About TranceforLife

TranceforLife · ‎10-05-2017

Unfortunately, without the full log files/messages we can only guess.

TranceforLife · ‎10-05-2017

Not sure if l fully understood your question, but for the traffic visibility on VM you must have an active licenses, otherwise no traffic will be shown in the monitor tab.

TranceforLife · ‎10-03-2017

Please post the outcome/TAC findings 😄

TranceforLife · ‎10-03-2017

This issue just breaks my mind 😄 l also have no ideas now. Just for test allow only application https (SSL) and on its default port 443 "application-default", otherwise l am giving up, sorry. It is more like a guess now. Cannot understand why we don't see SYN, ACK from PA PCAPs, when you were testing from the client PC with HTTPS requests.

TranceforLife · ‎10-03-2017

This is very weird. Ok let's try something else. Lets see if PA itself can get 3-way handshake using its external (NAT IP) address; > ssh port 443 source 188.x.x.x host 185.89.60.64 PCAP filter: capture all stages: firewall, drop, receive and transmit.

TranceforLife · ‎10-03-2017

@fcatapano85 yes it does: https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary

TranceforLife · ‎10-03-2017

Hmmmm.. Any intermediate devices before or after the FW that could potentially interfere with this session? Can you post successful and failed https session output using the "magnifying glass" option (eg): It is hard to prove but l doubt it is PA issue 😄 lets see

TranceforLife · ‎10-03-2017

Hmmm.. Can be tricky if you don't have access to the PA VM image as well as trial licences. I think option one: Use the lab for 4 hours. Before the expiration of your reserved time, get a copy of the config from Palo. Reserve another 4 hours, upload the config and continue with the lab, Option two (some costs involved): spin some EC2 instances and VM on AWS

TranceforLife · ‎10-03-2017

Is your policy configure with "any application " "any services" and without the security profiles attached. If not then worth to test.

TranceforLife · ‎10-03-2017

Hi @05454H, l think this is how it works. You have only 4 hours slot. The best way is to have the VM running locally where you can build your own lab and play with it.

TranceforLife · ‎10-03-2017

@reaper and @kiwi you know l always felt an expertise in all your replies. Thanks again for your help!

TranceforLife · ‎10-03-2017

Hello Community, Just wanted to say thanks to you guys for all your support, bright ideas and thoughts. It was a big pleasure for me to meet you all here, discuss different technical issues and problems. l definitely boosted my Palo skills because of this forum. l also hope that l helped other people with their requests and issues. This community helped me to resolve probably 50% of all my technical issues, very useful. For two years I was providing tech support to our PA customers and I really enjoyed this time. Palo was my first firewall l learned, and l am so happy l had a chance to work with this incredibly powerful device (s). Unfortunately, now I will not be an active member, so good luck to you all and LOVE what you do! Special thanks to @reaper, @kiwi, @BPry, @pulukas, @santonic, @vsys_remo, @Raido, @gwesson, @jvalentine If you want to keep in touch please feel free to find me on LinkedIn: Mykhaylo Skrypka

TranceforLife · ‎10-03-2017

Thi is a bit confusing now. New tab in the web browser = new session for Palo. It doesn't matter Chrome or Firefox first, for Palo it is a new session. Did you try to test from the different client/PC?

TranceforLife · ‎10-03-2017

Get another PCAP. l want to see SYN,ACK from the server arriving at the PA eth1/2

TranceforLife · ‎10-03-2017

Yes, it is not accessible here in UK. from the PCAP we can see the missing 3-way handshake and constant re-transmit of the SYN packets. Most likely web server is down. EDIT: hmm l think it is UP now:

TranceforLife · ‎10-02-2017

Hi, Can you please post full log output from the CLI: > tail lines 100 mp-log ikemgr.log This guide is quite good if you want to get an additional info: https://live.paloaltonetworks.com/t5/Featured-Articles/How-to-Open-a-Case-on-IPSec-VPN-Issues/ta-p/102233

TranceforLife · ‎09-14-2017

Hi, It this what you wanted: # set cli config-output-format set xxxxxx# show set deviceconfig system update-server updates.paloaltonetworks.com set deviceconfig system update-schedule threats recurring daily at 01:15 set deviceconfig system update-schedule threats recurring daily action download-and-install set deviceconfig system update-schedule global-protect-datafile recurring daily action download-and-install set deviceconfig system update-schedule global-protect-datafile recurring daily at 01:30 set deviceconfig system update-schedule anti-virus recurring hourly action download-and-install

TranceforLife · ‎09-14-2017

Your email box will be quite full ))

TranceforLife · ‎09-11-2017

Hey, You will find your solution here: https://live.paloaltonetworks.com/t5/General-Topics/Native-VPN-client-on-android-phone/td-p/161374/page/3

TranceforLife · ‎09-11-2017

I think I had exactly the same issue. Let me find the old post.

TranceforLife · ‎09-05-2017

Your issue is a bit confused. When your traffic is hitting catch-all rule, what can you see in the traffic logs (app, ports etc)?

TranceforLife · ‎09-05-2017

If your custom app will have a port number, then it is your choice. As I said earlier "any" will allow your custom app on any port (not recommended), "application-default" will allow your app only on the defined in custom app port number or range. https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-What-Does-Application-default-Under-Service-Mean/ta-p/54167 What do they mean? Any - This simply means all ports: 1-65535, TCP or UDP. The selected applications are allowed or denied on any protocol or port. Select - This means that you will have to specify exactly what TCP or UDP port that the application you want to allow or block is going to use. Choose an existing service or choose Service or Service Group to specify a new entry. Application-Default - Choosing this means that the selected applications are allowed or denied only on their default ports defined by Palo Alto Networks. This option is recommended for allow policies because it prevents applications from running on unusual ports and protocols, which if not intentional, can be a sign of undesired application behavior and usage.

TranceforLife · ‎09-05-2017

Hi, A lot of a good article here as well as video training on youtube, but short answer on your questions below: (1) - Must I use application override to use custom application? - No, not necessarily if your application will be identified by signature and parameters you specify. (2)- While using custom application, can I use default-application on the Service Column? Or should this column be set to Any since the default app is not in use - "any" in service column means your app will be allowed on any port (PAN-OS 7.1.x and above), if "application-default" then your app is allowed only on standard/predefined ports. https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Custom-applications-and-app-override/ta-p/71635

TranceforLife · ‎09-05-2017

From the log, everything is looking good. Did you refresh the screen in order to reflect teh changes? Did you activate support licenses?

TranceforLife · ‎09-05-2017

Ok, thanks. You need to configure your Palo to NAT all internal traffic to its External IP ( 172.16.0.1). In case you don't want to do that, then please add a static route on your router/modem pointing to the Palo external ip address (172.16.0.1) on how to reach 10.1.1.0/24 subnet.

TranceforLife · ‎09-05-2017

You natting your traffic to the 10.1.1.254, from the source ip 10.1.1.60? Why? What is your external ip address? You have modem/router, right. Does it know how to get back to the networks behind the FW?

TranceforLife · ‎09-05-2017

For TCP traffic "aged-out" could indicate not completed 3-way handshake. Few things to confirm: 1) Can Palo access the internet over the External interface? 2) Make sure routing is correct 3) Remember, traffic generated by the firewall will not be a subject for policy inspection (unless you source the packet from the interface which is assigned to the security zone). 4) Post the detailed log view of any aged-out session (magnifying glass view)

TranceforLife · ‎09-01-2017

Bug has been discovered by TAC which is only specific for 5200 series running on 8.0.4 (only) PAN-OS. You have an option to downgrade to 8.0.3h4 or wait for 8.0.5 release.

TranceforLife · ‎09-01-2017

Hi, We don't use routing between the same subnet, and no it should not be a problem. We expect Palo to ARP for an ip address within the same subnet. You need to take a PCAP from the Palo and check what is going on, check your apr table. Can you see MAC address of other Palo interface?

TranceforLife · ‎08-30-2017

Hi, Thanks for your feedback. Do you get the same error when trying to tweak SSL cert profile etc?

Date Registered	‎11-24-2015 12:59 PM
Date Last Visited	‎08-04-2019 01:00 PM
Total Messages Posted	1,047
Total Likes Received	210

Online Status	Offline
Date Last Visited	‎08-04-2019 01:00 PM

Strata

Prisma

Cortex

About TranceforLife