About emr_1

emr_1

I heard GP 5.2.6 will be planned to release in this week. (Information is from my openning ticket) Even I don't have any information related to addressed issue in this version, I can say it will be 'newer version'.

emr_1

Hi All, Just to share the latest info with you all. GP Agent v5.2.5-c84 was released instead of v5.2.6. You can find the addressed issue in release note: === https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-release-notes/gp-app-release-information/globalprotect-addressed-issues.html GPC-12568 Fixed an issue where, when the Connect with SSL Only option was specified as the GlobalProtect connection setting, the GlobalProtect app displayed the notification The network connection is unreliable and GlobalProtect reconnected using an alternate method. You may experience slowness when accessing the internet or business applications. when the GlobalProtect connection cannot be established as IPSec and then falls back to SSL. === In addition to above, after you update your content signature, you can find new option in App Configuration under GlobalProtect portal setting, called 'Display IPSec to SSL Fallback Notification'. Default value is 'yes' Regards, Emr

emr_1 · ‎02-20-2021

@a.jones At this point, disabling IPSEC mode under GlobalProtect Gateway config is the way to remove pop-up. I already opened ticket and TAC said he will fix the issue in GP 5.2.6, and new option will be available under Agent Configuration in GlobalProtect portal. Hope this will help you. Regards, Emr

emr_1 · ‎08-24-2020

*** I know Expedition Tool might have this feature, though please reply with others if possible *** The customer gave me one config which includes 500 static routes, 10000 address objects and 2000 serurity rule (without zone information...imagine cisco ASA or Checkpoint config) I want to determine src/dst zone for each security rule. To do, I need to compare each address object to this routing information and figure out which side (which interface) is address is belong. Afterward, I can configure zones to each rule. Is there any good tool to automatically figures out 'which side it is'? Dos promt tool, linux tool, excel macro... anything is fine to me.

emr_1 · ‎07-16-2020

Update by myself: TAC is working on this issue, and will be fixed in future release. (I don't know when...)

emr_1 · ‎07-16-2020

@ShaiW @OtakarKlier Thank you for your replies. CP sounds good solution for my customer, I'll try this.

emr_1 · ‎07-06-2020

One of my customer is requesting me to track user IP address when he move from his desk to meeting room, and vice versa. He carries his laptop, he use same ID account on AD, but his IP address will be changed when he moves around. I know he needs to generate EVENT LOG on AD to pick up the latest info by UIA, but I have no idea how to... Does he need always logout and re-logon once he moves? Any suggestion is welcome. Regards, Emr

emr_1 · ‎05-29-2020

I configured pcap enabled on vulnerability profile, antivirus profile and antispyware profile. It works fine and I can see green down arrow besides each threat log. If I try to download it, it says not found. I guess this is because panorama itself does not have pcap (on his storage), instead pcap exists on Cortex Data Lake. How can I grab this threat pcap from Cortex Data Lake? Regards, Emr

emr_1 · ‎01-01-2020

@SteveCantwell Thanks for your reply. My panorama is M-100, thus this only supports Panorama mode. (I believe Legacy mode is only for VM) I'll share new findings today as below::: I kept leaving my topology as I wrote above..today I found new logs from firewalls are stored to my M-100. If I trace back my system log, start time of recording is at 0:00 GMT today. Summarize my scenario: Date Time(GMT) events -------------------------------------- 12/30 04:59 Management server started. Running version 8.1.12 12/30 05:02 Autocommit job succeeded 12/31 --:-- 01/01 00:00 New logs start to be stored The difference between upgrade is done and new logs are: 19hrs (rest of 30th)+24hrs(31st)=43hrs Do you think this is expected behavior? Note that I'm doing NOTHING to all of four (M-100 and three firewalls). Regards, Emr

emr_1 · ‎12-31-2019

Originally my devices are: -one M-100 with 7.1.10 -two PA-5020 (HA) with 7.1.10 -one PA-3050 with 7.1.9 all of three Palo Alto devices were registered to M-100 and forwarding logs were working fine. I start upgrading M-100 first. From 7.1.10 to 8.0.20. -upgrade is fine -three devices are connecting after upgrade -I know old format logs were not seen (as expected)... that's fine. -new logs are seen on M-100 Next, when I upgrade M-100 from 8.0.20 to 8.1.12. -upgrade is fine. -three devices are connecting after upgrade -[PROBLEM]I can't see new logs on M-100 -the output of 'show logging status' on both firewall and M-100 seems to be synched...which means the logs should be correctly forwarded to M-100 Anybody hit same issue? What should I do to display new logs on M-100 v8.1.12 (all devices are v7.1.9 and v7.1.10 at this point) Thank, Emr

emr_1 · ‎11-17-2019

@Egghead_Systems Yes, replacement was 8.1.0. And also, my cases were PA-500 and VM-100. On both cases, the cause and result of issue were same, but broken file was different. Hope it helps you.

emr_1 · ‎11-10-2019

Hi @Egghead_Systems , First of all, the reason you and I went to maintence mode is because of new feature that installed from 8.1.1, called " Software Integrity Check". You can find this under release note. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-release-information/features-introduced-in-pan-os-8-1/management-features.html As TAC told me, PAN-OS detected some files were broken, such it stoped normal start up operation and went to maintence mode. After you see entering maintence mode, you can find log from fips.log on the menu and see which specific file was failed. The log below is my sample: === 10/14/19 15:31:09 fips ERROR: failed integrity check on /etc/pan-manifest/mgmt-panos(//var/appweb/sslvpndocs/global-protect/getsoftwarepage.esp: FAILED) 10/14/19 15:31:09 fips ERROR: FIPS-CC integrity on fs:Management plane failed verification on 1 files. 10/14/19 15:31:09 fips ERROR: * * * * * FIPS Self-Tests failed * * * * * 10/14/19 15:31:41 fips ERROR: * * * * * FIPS Self-Tests (**panic**) trying os command * * * * * === From above situation, we can take two ways: 1) try to proceed factory reset and see broken files are replaced by original files (don't forget to take your config backup before you proceed) 2)open the ticket, and request RMA On my case, we did RMA... I could not escape from maintence mode and found no way.

emr_1 · ‎10-21-2019

My customers are facing critical issue when he upgrades firmware. One customer is using VM-100, when he upgrades from 8.1.0 to 8.1.10 and reboot the device, he sees this issue. Another customer is using PA-500, when he upgrades from 8.1.0 to 8.1.9-h4 and reboot the device, he sees this issue. Both customers upgrades from 7.1.x and 8.0.x, and all steps until upgrading to 8.1.0 are fine. Even the reason points 'FIPS', they are not using FIPS mode. Anyone knows the cause? Note: We can not proceed factory reset after we see the issue. It fails. Regards, Emr

emr_1 · ‎07-12-2019

I previously asked TAC same questions and requested him to prepare KB. This is it: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLfmCAG Hope this helps your understanding. Also following page will help you to understaind URL Filtering deeper. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/upgrade-to-pan-os-90/upgradedowngrade-considerations.html Please read URL Filtering section

emr_1 · ‎05-16-2019

Hi there, One of my customer says when he establishes multiple GP tunnel from multiple iPad (iOS 12), when 4th tunnel is established, 1st tunnel will be disconnected. His topologies are as below: -PA is VM-300 with PAN-OS 7.1 -iPads run with iOS 12.2 -GP agent on iPad is 5.0.5 -authentication for GP is using localdb, and localdb has only one set of ID and password -all users use same ID and password for connection -GP Gateway subscription is installed -split tunnel setting is 0.0.0.0/0 If he establishes multiple tunnels with multiple windows pc, it works fine as expected. Even the following KB says we can use same ID to establish multiple tunnels: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CligCAC it looks to me, there is max of 3 tunnels with one ID if endpoint is iphone. Additional Info: sslvpn_ngx_error.log is recording a lots of "client 127.0.0.1 closed keepalive connection" - I'm not sure this is related or not Does anyone know this is by design or this is a bug ( bugID if available), or any information that you are able to more than 4 iOS with same ID? - because I don't have iPads, I can not test it. Regards,

Date Registered	‎05-10-2010 06:49 PM
Date Last Visited	yesterday
Total Messages Posted	217
Total Likes Received	59

Online Status	Offline
Date Last Visited	yesterday

About emr_1

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

Re: Globalprotect 5.2.5 popup message

Re: Globalprotect 5.2.5 popup message

Anyone knows good tool/excel macro for searching egree interface?

Re: How to download threat pcap?

Re: Globalprotect 5.2.5 popup message

Re: Anyone knows good test resource for spyware detection?

What is "FIPS failure. Power-On Integrity Self Test Failure (FS)"?

Re: Multi-category URL in PanOS9

Re: PPPOE interface - dynamic IP - GP Portal

Re: any solution to keep tracking user IP mapping?

Re: any solution to keep tracking user IP mapping?

Re: [need help]can't see new incoming logs after upgrading M-100 into 8.1.12

Re: Strict TLS 1.3 in chrome 72 or 73?

Re: Strict TLS 1.3 in chrome 72 or 73?

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

Re: Globalprotect 5.2.5 popup message

Re: Globalprotect 5.2.5 popup message

Anyone knows good tool/excel macro for searching egree interface?

Re: How to download threat pcap?

Re: any solution to keep tracking user IP mapping?

any solution to keep tracking user IP mapping?

How to download threat pcap?

Re: [need help]can't see new incoming logs after upgrading M-100 into 8.1.12

[need help]can't see new incoming logs after upgrading M-100 into 8.1.12

Re: What is "FIPS failure. Power-On Integrity Self Test Failure (FS)"?

Re: What is "FIPS failure. Power-On Integrity Self Test Failure (FS)"?

What is "FIPS failure. Power-On Integrity Self Test Failure (FS)"?

Re: Multi-category URL in PanOS9

Is there max concurrent session for GP with one ID?

Network Security

Cloud Security

Security Operations

About emr_1