About Gertjan-HFG

Do you use pppoe for the internet connection?   ... View more

@BPry  pan did not drop 9.0 support for all x000 series 3000 serries are supported for 9.0  But the pan-os 9 http/2 insection feature is not available for the 3000 series 😞 https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/app-id-features/http2-inspection.html   ... View more

@catrock   @BPryIt is possible, i do it on a pa220 in a very small office. Here is a concept training where  is covered how you can use layer 2 interfaces to create  a "switch" .   https://www.youtube.com/watch?v=ui912FZb0Dc   ... View more

@firewall-pupil @BPry  @vsys_remo   End of life date for 8.0 has changed. Its now 31 oktober 2019.   https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary ... View more

@JVanLanen in chrome you have to allow flash, for the management URL ... View more

@kiwi??  8.0.5 is released today ... View more

@sfranchina Veeam or any other snaphot backup its not supported by Palo Alto. (beside that it still works) You only get a 100% consistent backup if the PA is shutdown when running the backup.    ... View more

@reaper   No,  thats to time consuming for me at the  moment. ... View more

Here an article how to dig deeper in the decryption error messages. For example , The decrypt-error session end can also mean that the firewall has not enough resources to decrypt.   https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-New-session-end-reasons/ta-p/73289       ... View more

PAN-OS 8.0.1 issue still exist. ... View more

OK, you don't get a green bar, because with PA decryption can not send a EV certificate. Is you use firefox you have to import the internal CA because firefox uses its own certificate store   ... View more

Looks like your missing the "generated PA root CA" on your workstation(s). This is why you need that:   Ensuring the Proper Certificate Authority on the Firewall and Exporting the CA to Clients   Loading or generating a CA certificate on the Palo Alto Networks firewall is needed, because a Certificate Authority (CA) is required to decrypt traffic properly by generating SSL certificates on the fly. Either create a self-signed CA on the firewall or import a subordinate CA from your own PKI infrastructure. Select Forward Trust Certificate and Forward Untrust Certificate on one or more certificates to enable the firewall to decrypt traffic. Because SSL Certificate providers like Entrust, Verisign, Digicert, and GoDaddy do not sell CAs, they are not supported in SSL Decryption.   To Generate a Self-Signed Certificate:   From the firewall GUI, go to Device > Certificates Management > Certificates.  Click Generate at the bottom of the screen.  For Certificate name (which can be anything) I chose ssl-decrypt. For Common Name, I entered the Firewall's Trusted Internal IP: 172.16.77.1 Place a check box next to Certificate Authority to create a Certificate Authority and an SSL Certificate signed by the Firewall itself - x.x.x.x. If you want this certificate to be good for more than 1 year, please go into the Cryptographic settings, and choose, say, 2 years or 730 days. Now the certificate is good for 2 years. If you need to place any additional Certificate attributes, you can do so inside the window at the bottom. Click Generate, then notice that the Status shows as valid. Click ssl-decrypt, then place a check mark next to Forward Trust Certificate and Forward Untrust Certificate, then click OK. Now the certificate can be used for decryption.   If a self-signed CA is used, the public CA Certificate must be exported from the firewall, then installed as a Trusted Root CA on each machine’s browser to avoid Untrusted Certificate error messages inside your browser ... View more

Niets veranderen aan de PA een aan aantal uren laten draaien en opeens werkt het. Na een reboot van de PA weer hetzelfde verhaal. ... View more

@OtakarKlier You mean that for  the latest HIGH only 7.1.8 is not vulnerable?   The dirty cow Kernel Vulnerability is rated high,  but the attack surface is very very small.   You have to login the CLI then you have to escape the CLI  to the shell (only possible for PA TAC) After that you can use the exploit ... View more

There are multiple correct answers.(see above previous posts) It al depends on what you have en need:   A lot of bugs are model specific. See the release notes for examples. What features do you need? Critical Issues Addressed in PAN-OS Releases PAN-OS Security Advisories   Apart from that pan-os 8.0.0 is not recommended 🙂 But if you have a new model its the only choice.     ... View more

For PA200 performance with a VM-50 you don't need SR-IO and PCI passthrough   Speeds below are only valid for PAN-OS 8  ... View more

SR-IO and DPDK  only increases througput,  no more no less So it depends on your homelab requirements.  Do you want more than 600Mb Threat prevention throughput, you need SR-IO and DPDK  and a  vm100 or higher license ... View more

On some new models PANOS 8 is the only version available. ... View more

First: Open a case with TAC   I did some more research after my issue.  Immediately after installing or rebooting a panos 8.0 firewall this issue is present.   The issue disappeared by just waiting  x hours whitout changing anything.  Yet i don't no what the minimum time for x is.  In my test i waited approx 12 hours     ... View more

Use the negate option in your "country" rule ... View more

I also like @RafisGaripov PAN videos   Here is part 2 of the above nat video 🙂 https://www.youtube.com/watch?v=Qq_T9mcBAYk ... View more

For the vm-100 running pan-os 8 is 2 cores also the max, more cores wil be added to the (virtual) management plane This is done to limit the througput.    @Tician A critical note: You only get the perfomance win if u use in esxi : Single Root I/O Virtualization (SR-IOV) or PCI Passthrough of I/O enabled    If you use the PA interfaces on a "normal" (d)vswitch the througput is even slower then the vm-100 on panos-7.1 max threat prevention througput  500 Mbps  in 7.1 it was 600 Mbps App-id performance stays the same 1 Gbps     ... View more