About markk96

markk96 · ‎12-04-2018

The Policy rule is set for any any, with application default set to any. The vwire is set to 0-4094 for tagging.

markk96 · ‎12-04-2018

I am having trouble with the following. Cisco ASR router with IP of 10.1.1.5 plugs into Cisco 9K switch into port eth 1/3, eth 1/3 is configured the follwoing way. interface TenGigabitEthernet0/0/1 description LAS-9K-2 ip address 10.1.1.5 no ip redirects no ip unreachables no ip proxy-arp ip nbar protocol-discovery load-interval 30 cdp enable end interface Ethernet1/3 switchport access vlan 852 no shutdown The Palo is configured as follows. L3-9K2-vwire ethernet1/19 ethernet1/20 p 0-4094 Palo port 19 connected to 9K eth 1/15 interface Ethernet1/15 switchport access vlan 852 no shutdown Palo port 20 Connected to 9k eth 1/16 interface Ethernet1/16 description Palo-Wan2-eth20 no switchport speed 10000 no ip redirects ip address 10.1.1.6 no ip ospf passive-interface ip router ospf 1 area 0.0.0.0 The IP's above have been changed for this discussion. What is happening there is no traffic from the layer2 vlan 852 on the cisco switch. In the palo traffic logs i can see 10.1.1.6 trying ping 10.1.1.5, but never 10.1.15 to 10.1.16 I am not sure what i am missing, I have done this before.

markk96 · ‎01-26-2018

I use Panorama, I have not had any issues commiting to them after leaving them mismatched for 24 hours.

markk96 · ‎01-26-2018

I have never had any issue making the suspended Palo active again before I upgrade it, that is what I always do. I make sure they both see one is active and one is passive. Then I start my upgrade and reboot.

markk96 · ‎01-26-2018

Correct. 1. Suspend the Primary 2. Upgrade the Primary and Reboot 3. Suspend the Secondary so it fails back to the Primary. 4. Make sure Production is working fine on the new code. 5. Upgrade the Secondary. I never have any issues leaving the OS mismatched for a couple of days.

markk96 · ‎01-26-2018

I always Failover to the passive Palo, then I go back to what I consider the "Primary" palo and upgrade it, once it comes up and everything is running on it, I fail back to it. I run that for a day or two and then I upgrade the passive node.

markk96 · ‎10-28-2015

I point my ldap server at the root domain and not a single server, so it is setup as ldap server : corp.firm.local and it works without problems, the client querys whatever domain controller it can find.

markk96 · ‎07-14-2015

Help me understand this better, on the global protect portal for the server cert i need a public cert from a place like godaddy? For the client cert I can use a cert that issued from our internal cert authority which has a cert on all the domain workstations already? What I want is a pre-logon to happen when a user is not logged in yet, but a network connection is in place, then when the user signs in i want it to switch over to the user name for user-id on the palo.

markk96 · ‎05-29-2015

I have one portal and 3 gateways. The ones that are gateways there is no option to disable it.

markk96 · ‎05-29-2015

Is it possible to disable this login page to download the pan gp client?

markk96 · ‎05-29-2015

How many of you have this category being blocked? Any issues with web surfing?

markk96 · ‎11-21-2014

Finding issues with windows firewall with domain policy applied. The Pan client is detected as on the domain and the network adapter is public for the firewall. Under the domain firewall log on the windows machine I show several UDP blocks for the IP address of the gp client.

markk96 · ‎11-08-2014

I have the same issue. Any update?

markk96 · ‎11-05-2014

Is it possible to create email alerts for a virus type threat alert only? With them set as medium i don't want all the medium threat alerts.

markk96 · ‎11-05-2014

Yes this is helpful. Going to be curious to see what the next email has for it next month. Thanks

markk96 · ‎11-05-2014

Cryptowall 2.0 is going through our PALO's as well. I have the hash for it, i need a way to give it to Support.

markk96 · ‎11-05-2014

I have been blocking the url category for web-based email per my company policy, but i am having issues with newsletters that have links. For example this one I have. An email comes in to view the upcoming items for sale. here is the link Healthy Snacks at Work | Corporate Wellness - fresh2desk If you look at the link link.rm0003.net/go/mnQgWuXbk28PhBn7WSw6zw2/ I whitelist link.rm0003.net But if you put that in the url then this is the real site. Which i cannot allow the users to go to. ReachMail

markk96 · ‎11-02-2014

I was curious, I have 900 remote users and 3 /24 scopes and saw them using IP's from 3 different scopes and only about 100 logged in at anyone time. I was curious if they were tied to login lifetime setting.

markk96 · ‎11-01-2014

What setting in the GP gateway determines how long a DHCP address is reserved for?

markk96 · ‎10-30-2014

Yes it is checked and when the laptop docs the icon shows it is internal, but a user can right click and manual connect to a gateway and it will connect. Sorry I stated the issue wrong, an internal client and connect to an external gateway. I need to prevent that from happening.

markk96 · ‎10-30-2014

Good luck controlling skype with the PALO, research using group policy if you are active directory on how to deploy policy to lock things down, this will help you with your attempt to use the PALO app IDS.

markk96 · ‎10-30-2014

I have deployed Global Protect with Single Sign on and have internal host detection. I have everything working and connecting fine, I have one portal and 3 gateways. What I have seen is that some internal clients are connecting to an internal gateway, either by choosing to, or by accident. I have not setup an internal gateway and now I am thinking I should. Any guides or suggestions?

markk96 · ‎10-29-2014

Yes I have seen page 4, skype is using other clients as a proxy via the supernode option. I have a case open with support and not much success, this is why we abandoned the PALO for blocking skype and controlling it with group policy on the ad domain. This works better.

markk96 · ‎10-29-2014

This is a problem with SKYPE and the way the Palo ID's users.

markk96 · ‎10-23-2014

This is my policy in the template. If I remove the "web-browing" out of the allow portion then Firefox dropbox upload is denied. If I leave it in, then Firefox Dropbox upload works. File-Blocking { rules { Wildfire { application any; file-type [ apk email-link flash jar msoffice pdf PE]; [67;1H [K [7mlines 202232-202283 [m [67;1H [67;1H [K direction both; action forward; } Deny { application any; file-type any; direction upload; action block; } "Facebook Photo" { application facebook-posting; file-type any; direction upload; action continue; } Allow { application [ ftp instagram join-me-file-transfer linkedin-posting ms-ds-smb web-browsing]; file-type any; direction upload; action continue;

markk96 · ‎10-23-2014

No that is not what i am saying, this is only dropbox web uploading. I am using the File-Blocking Object to do this. If you look under file blocking there is dropbox and there is web-browsing. With web-browsing uploads allowed dropbox and firefox will upload, even though dropbox is set to block upload. This is not an issue with IE or Chrome.

markk96 · ‎10-23-2014

For dropbox on the web. I need to block uploading, this works with chrome, ie. but with firefox if i create a File-Blocking policy with the following. Firefox will not stop the dropbox upload. IE and Chrome will. Any application upload block application web-browsing upload continue If I remove web-browsing application from the policy object then dropbox will not upload in firefox. I need to allow web-browsing uploads. I am running 6.0.3 on my palo's.

markk96 · ‎10-21-2014

I have no issues failing the PAN's that sit behind the Cisco ASA's. The PAN interface's are a Vwire and untrust is plugged into layer 2 vlan that the inside interfaces of the ASA's are connected to.

markk96 · ‎10-21-2014

Client is 2.1.0-50

markk96 · ‎10-20-2014

That did not work for me, I have found that if I right click the PANGP Adapter when connection to my other two gateways and disable it and re enable it it will connect, but if I try to that with my portal gateway, it just spins the adapter goes to Identifying and then unidentified network and then the log does what I posted above. Only a reboot will fix it.

Date Registered	‎10-10-2013 07:02 AM
Date Last Visited	‎02-12-2020 12:13 PM
Total Messages Posted	77
Total Likes Received	8

Online Status	Offline
Date Last Visited	‎02-12-2020 12:13 PM

Strata

Prisma

Cortex

About markk96