About CafNetMatt

I've noticed that some App-IDs have web-browsing and ssl implicit to the application while others they are dependencies.   Is there a reason for this? Are the App-IDs being updated to make these 2 applications implicit?   For instance, I'm setting up firewall policies for both teamviewer and Office 365.  There are many more but I'm using these two just as an example.  For both of these, ssl & web-browsing are dependencies.  I followed the Tips & Tricks article about making a custom service group with all the ports necessry for these applications and applying it to a policy for web-browsing and ssl but I still get the dependency warnings.  These are just annoying and having to explain to the client why they are there is a pain as well!  The only way to eliminate them is to add web-browsing and ssl to every security policy that has these as dependencies.   It seems like half the App-IDs now have web-browsing and ssl as requirements and I don't see this shrinking.    So it really seems that something has to be done to alleviate this issue.   Anybody know if there is work to eliminate these spurious dependency warnings?     ... View more

When loading a partial config you have 3 options:  replace, merge, append.  I can't find a description anywhere as to what exactly each of these does!  Especially between merge and append.  I did see this KB article but it really doesn't explain the ramifications for each of these choice and neither does the CLI Guide.   KB Article referenced:  https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Load-Partial-Configurations/ta-p/62549   I'm doing an AppID optimization project using the Migration Tool 3.3.15 which does not export via API to PANOS 8.  Well, it does, it just can't parse the security policies and commit.  So, I'm going to import the changes manually using load partial config.  All I have to do is remove unused objects, create 1 new service-group and update the security rulebase.   Before I do on a client's appliance I was trying to figure out what exactly each of these options do so I can make an intelligent (at least somewhat intelligent ;-)) decision.   Replace:  My guess is this replaces the entire xpath section you reference in the call.  For instance,  load config partial from x.xml from-xpath devices/entry/vsys/entry/rulebase/security mode replace to-xpath /config/devices/entry/vsys/entry/rulebase/security This would replace everything in the security stanza with whatever exists in x.xml.   Append:  This would put everything in the security stanza in the file x.xml at the end of the existing ruleset and not overwrite what's there.  If this is true, what would happen if you had an entry that had the same name?  Would it just update it or overwrite it? Generate an error?   Merge:  This is the one that I have no idea how it would operate at all.   I'm leaning toward replace since I've got policies that were updated from services to AppID, I've got new policies and some have been rearrange.   Thank in advance! ... View more

This is a strange issue.   PA-3020 recently upgraded to 7.0.4.  The firewall is in single vsys mode.   I installed new SSL certificates for Global Protect.  Somewhere during the process of installing the new certificate and upgrading to 7.0.4, an ssl-tls service profile was automatically created.  I didn't create it.  I'm trying to delete that certificate but it won't let me as long as the ssl tls service profile exists.   Here's the weird part.  In the GUI, the profile does not show up under Devices > Certificates > SSL TLS service profiles but is available when choosing the SSL TLS service profile under the Global Protect Portal configuration.  When I create a new SSL TLS service profile, it does show and it is shown as 'shared'.   When I go to the CLI and do a 'show config' (not in configure mode), The XML output shows the hidden profile located at: </config> <devices>     <entry name="localhost.localdomain">       <vsys>         <entry name="vsys1">             <ssl-tls-service-profile>             <entry name="GP_GD_Chained_2019-ssl-tls-service-profile">               <certificate>GP_GD_Chained_2019</certificate>               <protocol-settings/>             </entry>           </ssl-tls-service-profile>         </entry>       </vsys>     </entry>   </devices> </config>   But, when I enter configure mode, I cannot locate this ssl tls service profile.  I've exported the config as set commands and done a search.  It doesn't show it.  I can't change the vsys I'm viewing because I'm not in multi-vsys mode.   The ssl tls service profile I created manually, shows up under <shared> in the CLI and I can view it from configure mode.   I'm trying to avoid enabling multi-vsys support.  I just don't want to have to create a bunch of local accounts and authentication profiles that exist both as shared and in vsys1.   Anyone have an idea how I can remove this profile?   Thanks. ... View more