About emr_1

emr_1 · ‎08-24-2020

*** I know Expedition Tool might have this feature, though please reply with others if possible *** The customer gave me one config which includes 500 static routes, 10000 address objects and 2000 serurity rule (without zone information...imagine cisco ASA or Checkpoint config) I want to determine src/dst zone for each security rule. To do, I need to compare each address object to this routing information and figure out which side (which interface) is address is belong. Afterward, I can configure zones to each rule. Is there any good tool to automatically figures out 'which side it is'? Dos promt tool, linux tool, excel macro... anything is fine to me.

emr_1 · ‎07-16-2020

Update by myself: TAC is working on this issue, and will be fixed in future release. (I don't know when...)

emr_1 · ‎07-16-2020

@ShaiW @OtakarKlier Thank you for your replies. CP sounds good solution for my customer, I'll try this.

emr_1 · ‎07-06-2020

One of my customer is requesting me to track user IP address when he move from his desk to meeting room, and vice versa. He carries his laptop, he use same ID account on AD, but his IP address will be changed when he moves around. I know he needs to generate EVENT LOG on AD to pick up the latest info by UIA, but I have no idea how to... Does he need always logout and re-logon once he moves? Any suggestion is welcome. Regards, Emr

emr_1 · ‎05-29-2020

I configured pcap enabled on vulnerability profile, antivirus profile and antispyware profile. It works fine and I can see green down arrow besides each threat log. If I try to download it, it says not found. I guess this is because panorama itself does not have pcap (on his storage), instead pcap exists on Cortex Data Lake. How can I grab this threat pcap from Cortex Data Lake? Regards, Emr

emr_1 · ‎01-01-2020

@SteveCantwell Thanks for your reply. My panorama is M-100, thus this only supports Panorama mode. (I believe Legacy mode is only for VM) I'll share new findings today as below::: I kept leaving my topology as I wrote above..today I found new logs from firewalls are stored to my M-100. If I trace back my system log, start time of recording is at 0:00 GMT today. Summarize my scenario: Date Time(GMT) events -------------------------------------- 12/30 04:59 Management server started. Running version 8.1.12 12/30 05:02 Autocommit job succeeded 12/31 --:-- 01/01 00:00 New logs start to be stored The difference between upgrade is done and new logs are: 19hrs (rest of 30th)+24hrs(31st)=43hrs Do you think this is expected behavior? Note that I'm doing NOTHING to all of four (M-100 and three firewalls). Regards, Emr

emr_1 · ‎12-31-2019

Originally my devices are: -one M-100 with 7.1.10 -two PA-5020 (HA) with 7.1.10 -one PA-3050 with 7.1.9 all of three Palo Alto devices were registered to M-100 and forwarding logs were working fine. I start upgrading M-100 first. From 7.1.10 to 8.0.20. -upgrade is fine -three devices are connecting after upgrade -I know old format logs were not seen (as expected)... that's fine. -new logs are seen on M-100 Next, when I upgrade M-100 from 8.0.20 to 8.1.12. -upgrade is fine. -three devices are connecting after upgrade -[PROBLEM]I can't see new logs on M-100 -the output of 'show logging status' on both firewall and M-100 seems to be synched...which means the logs should be correctly forwarded to M-100 Anybody hit same issue? What should I do to display new logs on M-100 v8.1.12 (all devices are v7.1.9 and v7.1.10 at this point) Thank, Emr

emr_1 · ‎11-17-2019

@Egghead_Systems Yes, replacement was 8.1.0. And also, my cases were PA-500 and VM-100. On both cases, the cause and result of issue were same, but broken file was different. Hope it helps you.

emr_1 · ‎11-10-2019

Hi @Egghead_Systems , First of all, the reason you and I went to maintence mode is because of new feature that installed from 8.1.1, called " Software Integrity Check". You can find this under release note. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-release-information/features-introduced-in-pan-os-8-1/management-features.html As TAC told me, PAN-OS detected some files were broken, such it stoped normal start up operation and went to maintence mode. After you see entering maintence mode, you can find log from fips.log on the menu and see which specific file was failed. The log below is my sample: === 10/14/19 15:31:09 fips ERROR: failed integrity check on /etc/pan-manifest/mgmt-panos(//var/appweb/sslvpndocs/global-protect/getsoftwarepage.esp: FAILED) 10/14/19 15:31:09 fips ERROR: FIPS-CC integrity on fs:Management plane failed verification on 1 files. 10/14/19 15:31:09 fips ERROR: * * * * * FIPS Self-Tests failed * * * * * 10/14/19 15:31:41 fips ERROR: * * * * * FIPS Self-Tests (**panic**) trying os command * * * * * === From above situation, we can take two ways: 1) try to proceed factory reset and see broken files are replaced by original files (don't forget to take your config backup before you proceed) 2)open the ticket, and request RMA On my case, we did RMA... I could not escape from maintence mode and found no way.

emr_1 · ‎10-21-2019

My customers are facing critical issue when he upgrades firmware. One customer is using VM-100, when he upgrades from 8.1.0 to 8.1.10 and reboot the device, he sees this issue. Another customer is using PA-500, when he upgrades from 8.1.0 to 8.1.9-h4 and reboot the device, he sees this issue. Both customers upgrades from 7.1.x and 8.0.x, and all steps until upgrading to 8.1.0 are fine. Even the reason points 'FIPS', they are not using FIPS mode. Anyone knows the cause? Note: We can not proceed factory reset after we see the issue. It fails. Regards, Emr

emr_1 · ‎07-12-2019

I previously asked TAC same questions and requested him to prepare KB. This is it: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLfmCAG Hope this helps your understanding. Also following page will help you to understaind URL Filtering deeper. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/upgrade-to-pan-os-90/upgradedowngrade-considerations.html Please read URL Filtering section

emr_1 · ‎05-16-2019

Hi there, One of my customer says when he establishes multiple GP tunnel from multiple iPad (iOS 12), when 4th tunnel is established, 1st tunnel will be disconnected. His topologies are as below: -PA is VM-300 with PAN-OS 7.1 -iPads run with iOS 12.2 -GP agent on iPad is 5.0.5 -authentication for GP is using localdb, and localdb has only one set of ID and password -all users use same ID and password for connection -GP Gateway subscription is installed -split tunnel setting is 0.0.0.0/0 If he establishes multiple tunnels with multiple windows pc, it works fine as expected. Even the following KB says we can use same ID to establish multiple tunnels: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CligCAC it looks to me, there is max of 3 tunnels with one ID if endpoint is iphone. Additional Info: sslvpn_ngx_error.log is recording a lots of "client 127.0.0.1 closed keepalive connection" - I'm not sure this is related or not Does anyone know this is by design or this is a bug ( bugID if available), or any information that you are able to more than 4 iOS with same ID? - because I don't have iPads, I can not test it. Regards,

emr_1 · ‎02-19-2019

You can find under Monitor tab > Logs > system. Log format is like below === Severity: informational Event: globalprotectgateway-agent-msg description: GlobalProtect gateway agent message. Login from: <src IP>, User name: <user name>, Time: 1550635345, Message: Agent Disable, Comment: <reason>. Override(s)=2. === I believe <reason> field is what you are looking for.

emr_1 · ‎01-30-2019

Hi BPry, gwesson Thank you for replies. I understood the situation.

emr_1 · ‎01-29-2019

Hi BPry, Thanks for your reply. I tested with my testbed : PA-5020 v8.0.13 with Chrome 72. Here is test results. chrome://flags/#tls13-variant ## default chrome://flags/#enforce-tls13-downgrade ## default -> I could access to the gmail chrome://flags/#tls13-variant ## default chrome://flags/#enforce-tls13-downgrade ## enabled -> confirmed "ERR_TLS13_DOWNGRADE_DETECTED" -> also confirmed I could access to the gmail after I upgrade into 8.0.14. chrome://flags/#tls13-variant ## default chrome://flags/#enforce-tls13-downgrade ## disabled -> I could access to the gmail Thus, I believe downgrade protection is not enabled in 72.

emr_1 · ‎01-28-2019

Hello Guys, Which information is true? Chrome 72(in topic) or Chrome 73(in article)?

emr_1 · ‎01-21-2019

You need to configure Client Authentication field.

emr_1 · ‎01-20-2019

No, if IP address grabed dynamically, it is not shown on the list. (as I mentioned above, it works with 'None') By the way, if you configure static-ip under pppoe setting, it shows IP address.

emr_1 · ‎01-18-2019

Hi This should be work with 'None' in IP address field. Here is my testbed (sorry, mine is dhcp client - not pppoe) With above interface, if I configure GP as below... The device recognizes IP address which retrieved from ISP. admin@PA-220> debug ssl-vpn global-protect-portal portal : gptest portal address IPv4 : 58.156.1xx.xxx admin@PA-220> debug ssl-vpn global-protect-gateway gateway : gptest gateway address (IPv4 Only) : 58.156.1xx.xxx admin@PA-220>

emr_1 · ‎01-18-2019

Hi, Which version of UIA are you using? I hit same issue and it was a bug. === WINAGENT-432 Fixed an issue where the User-ID agent failed to normalize usernames correctly before sending to firewalls when the usernames were in User Principle Name (UPN) format, which prevented PAN-OS 8.0 and earlier firewalls from enforcing policy as expected for those usernames. === This is fixed in UIA v8.1.4, so please try 8.1.4 or later (the latest version is 8.1.6)

emr_1 · ‎10-16-2018

Reply to myself. It was WINAGENT-391 issue. Description: Fixed an issue where the User-ID agent failed to normalize usernames correctly due to a domain map lookup failure. This is fixed in UIA 8.1.4.

emr_1 · ‎09-23-2018

I have two different customers who hits same issue. One user is using PAN-OS 8.1.3 and UIA 8.1.3-10, another is using PAN-OS 8.0.12 and UIA 8.1.3.-10. The issue is that UIA detects user info as three types of formats like... 1) domain\user (this is same as previous version) 2) domain.local\user 3) user@domain.local When PA received these info, "show user ip-user-mapping all" shows following two types as below 1) domain\user 2) domain.local\user admin@hostname(active)> show user ip-user-mapping all IP Vsys From User IdleTimeout(s) MaxTimeout(s) --------------- ------ ------- -------------------------------- -------------- ------------- 10.241.73.100 vsys1 UIA domain\user1 Never Never 10.212.136.101 vsys1 UIA domain.local\user1 Never Never 10.224.57.100 vsys1 UIA domain\user1 Never Never 10.128.145.9 vsys1 UIA domain\user2 Never Never 10.128.144.35 vsys1 UIA domain.local\user3 Never Never The issue is that when PA recognize user format as "domain.local\user" format, the user does not hit to policy which was configured by user group that was pulled from AD. The reason is that user group and member was recognized ONLY by "domain\user' format. admin@hostname(active)> show user group name "cn=domain users,cn=users,dc=domain,dc=local short name: domain\domain users source type: ldap source: groupmapping [1 ] domain\01 [2 ] domain\21 [3 ] domain\22 [4 ] domain\23 [5 ] domain\24 [6 ] domain\26 [7 ] domain\27 [8 ] domain\29 [9 ] domain\88 [10 ] domain\98 [11 ] domain\administrator [12 ] domain\agroadmin [13 ] domain\agrotest [14 ] domain\alc [15 ] domain\amano1 [16 ] domain\amano2 ..so on I believe on PAN-OS 8.0 and earlier, "domain\userA" and "domain.local\userA" is NOT same guy, thus it does not hit group members. Is there any body who hits same issue? Note: I know PAN-OS 8.1 starts supporting multiple formats, though it makes me confusing and hitting this issue. Regards, Emr

emr_1 · ‎05-20-2018

@reaper confirmed, It's back! Thank you very much

emr_1 · ‎05-15-2018

Yes, you are correct. With my PA-850 v8.0.7, I could not configure decrypt port mirror. With another PA-850 v8.1.0, I could. Here is information for you: https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/decryption-features/decryption_mirroring_support_extension

emr_1 · ‎05-15-2018

Hello Palo Alto, I was using following link to check critical issues. https://live.paloaltonetworks.com/t5/Integration-Articles/Critical-Issues-Addressed-in-PAN-OS-Releases/ta-p/52882 I can't access to it anymore. How can I collect the latest critical issue information? Do I have to open a ticket every time I want to know? Regards, Emr

emr_1 · ‎04-02-2018

I have a lots of customers who uses HA pair with 1.1.1.1/30 and 1.1.1.2/30 for HA1 port. This HA1 port connected directly. And reason for selecting these IPs are because nobody was using it in the past. Today, I read this article: https://blog.cloudflare.com/announcing-1111/ https://www.theverge.com/2018/4/1/17185732/cloudflare-dns-service-1-1-1-1 According to this thread, it sounds okay to keep using 1.1.1.1 for HA1, though I'm curious... do they need to change IPs? In addition, with my quick test in my lab, I can access to 1.1.1.1 DNS server even HA1 is using 1.1.1.1, thus I believe 1.1.1.1 for HA1 is okay. Regards. Emr

emr_1 · ‎03-18-2018

Hi, Your keyword 'Palo' is not good choice. Try with blank or other word. FYI: I could search by 'IP'. Note: I used Panorama v8.0.7 and 'Palo' did not work. Note2: If I use 'Palo' on my PA-220 v8.0.8, it filtered as expected. It might be a bug on Panorama.

emr_1 · ‎01-09-2018

Hi All, In Zone Protection Profile, a unit of rate changed from packets/sec to connections/sec when I upgrade into PAN-OS 8.0. It sounds defferent thing, though is this only changes on GUI and nothing changes on this feature, I mean way of counts is same as before? If no, how to calcurate accurate value for 'connections'? Let's say if I configure '10000 packets/sec' on PANOS7.1, then what value should be for 'connections/sec' on PANOS 8.0?

emr_1 · ‎12-21-2017

You can find your platform from link below, then expand '+ Show More', and find ' Max concurrent decryption sessions' https://www.paloaltonetworks.com/products/product-selection# You can also find same value from CLI >show system state filter cfg.general.max-proxy-session No changes between 7.1 and 8.0 on same platform.

emr_1 · ‎10-16-2017

Bad new: telnet on PANOS is no longer available. It was removed on PAN-OS 5.0. FYI: page12 https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/technical-documentation/pan-os-5x/PAN-OS-5.0-RN.pdf

Date Registered	‎05-10-2010 06:49 PM
Date Last Visited	yesterday
Total Messages Posted	214
Total Likes Received	57

Online Status	Offline
Date Last Visited	yesterday

Strata

Prisma

Cortex

About emr_1