About epavis

epavis · ‎12-20-2021

Hi Jimmy, Thanks for your quick answer. I've just talked with my customer. He told me the issue is random. With the same request, he got good answer and sometimes not. By the way, he runs a Panorama in 9.1.8. I'm confused, before opening a case, I want an issue easy to replicate. I'll keep you in touch. Thanks again.

epavis · ‎12-20-2021

Hi There, One of my customer is trying to search within the traffic log, using XML API, specific host (IP address). He use this kind of request: https://IP-Panorama/api//api/?key=<Clef Valide>&type=log&log-type=traffic&query=(receive_time geq '2012/06/22 08:00:00') In this case there is no specific IP, but it gives us the same when we're looking for a specific address. The CSV returned subnets IP for src and dst. Never a specific /32 host. Exemple: [...] <src>10.254.76.0/24</src> <dst>8.8.8.0/24</dst> <rule>Deny ALL</rule> <srcloc code="10.0.0.0-10.255.255.255" cc="10.0.0.0-10.255.255.255">10.0.0.0-10.255.255.255</srcloc> <dstloc code="United States" cc="US">United States</dstloc> [...] Do you have any idea? Are you guys already experience such issue?

epavis · ‎06-14-2019

Hi, I agree, override will be a temporary solution. We explained the customer he has to upgrade the box (no ssl decryption). The box is just hitting its capabilities. Thanks all and have a good day.

epavis · ‎06-13-2019

Support explained me the meaning of this process: "The tokens are for decoder regex matches , so check to see if they have a lot of custom signatures defined via regex. do you using a lot of custom signature? " => There is no custom sig. Then they reply : "CTD ( content detection) and To reduce the cpu overload used by the content detector, application override need to be configured for the above applications. you need to double check the acc logs and see the top 3 application used during the high dp load and create the application override for those application."

epavis · ‎06-05-2019

Hi there, Quick question. I'm currently troubleshooting a PA 3020 in version 8.0.12 for one of my customer. Its PA has huge DP CPU usage (arround 80%). I try to figure out the reason of this usage. I've isolated the "ctd_token" process which is a big CPU user. Can you give me a hint about its utility? cheers, Edouard

epavis · ‎04-30-2013

Great, thanks a lot. That's what I looked for. Regards. Edouard

epavis · ‎04-30-2013

Hi Emr, No, I was talking about this document: But yours is useful as well. Regards.

epavis · ‎04-30-2013

Hi there, Do you know where I can find and uptodate "platform specifications and features summary" document? Mine is old (March 2011) and there is no PA3000 nor PA200 inside. I search on the website but I can't find this pdf. Regards, Edouard

Member Since	‎07-13-2012 07:39 AM
Date Last Visited	2 weeks ago
Posts	8
Total Likes Received	2

Online Status	Offline
Date Last Visited	2 weeks ago

About epavis

Re: API return IP subnet instead of IP/32 host

API return IP subnet instead of IP/32 host

Re: What is "cdt_token" process?

Re: What is "cdt_token" process?

What is "cdt_token" process?

Re: What is "cdt_token" process?

platform specifications and features summary

How is the threat severity level determined?

Re: API return IP subnet instead of IP/32 host

API return IP subnet instead of IP/32 host

Re: What is "cdt_token" process?

Re: What is "cdt_token" process?

What is "cdt_token" process?

Re: platform specifications and features summary

Re: platform specifications and features summary

platform specifications and features summary

Network Security

Cloud Security

Security Operations

About epavis