVE IDs that may be associated with a domain. The Palo Alto content team constantly keeps monitoring and reevaluating the malicious or benign nature of such URLs. The best way to get a domain clean that has been categorized as Malware is to have a TAC case opened up with pcaps of the threat traffic ( this can be done by enabling pcap on the threat profile that triggered this threat log), screen shot of the threat log and the tech support file. The TAC will have this domain re-evaluated by the Content team and if changes are made to this threat signature then push the change with the next content release.

Chatri · ‎08-01-2013

I hope I have understood your question correctly, You want to balance traffic coming in to a Firewall between a vwire internet link and a L3 internet link. A Wire Interface will put all the traffic that is received on it on the second Vwire interface that is part of that 'VWIRE'. There wont be any routing decisions made on it with respect to balancing the LOAD. It will not be possible to split traffic between a Vwire interface and an L3 interface.

Chatri · ‎08-01-2013

A good idea will also be to see if there are any other third party VPN client that is installed on the PC. Also, Do the routes get installed ? Does the IPconfig look fine after connecting?

Chatri · ‎07-25-2013

Is the login attempt successful. Can you verify in the authd.log whether the log in was successful? Also, in the user mapping tab under device>>>user-identification... Is there any networks specified under 'Include/exclude' networks? I have seen issues where the include and exclude networks causes the issue. You could just try adding 0.0.0.0/0 in the include networks...just to see if that changes anything. Regards.

Chatri · ‎07-25-2013

Following document should be able to help you set it up. https://live.paloaltonetworks.com/docs/DOC-4791

Chatri · ‎07-25-2013

Hi, There is no such specific known issue that has been seen where the Auto commit fails up on upgrade to 5.0.0. Does it show you an error as to why the Auto commit failed? ( show jobs id will give you details) 10 % would mean that the Phase 1 parsing of all the management clients is itself failing. The job details will tell you which client is failing. Or there can be a recovery attempt made from the Maintenance mode to see if more information can be found on why the commit fails, but its best to involve TAC for option 2 if nothing specific is found in option 1

Chatri · ‎07-25-2013

If you mean controlling the columns that need to be added in a CSV export, then NO....It is not possible. The only thing that can be controlled is number of lines worth of logs that can be exported in the Excel format.

Chatri · ‎07-25-2013

PA firewall cannot act as a web proxy. So, like just like an explicit proxy the Palo Alto will not be able to cache web pages. But just like an explicit proxy the PA can act as a dns proxy. To be straight, the Palo Alto will not not be able to do all that an explicit Proxy does.

Chatri · ‎07-25-2013

I found the following in the release notes of PANOS 5.0.2. Seems like you might be running in to the same issue. The firewall was intermittently failing to respond to DHCP requests from hosts after upgrading to PAN-OS 5.0. Issue due to a problem that occurred after lease information was saved on the firewall every 12 hours after a restart, the issue was cleared, but would then occur again after 12 hours.

Chatri · ‎07-25-2013

Based on the logs provided by you. It does seem like this is a definite Bug that you are hitting. I have confirmed that the fix was incorporated in 5.0.3 and this will also be available in any version above 5.0.3 Regards.

Date Registered	‎01-23-2012 10:57 AM
Date Last Visited	Tuesday
Total Messages Posted	77
Total Likes Received	32

Online Status	Offline
Date Last Visited	Tuesday

Strata

Prisma

Cortex

About Chatri