About glastra1

glastra1 · ‎08-13-2018

I don't see checkpoint viewer in expedition, has it been removed for any reason? MT 3.1, Expedition,

glastra1 · ‎12-05-2017

this could be your issue, https://live.paloaltonetworks.com/t5/Management-Articles/Local-interface-reference-removed-when-Force-Template-Values/ta-p/166664 Regards, Gerardo.

glastra1 · ‎03-15-2017

Enable troubleshooting on the global protect client. More information would be helpful.. Have you configured a global protect gateway? is it FQDN/IP? Has the global protect gateway an IP pool? Is the agent gateway configuration enabled for all the users or just for an specific group? Is the computer NIC in the same network as the IP pool? regards, Gerardo.

glastra1 · ‎03-13-2017

Per the description sounds like a buffer depletion, I just checked the release notes and there are a couple of fixes on that but I'd recommend you to collect a tech support and open a TAC case to get the right diagnostic. regards, Gerardo.

glastra1 · ‎03-09-2017

Try rebooting the firewall. At the top of my head the inferfaces on virtual firewalls are detected at boot time, so if those were added to openstack after you turned on the firewall that may be the issue. regards, Gerardo.

glastra1 · ‎02-20-2017

Firewall or panorama? PAN-OS version? do you have an snippet of your code or the way you're adding it. Regards, Gerardo.

glastra1 · ‎02-08-2017

Yes, that's expected behavior shorther prefix lenghts will take over. Admin distance will only matter when you have the same route (including prefix lenght) coming from different routing protocols (static, ospf, bgp...). In adittion OSPF is an internal gateway protocol so is asummed that the the routes are coming from controled sources (where only the requiered routes are advertised), the only options left are changing to BGP (EGP) or configure static routes using the same prefix lenght. As side note to check the installed routes in the dataplane you can use the following command, >show routing fib regards, Gerardo.

glastra1 · ‎02-02-2017

not at the top of my head but you can rely on third party authentication like radius, LDAP or kerberos so the users can change their passwords on those systems or use the same password as in their domain computers (which you don't know) https://www.paloaltonetworks.com/documentation/62/globalprotect/globalprotect-admin-guide/set-up-the-globalprotect-infrastructure/set-up-external-authentication regards, Gerardo.

glastra1 · ‎01-26-2017

You won't be able to configure duplicated IPs (the commit will fail) even if they are in different vsys but you can configure them in the same network segment. For example 10.1.1.1/24 in VR1 and 10.1.1.2/24 in VR2. Regards, Gerardo.

glastra1 · ‎01-26-2017

That should be a feature requests. As workaround you may want to use BGP or create static routes with less admin distance. Regards, Gerardo.

glastra1 · ‎01-26-2017

Use Global Protect 🙂 regards, Gerardo

glastra1 · ‎01-05-2017

It could also be sending attribute number 2, anyway make sure is sending the right attribute depending on your needs and run packet captures just to double check. https://live.paloaltonetworks.com/t5/Configuration-Articles/RADIUS-Vendor-Specific-Attributes-VSA/ta-p/60273 There are 5 attributes: PaloAlto-Admin-Role: Attribute #1 - This can either be a default admin role name or a custom admin role name. PaloAlto-Admin-Access-Domain: Attribute #2 - This is used when a Palo Alto Networks device has multiple vsys. This is the name of an Access Domain as created under Device > Access Domains. PaloAlto-User-Group: Attribute #5 - This is the name of a group to be used in an Authentication Profile. regards, Gerardo.

glastra1 · ‎01-04-2017

Looks like the radius server is sending radius attribute #4 (for access domains) instead of number #3 (for predefined roles). According to your logs the role is blank but the access domain (ADO) is "superuser" (predefined role) access domain = superuser Found userinfo (name/role/ado) cache entry: adm-admin//superuser Sent authorization response for user "adm-admin": role/domain="/superuser" https://live.paloaltonetworks.com/t5/Configuration-Articles/RADIUS-Vendor-Specific-Attributes-VSA/ta-p/60273 PaloAlto-Panorama-Admin-Role: Attribute #3 - This can either be a default admin role name or a custom admin role name on Panorama. PaloAlto-Panorama-Admin-Access-Domain: Attribute #4 - This is the name of an Access Domain configured on Panorama as created under Panorama > Access Domains. If you want to configure admins with access domains you can follow the next guide, https://live.paloaltonetworks.com/t5/Management-Articles/Separate-Panorama-Admins-Access-Domains-using-RADIUS/ta-p/54432 You can place a packet capture to analyze the radius responses at the top of my head they should be on clear text, https://live.paloaltonetworks.com/t5/Management-Articles/How-To-Packet-Capture-tcpdump-On-Management-Interface/ta-p/55415 https://live.paloaltonetworks.com/t5/Management-Articles/Tcpdump-Packet-Capture-Truncated/ta-p/63047

glastra1 · ‎01-03-2017

Global protect satellite doesn't provide redundancy. PBF or dynamic routing do. Since you'll have 2 links: MPLS and VPN, you can simply configure PBF to use your primary link (MPLS) which be failing over to your VPN (static route) in case it fails https://live.paloaltonetworks.com/t5/Management-Articles/Selecting-an-IP-Address-for-PBF-or-Tunnel-Monitoring/ta-p/61993 Regards, Gerardo.

glastra1 · ‎01-03-2017

Try checking your GP portal SSL protocols supported with a different tool (like the one in the link) if it's still showing up as tlsv1.0 open a TAC case. https://www.ssllabs.com/ssltest/

glastra1 · ‎01-03-2017

You could create an script use the XML api the get the logs, https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/pan-os-xml-api-request-types/retrieve-logs-api If you have further questions you can use our dev forum, https://live.paloaltonetworks.com/t5/APIs/bd-p/TechnologiesSDKsDiscussions regards, Gerardo.

glastra1 · ‎12-12-2016

Seems that the command is not exposed using the API. It'll be something like /api/?type=op&cmd=<show><system><statistics><session></session></statistics></system></show> That returns an invalid response probably because the CLI command returns information in real time. <response status="error"><msg><line>invalid client cli</line></msg></response> In adittion you can get the same info from ">show session info" /api/?type=op&cmd=<show><session><info></info></session></show> Regards, Gerardo.

glastra1 · ‎12-12-2016

Try using the following example with curl, https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/get-started-with-the-pan-os-xml-api/make-your-first-api-call#51855 Make sure it doesn't include spaces. If that still gives you an error I'd suggest trying generating a new API key with a different username. regards, Gerardo.

glastra1 · ‎11-16-2016

Try removing the "include groups" in group mapping and re-add them again. Probably one of them is no longer fecthed from the LDAP server (deleted). https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Search-Group-Mapping-Include-List-using-Wildcards/ta-p/64716

glastra1 · ‎09-19-2016

Is the traffic passing through the dataplane? If that's the case maybe you're the next document can help you out. https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Policy-behavior-change-application-default/ta-p/75664

glastra1 · ‎08-25-2016

Correct https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/globalprotect-features/disable-direct-access-to-local-networks regards, Gerardo

glastra1 · ‎06-20-2016

First of all the user to IP mapping should be refreshed at user logon. Please make sure that every logon is generating security events on the LDAP servers and the the agent is able to map them, https://live.paloaltonetworks.com/t5/Management-Articles/Security-Event-IDs-from-Active-Directory-Used-with-User-ID-Agent/ta-p/52448 Seems that almost all of your user to ip mapping relies on windows probes which is not ideal, As an alternative method you could enable kerberos SSO in captive portal. https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/authentication/configure-kerberos-single-sign-on.html regards, Gerardo.

glastra1 · ‎05-17-2016

Phase 2 (Each proxy ID) should be negotiated according to the key lifetime, so if in one side it's set to 5 minutes that's normal. You don't usually want to re-ley that often, if you're receiving delete messages the re-keys need to be troubleshooted in the side deleting the SA. If the other side it's also a palo alto a rekey can be triggered if tunnel monitoring is detected as "down", https://live.paloaltonetworks.com/t5/Configuration-Articles/Understanding-behavior-of-PBF-and-Tunnel-monitoring-probes/ta-p/68666 You can check the remaining lifetime for your Phases 2 with the following command, >show vpn flow. Regards, Gerardo.

glastra1 · ‎03-25-2016

googol you can find them in the next link https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/threat-prevention/best-practices-for-securing-your-network-from-layer-4-and-layer-7-evasions#16594 regards, gerardo

glastra1 · ‎03-25-2016

You need to contact your SE to enter in beta programs. Regards, Gerardo.

glastra1 · ‎03-17-2016

Make sure that the connection method configured in the portal is "user-logon" and not on-demand. regards, Gerardo.

glastra1 · ‎03-16-2016

well... I tested it in my FW and it worked in 6.1.10 > tcpdump filter "tcp[tcpflags] & (tcp-syn|tcp-fin) != 0" Press Ctrl-C to stop capturing tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes ^C5 packets captured 10 packets received by filter 0 packets dropped by kernel It captured just sync packets which by default are truncated https://live.paloaltonetworks.com/t5/Management-Articles/Tcpdump-Packet-Capture-Truncated/ta-p/63047 regards, Gerardo

glastra1 · ‎03-14-2016

you can create one policy per each server you're going to monitor. Just make sure to check the option "disable this rule if next hop/monitor is unreachable" (first screenshot in the next kb) https://live.paloaltonetworks.com/t5/Configuration-Articles/Policy-based-forwarding-rule-is-not-applied-when-the-monitoring/ta-p/57444 For the monitor profile attached to the PBF you can select either wait/recover or failover dependiong on your needs, the actions the firewall will take are explained in the admin guide (second column as disabled is goind to be selected in the PBF) https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/policy/pbf Regards, Gerardo.

glastra1 · ‎03-02-2016

Not sure how the client is trying to connect to the sinkhole IP addres if it's receiving an error code in the DNS response instead of the sinkhole IP address (unless the packet capture is missing something). By any chance is the client using an internal DNS server? From RFC 1035 (DNS) the response "no such name" 3 Name Error - Meaningful only for responses from an authoritative name server, this code signifies that the domain name referenced in the query does not exist.

glastra1 · ‎02-16-2016

Have you configured the same zone on both outgoing interfaces? If not the firewall will drop the packets The firewall session's table is based among other things on source and destination zones (not physical interfaces) if the destination zone changed the packets will be dropped (as it broke the ecisting session). There is a Global counter for it but I don't remember it at the top of my head (something lime pkt_flow_zone_change) You can check the global counters and see if the packets are being dropped. Before and after the issue, > show counter global filter delta yes | match drop Regards, Gerardo.

Date Registered	‎07-31-2015 01:50 PM
Date Last Visited	Thursday
Total Messages Posted	110
Total Likes Received	21

Online Status	Offline
Date Last Visited	Thursday

Strata

Prisma

Cortex

About glastra1