About Register_Security

Register_Security · ‎03-21-2017

Hi BPry, Thanks a lot your reponse. "It looks like your account has been locked out for some reason." -> Yes, it's exprired by password profile (account not use in amount time). But with the backup admin account (never exprired), I also not access to Web GUI with this account (only access to CLI). Result of "tail follow yes mp-log authd.log" command, plz reivew it: 2017-03-22 10:04:20.832 +0700 Error: pan_auth_user_is_in_locklist(pan_authd_localdb_utils.c:177): failed to prepare sql statement: select * from locklist where vsysname=? and profilename=? and lower(username)=lower(?) and flags<>? 2017-03-22 10:04:20.833 +0700 Error: pan_auth_lock_user(pan_authd_localdb_utils.c:853): failed to lock user <shared,__dummy_%_admin_%_profile__,apiconfig> 2017-03-22 10:04:20.833 +0700 Error: pan_authd_user_auth_failure_alarm_gen(pan_authd_localdb_utils.c:695): failed to prepare sql statement: select * from locklist where vsysname=? and profilename=? and lower(username)=lower(?) and flags<>? 2017-03-22 10:04:20.833 +0700 debug: pan_authd_process_authresult(pan_authd.c:1399): Alarm generation set to: False. 2017-03-22 10:04:20.833 +0700 User 'abc' failed authentication. Reason: Invalid username/password From: 192.168.x.x. 2017-03-22 10:04:20.833 +0700 debug: pan_authd_generate_system_log(pan_authd.c:866): CC Enabled=False 2017-03-22 10:06:20.966 +0700 debug: pan_authd_service_req(pan_authd.c:3324): Authd:get group request 2017-03-22 10:06:20.966 +0700 debug: pan_authd_handle_group_req(pan_authd.c:3211): Got user role/adomain / for user xxx 2017-03-22 10:06:20.968 +0700 Error: pan_authd_inc_expired_login_count(pan_authd_ludb.c:3986): Error in binding username to sql statement.Could not access login history. 2017-03-22 10:06:20.968 +0700 Error: pan_authd_handle_group_req(pan_authd.c:3259): Failed to increment login count for xxx Ps: Update your dang systems man! 6.1.4 is out of date even in the 6.1.* line! -> Thanks a lot for your remind, I will update asap ^_^

Register_Security · ‎03-21-2017

Hi All, I have met a problem with access to my Active Pan Device by Web Admin GUI. I can access by SSH Console and I can access to Standby Device in HA System. My device: PAN 3020, OS Version 6.1.4. Have anyone meet the same problem, please share the solutions. Error logs --------------------- 2017-03-21 11:04:21.009 +0700 Error: pan_authd_user_is_lockedout(pan_authd_localdb_utils.c:389): failed to prepare sql statement: select * from profiledb where vsysname=? and profilename=? 2017-03-21 11:04:21.012 +0700 Error: pan_auth_user_is_in_locklist(pan_authd_localdb_utils.c:177): failed to prepare sql statement: select * from locklist where vsysname=? and profilename=? and lower(username)=lower(?) and flags<>? 2017-03-21 11:04:21.013 +0700 Error: pan_auth_lock_user(pan_authd_localdb_utils.c:853): failed to lock user <shared,__dummy_%_admin_%_profile__,apiconfig> 2017-03-21 11:04:21.014 +0700 Error: pan_authd_user_auth_failure_alarm_gen(pan_authd_localdb_utils.c:663): failed to prepare sql statement: select * from profiledb where vsysname=? and profilename=? 2017-03-21 11:06:25.975 +0700 Error: pan_authd_handle_get_pwchange_required(pan_authd.c:3041): Failed in get_pwchange_required. 2017-03-21 11:06:26.082 +0700 Error: pan_auth_get_lastpwchange(pan_authd_localdb_utils.c:2943): Error in preparing sql statement.Could not access password history. 2017-03-21 11:06:26.082 +0700 Error: pan_auth_set_lastpwchange(pan_authd_localdb_utils.c:2994): Error getting lastpwchange for user:user1 2017-03-21 11:06:26.082 +0700 Error: pan_authd_handle_set_lastpwchange(pan_authd.c:2971): Failed to set lastpwchange. 2017-03-21 11:06:26.604 +0700 Error: pan_authd_admin_unlock_complete_handler(pan_authd_ops.c:482): failed to prepare sql statement: select * from authseqdb 2017-03-21 11:06:26.605 +0700 Error: cfgagent_doop_callback(pan_cfgagent.c:512): Failed to handle op command for agent: 2017-03-21 11:06:43.304 +0700 Error: pan_authd_admin_unlock_complete_handler(pan_authd_ops.c:482): failed to prepare sql statement: select * from authseqdb 2017-03-21 11:06:43.304 +0700 Error: cfgagent_doop_callback(pan_cfgagent.c:512): Failed to handle op command for agent: 2017-03-21 11:07:19.557 +0700 Error: pan_cfg_parse_authprofiles(pan_authd_ludb.c:1005): lockout time value missing 2017-03-21 11:07:19.558 +0700 Error: pan_cfg_parse_authprofiles(pan_authd_ludb.c:1005): lockout time value missing 2017-03-21 11:07:19.746 +0700 Error: pan_ludb_unmark_all(pan_authd_ludb.c:1640): failed to unmark rows in db: unable to open database file 2017-03-21 11:07:19.746 +0700 Error: pan_ludb_update_user_db(pan_authd_ludb.c:1764): failed to unmark rows in db 2017-03-21 11:07:19.747 +0700 Error: pan_ludb_update_profiledb(pan_authd_ludb.c:2189): failed to drop table in db: unable to open database file 2017-03-21 11:07:19.747 +0700 Error: pan_ludb_update_auth_db(pan_authd_ludb.c:3141): failed to update profile db 2017-03-21 11:07:19.747 +0700 Error: pan_ludb_update_adminuser_db(pan_authd_ludb.c:3075): failed to drop adminusers table in db: unable to open database file 2017-03-21 11:07:19.748 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for admin2017-03-21 11:07:19.748 +0700 debug: pan_cfg_set_ssh_auth_public_key(pan_cfg_utils.c:7497): Public key format = OpenSSH, type = RSA 2017-03-21 11:07:19.815 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for giangpd2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for apiconfig2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for xemconfig2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for xemreport2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for user12017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for checkarp2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for user12017-03-21 11:07:19.816 +0700 Error: pan_authd_remove_pwhistory(pan_authd_localdb_utils.c:3100): failed to remove all users from pwhistory 2017-03-21 11:07:19.816 +0700 Error: pan_authd_delete_expired_login_count(pan_authd_ludb.c:4092): Error delete login count from login history.Could not access login history. --------------------- Thanks in advances.

Register_Security · ‎10-15-2014

Hi Jahnavi, On my device, I generate my certificate with Extenal Authority CSR, after 3 parthy issue the certificate. I edit an CRT file: -----BEGIN CERTIFICATE----- Root CA -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- Intermediate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- issued certificate -----END CERTIFICATE----- I import in to PAN successfully, I can check "Forward Trust Certificate", when I run "commit", the PAN inform "Unmatch certificate and key". Have you experience for this problem, please share for me. Thanks in advance,

Register_Security · ‎10-14-2014

Yeah, I want to use SSL decryption, how can I get subordinate CA ?

Register_Security · ‎10-14-2014

Hi All, My device is PANOS 6.0.5; I have a problem with Certificate configuration. On my device, I generate a Certificate follow How to Generate a CSR(Certificate Signing Request) and Import the Signed Certificate; After, my 3rd party CA issue complete, I import the issued certificate (crt file) successfully and status is "valid" I can check "Certificate for Secure Web GUI" but I can not check "Forward Trust Certificate" option. I really don't know where is my problem, please help Thanks,

Register_Security · ‎09-09-2014

Hi Hulk, After the "debug software restart web-server", the threat log was displayed again, but when I use custom report, it do not have any record in some days. Have you ever seen the same problem ? share experience Thanks,

Register_Security · ‎09-09-2014

Hi Hulk, I really confuse with my device, I run debug software restart web-server , but it does not display any threat log Thanks

Register_Security · ‎09-08-2014

Hi Hulk, Result of show system resources follow top - 13:49:05 up 37 days, 11:29, 1 user, load average: 0.00, 0.00, 0.00 Mem: 3852228k total, 3719088k used, 133140k free, 129616k buffers Swap: 2008084k total, 1576k used, 2006508k free, 2391864k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1975 root 20 0 501m 350m 6960 S 2 9.3 932:08.74 mgmtsrvr 2000 root 20 0 273m 147m 10m S 1 3.9 175:40.64 devsrvr 2011 root 20 0 325m 129m 7312 S 3 3.4 327:53.55 logrcvr 1978 root 20 0 156m 73m 64m S 0 2.0 3:03.56 useridd 26616 nobody 20 0 119m 56m 4272 S 0 1.5 1046:00 appweb3 2034 root 20 0 47864 37m 1868 S 1 1.0 226:18.66 snmpd 16063 quoclc 20 0 43412 17m 9196 S 0 0.5 0:00.38 cli 1824 root 20 0 53064 12m 2680 S 0 0.3 7:38.81 dagger 26614 nobody 20 0 76120 12m 3040 S 0 0.3 0:14.39 appweb3 2019 root 20 0 93448 11m 2636 S 0 0.3 2:51.68 satd 2025 root 20 0 135m 11m 2488 S 0 0.3 9:16.03 routed 26625 nobody 20 0 81624 10m 3284 S 0 0.3 0:11.02 appweb3 2016 root 20 0 250m 7628 2324 S 0 0.2 13:04.66 varrcvr 1799 root 0 -20 31736 6852 2392 S 0 0.2 18:36.90 masterd_core 1818 root 0 -20 14032 6696 1332 S 0 0.2 32:32.04 masterd_manager 1826 root 20 0 56020 6384 2396 S 0 0.2 4:19.47 cryptod 1825 root 30 10 13656 6376 2224 S 0 0.2 15:31.45 python 2026 root 20 0 108m 5608 3220 S 0 0.1 0:24.85 authd 1816 root 15 -5 20724 4912 1536 S 1 0.1 231:50.67 sysd 2024 root 20 0 53688 4424 2052 S 0 0.1 0:01.58 pppoed 2023 root 20 0 52664 4408 2068 S 0 0.1 0:01.32 dnsproxyd 2021 root 20 0 82560 4296 2308 S 0 0.1 0:37.78 sslmgr 32688 root 20 0 4268 4264 3280 S 0 0.1 0:00.02 ntpd 2010 root 20 0 69616 4200 2640 S 0 0.1 0:56.94 ikemgr 2014 root 20 0 78600 3716 2336 S 0 0.1 2:06.81 rasmgr 2018 root 17 -3 35920 3648 2236 S 0 0.1 6:13.69 ha_agent 3884 root 20 0 10648 3636 1944 S 0 0.1 28:05.31 packet_path_pin 1831 root 20 0 133m 3576 1844 S 0 0.1 14:05.07 sysdagent 2022 root 20 0 35312 3472 2080 S 0 0.1 0:02.05 dhcpd 2015 root 20 0 76808 2600 1580 S 0 0.1 2:02.81 keymgr 1843 root 20 0 26492 2256 1444 S 0 0.1 0:34.19 chasd 16038 root 20 0 6876 2236 1796 S 0 0.1 0:00.06 sshd 1844 root 20 0 3988 2216 1224 S 0 0.1 0:00.01 tscat What is problem on my device ?

Register_Security · ‎09-08-2014

Hi Hulk, I can see all of threat log on console, the problem can not see threat log on GUI (Monitor --> Logs --> Threar) Please help.

Register_Security · ‎09-08-2014

Hi All, I have a problem to view threat log on device. My device is 3020 model, with 5.0.9 version, threat verion: 445-2292. I do not see any threat log record when I select DESC sort, but I can see threat log with ASC sort. Please help me why ? thanks

Register_Security · ‎08-11-2014

Hi Leo I have a problem with command All of mibs file (PAN-MIB-MODULES-5.0-RevD) in /usr/share/snmp/mibs my pan is 5.0.9 snmpget -M /usr/share/snmp/mibs -m ALL -Pu -v 2c -c public 192.168.x.y 1.3.6.1.4.1.25461.2.1.2.3.2.1 all of message is "Cannot adopt OID in"; Please help me where I miss .... Thanks

Register_Security · ‎07-20-2014

Panorama: 5.1.0

Register_Security · ‎07-18-2014

Hi All, I configure a report from panorama and set schedule for sending result to my email. I have receive email from panorama via two file : a .dat file with key code inside, and a .pdf file with no data. I do not know why Please help me

Register_Security · ‎07-13-2014

Hi Steven, Please see my debug information below. admin@Panorama> show logging-status device 001XXXXXXXXX Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated config 2014/07/14 10:19:10 4918 2014/07/11 11:39:48 system 2014/07/14 04:02:32 49500 2014/07/14 04:02:05 threat traffic 2014/07/14 10:19:10 2225666165 2014/07/14 10:19:10 hipmatch admin@Panorama> request log-fwd-ctrl device 001XXXXXXXXX action stop scheduled a job with jobid 27. 27 admin@Panorama> show logging-status device 001XXXXXXXXX Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated config 2014/07/14 10:19:10 4918 2014/07/11 11:39:48 system 2014/07/14 04:02:32 49500 2014/07/14 04:02:05 threat traffic 2014/07/14 10:20:11 2225687615 2014/07/14 10:20:10 hipmatch admin@Panorama> request log-fwd-ctrl device 001XXXXXXXXX action start scheduled a job with jobid 28. Converted log-fwd-ctrl action to 'start-from-lastack' 28 admin@Panorama> show logging-status device 001XXXXXXXXX Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated config 2014/07/14 10:20:46 4918 2014/07/11 11:39:48 system 2014/07/14 04:02:32 49500 2014/07/14 04:02:05 threat traffic 2014/07/14 10:20:46 2225699275 2014/07/14 10:20:46 hipmatch admin@Panorama> debug software restart management-server Process 'mgmtsrvr' executing RESTART admin@Panorama> show logging-status device 001XXXXXXXXX Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated config 2014/07/14 10:24:06 4918 2014/07/11 11:39:48 system 2014/07/14 10:24:06 49530 2014/07/14 10:22:23 threat traffic 2014/07/14 10:27:08 2225833365 2014/07/14 10:27:08 hipmatch On device I run debug admin@PA-Internet-3020-HO(active)> debug software restart log-receiver Process 'logrcvr' executing RESTART and show logging status again, but I still see, and I think it does not work correctly admin@Panorama> show logging-status device 001XXXXXXXXX Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated config 2014/07/14 10:24:06 4918 2014/07/11 11:39:48 system 2014/07/14 10:24:06 49530 2014/07/14 10:22:23 threat traffic 2014/07/14 10:29:10 2225877874 2014/07/14 10:29:05 hipmatch

Register_Security · ‎07-13-2014

Hi Hshah, I see all of log locally device.

Register_Security · ‎07-11-2014

1. My device have working about 1 year. 2. Log Forarding Configuration. I really don't know why ?

Register_Security · ‎07-11-2014

Hi All, I have a problem with Panorama and devices log. Panorama information model: Panorama serial: xzy...... sw-version: 5.1.0 app-version: 445-2292 app-release-date: unknown av-version: 1317-1787 av-release-date: unknown threat-version: 445-2292 threat-release-date: unknown logdb-version: 5.0.2 My Device information model: PA-3020 sw-version: 5.0.8 global-protect-client-package-version: 1.2.5 app-version: 445-2292 app-release-date: 2014/07/08 14:43:28 av-version: 1317-1787 av-release-date: 2014/07/10 08:20:01 threat-version: 445-2292 threat-release-date: 2014/07/08 14:43:28 wildfire-version: 0 wildfire-release-date: unknown url-filtering-version: 2014.07.11.240 global-protect-datafile-version: 0 global-protect-datafile-release-date: unknown logdb-version: 5.0.2 platform-family: 3000 I confirute forward log from device to panorama. On panorama, I saw all "traffic log" but I can't see any "URL or Threat log". I don't know where I missed configuration. Please help me

Register_Security · ‎05-12-2014

Thanks Hulk, I wonder how I block all of incomplete application. Hi Jared, I don't know where to configure application-default, please shared your idea in this case. Thanks so much.

Register_Security · ‎05-12-2014

Hi all, I have the same problem with incomplete application. !Public zone! <====> PAN Firewall <====> INSIDE Firewall <-----> Server IP. I have nated Server IP to Public ip, and configure rule like the below. Name: (Ping) ; Src zone: (public); Src: (any); Dst zone: (any) ; Dst (any); Appliccation: (icmp, ping) ; Action: (ALLOW); I monitor traffic on PAN Firewall, I saw the traffic : Application is INCOMPLETE and action is ALLOW corresponding to the above "Ping" rule, and on my INSIDE Firewall, I also saw the traffic with the same public IP address to my server. I real don't know why is traffic pass into my INSIDE Firewall. Please help me to deny all of incomplete traffic. Thanks so much.

Register_Security · ‎05-09-2014

Hi Hari, Sorry for a long time in response. I were not receiving any e-mail alerts scheduled for daily. And I have click "send test mail" more than once, sometime it work but sometime it failed I don't know reason why, while other systems always send alert e-mail successfully. You got a propose I am very welcome. Thanks

Register_Security · ‎04-21-2014

Are there any screenshort for heartbleed attack into system ? Please share ?

Register_Security · ‎03-24-2014

Thanks for all reply, but what I want to see How many are Mb/s running on each interface ? when I show interface eth1/1 The result is below, I want to know "real running speed" (Mb/s) for Transmit and Received. Physical port counters read from MAC: -------------------------------------------------------------------------------- rx-broadcast 249640 rx-bytes 4516648362570 rx-multicast 0 rx-unicast 12291399844 tx-broadcast 25 tx-bytes 17829203228051 tx-multicast 0 tx-unicast 19161430846 -------------------------------------------------------------------------------- Hardware interface counters read from CPU: -------------------------------------------------------------------------------- bytes received 4467481764870 bytes transmitted 120 packets received 3701714897 packets transmitted 2 receive errors 956 packets dropped 0

Register_Security · ‎03-24-2014

I want to know the command to show "running speed" of interface include physical and "ae" interface ? Please help me Thanks

Register_Security · ‎02-07-2014

Thanks for all of reply.

Register_Security · ‎02-07-2014

Have anyone upgrade PANOS to 6.0.0 already ? any problems ? I wonder why version 6.0.0 release date (01/19/2014) is older 5.0.11 (01/29/2014). Regards,

Register_Security · ‎01-10-2014

I have an alert system to monitor performance all of device in my system, include my PAN. I can add all of each oid on the PAN, but I can not know the correspond name of each oid. Example : OID 11.3.6.1.2.1.2.2.1.10.1 is "ifInOctets" I have so many oid key: .iso.3.6.1.2.1.2.2.1.12.6; ..... many oid . I want to know name of each oid. Please help me how to know it. Thanks so much

Register_Security · ‎12-04-2013

Thanks for your reply. It also helpful, but I hope the new release version of Pan. It will support more detail like : (addr.src in \d+.\d+.*) Best regards,

Register_Security · ‎11-19-2013

I want to make a search string with regular expression in Monitor tab --> Traffic Like that ( addr.src in (192.168.*?) ). If I have any miss syntax, please help me. Any document for Regular expression for searching in pan, please show me

Register_Security · ‎10-31-2013

I have two Palo Alto devices and running HA. When i run command on Active and passive device: > show interface hardware It only show the same MAC Address value of all interface. I want to know original (physical) MAC Address of each interface on each device Please help me thanks so much

Register_Security · ‎10-29-2013

Hi All, I configure an email profile for alert and report by email from my PAN ( latest OS 5.0.8 ) I have a problem with Email Scheduler below sometime, I only send test email (test manually) once and after that I can not send email any more. I really don't know where I miss configuration, please help if any one have experience

Date Registered	‎07-10-2013 11:34 PM
Date Last Visited	Friday
Total Messages Posted	48
Total Likes Received	1

Online Status	Offline
Date Last Visited	Friday

Strata

Prisma

Cortex

About Register_Security