About OtakarKlier

Hello, Might want to search the release notes, however I have not seen this before. How are your user-id's getting processed, i.e. pointing at Domain Controllers, exchange, etc.? When the firewalls reboot, the user-id mappings get flushed if using agentless. So if the user-id doesnt see a new login, it will not show the mapping. I have seen a lot and hence I use Exchange logs rather than domain controllers since Outlook is constantly authenticating against the exchange servers.   Regards, ... View more

Hello, When our tunnels go down, from the logs on our PAN, its always the AWS side.    Regards,   ... View more

Hello, Here is what I do on a high level: 1. make sure both pairs are on the same code version 2. export config from old pair and put into new pair, be mindful not so save management IP etc so both pairs are accessible 3. make sure new pair has everything setup, base config for management, HA setup etc. on cut over day: 4. shut down old pair 5. move cables to the new pair   Downtime should be minimal. If you want to clear arp cache, log into the upstream and downstream switches/routers and clear arp on them.   Regards, ... View more

Thanks @BPry , Forgot to mention that we need to leave a few externally whitelisted IP's open. I'm not thinking this is possible. Maybe someone out there has done this?   Cheers! ... View more

Hello, Safe and secure are relative terms. you have to ask who you are protecting this data from and how are you going to do it. Azure can be safe or not depending on configuration. Also remember that you are just storing your data on someone elses hardware.   Hope that helps. ... View more

Hello, I do not sorry. However you can use a mib browser and see whats available.   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/snmp-monitoring-and-traps/use-an-snmp-manager-to-explore-mibs-and-objects/identify-the-oid-for-a-system-statistic-or-trap   Cheers! ... View more

Hello, I would recommend asking Solarwinds support to find out why.   Regards, ... View more

Hello, Also as a suggestion, please use URL filtering as well as DNS sinkholes. Will make your security posture that much better.   Regards, ... View more

Hello, This is a combination of different settings. Lets say you want to inspect traffic between Zones A and B. Just create a security policy that allows the traffic to flow between those zones (specific applications, etc.). Then make sure you apply 'Profile Settings' for AntiVirus, AntiSpyware, Vulnerability protection, etc., just dont do internal URL Filtering, just eats up resources and creates a headache for you.   Hope that helps. ... View more

Hello, Depending on the size of the other networks, perhaps changing the IP subnets that the 'smallest' one is using? I know it sounds daunting, but with DHCP and planning it can be quit easy (yep had to do this a few times in the past).   Good luck. ... View more

Hello, While I have not configured this in the past, I did find the following article that may help.    https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping   Regards, ... View more

Hello, Make sure your management port can access the paloalto update sites. Also make sure you are not inspecting or decrypting that traffic as that will break it as well. Check the traffic logs from the management interface to the internet and it should tell you the problem.   Regards, ... View more

Hello, Interesting issue. My guess is that the information in SolarWinds is correct. You could open a ticket with them. How far back in time are you looking at the report? Remember that SolarWinds aggregates the data over a longer period the farther you go back. i.e. for the current day the interval will be you defined interval for polling, for last week it will be data averaged over a 15 minute period and so on.   Hope this helps. ... View more

Hello, I suggest setting up snmpv3 and have the monitoring solution reach in and grab the data. Once the monitoring solution can authenticate to the PAN, it should provide you with the different options that solution can monitor. We dont use Nagios so I cant really provide further guidance on that front. Also for netflow, you cannot use the management interface.   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-setup-operations/enable-snmp-monitoring     Hope this helps. ... View more

Hello, Sounds like you have it correct :).   Cheers! ... View more

Hello, Also make sure you have policies that allow the traffic.   Cheers! ... View more

Hello, While yes it does increase load on the system, I try my best to follow the Zero Trust approach. So yes I will enable those features for the internal traffic as well. This can indicate a malicious actor on the network attempting to get a foothold somehow. It will also potentially stop lateral movement.   Hope that helps. ... View more

Hello, I never rely on the two default policies. I always have a DENY ALL policy right above them so I can see all traffic getting denied.   Hope that makes sense.   Regards, ... View more

Hello, I like to have the following: URL filtering: only for outbound web traffic (not inbound or internal) Threat Prevention- AV, Antispyware:  On all policies, if something breaks, add an exception for just hat one policy, i.e. a ssh brute for due to a monitoring solution, just create a special policy that ignores that and only for that traffic policy) Malware Anlysis: On all policies, same reasoning as above. SSL Decryption: Where practical, external traffic is a must, inbound and internal traffic at your discretion.    In addition to this use policies that have Applications instead of Services(ports), where applicable. This will help as well. i.e. only DNS application traffic from your internal DNS servers and only to a public DNS server that is secure (such as OpenDNS, cloudflare, etc.). This will prevent internal clients bypassing your internal DNS and/or exfiltrating data out using the DNS protocol.   Hope that helps. ... View more

Hello, Just a reminder that Palo Alto has a lot of back end feeds and bots that continuously update their stack. I think that a properly configured system with regular updates and dynamic inspection is a good part of an overall security strategy.   Regards, ... View more

Hello, What device is providing the DHCP assignments? If an internal windows server, that should be updating the DNS of the machine names to IP mappings.   I cant think of a way to do this via a PAN dhcp assignment for a GP client. Perhaps someone else does?   Regards, ... View more