LIVEcommunity - About JimMcGrady

JimMcGrady

My current thinking for the method is to take a backup of the gateway. And also to export a named config. Followed by: - Delete the gateway in Azure. - Create a new gateway (from Marketplace) with the same name, subnet, and ip address as the old. - Once the new gateway is up and reachable, import the named config. - Update the license/subscriptions, as saved in the Palo portal, with the new gateway ID. Is there a better way? Or any missing steps?

JimMcGrady · ‎03-17-2021

My Azure region has recently become availability zone capable. Is there a recommended process for converting/migrating Palo VM firewalls so they make use of this feature?

JimMcGrady · ‎03-04-2021

I'm trying to get an ipsec vpn working with a Palo gateway instance inside of Azure. Because Azure handles the public IP, and the Palo has no awareness of it, i expect NAT traversal will factor heavily. Has anyone got such a topology working? An old thread on this subject suggests that this is not the recommended approach - that Azure native vpn should be used instead. Heres a post from that discussion: In our reference architecture and companion deployment guide, we do not typically recommend terminating the VPNs on the Virtual Appliance running in Azure. This is b/c you will need to use SNAT to enforce return path routing through the proper firewall to prevent asymmetric routing as we cannot extend BGP from the firewalls to the Azure Route Table. Instead, you may consider terminating the VPN on the Azure VPN Gateway and use our backhaul routing design to force all traffic to and from the Gateway subnet through the firewall utilizing UDRs and the Load Balancer.

JimMcGrady · ‎03-04-2021

Networking in Azure is very abstract. When setting up a Palo Alto gateway in Azure as a VPN gateway, did you need to use NAT traversal? The PA only sees its private IP as Azure handles the public. Please let us know if you get it working.

JimMcGrady · ‎02-01-2021

According to system resources, the "cord" process was using a lot of CPU. A reboot of Panorama resolved the issue. I can now generate reports normally.

JimMcGrady · ‎01-31-2021

Custom reports on my Panorama (9.1.6) were working fine until this week. Today, any report i run gets stuck in "please wait" indefinitely. Nothing has changed on the machine. Any ideas what i should look for?

JimMcGrady · ‎09-17-2020

With Palo gateway appliances, is it possible to give the management interface a secondary IP?

JimMcGrady · ‎09-16-2020

When i set our URL filter to block category 'web advertisements' it works as expected. However, it also blocks many of the results of Google and Bing searches. I understand that is because the results in question are web advertisements, strictly speaking. Ideally i'd like to block inline advertisements whilst allowing results from Google/Bing searches - even if they are web ads. If this isnt possible, how would i go about setting up exceptions for specific *.site.com URLs?

JimMcGrady · ‎09-07-2020

Thanks for that. I see i can click on the 'green cog' next to a setting in a Panorama template. This makes the green cog disappear - which means Panorama wont push a value for that particular field.

JimMcGrady · ‎09-06-2020

When i import my HA pair of firewalls into Panorama (9.1.3), the resulting template includes values for HA config. I would like to leave HA config up to the gateways themselves and not include it as part of the template. How would i delete that part of the template? If i set values to their defaults, that part of the config still exists in the template as default values. I want to remove it.

JimMcGrady · ‎08-10-2020

For the most part, Globalprotect is working fine. However, we have one web based app where users are reporting session disconnect errors after being idle for 5 minutes. When connecting to the corporate network rather than via GP, these users dont see the issue. Are there any TCP idle timeout settings specific to GP rather than for the firewall overall?

JimMcGrady · ‎07-22-2020

My client is running GP 5.0.8 clients to a 9.0.9 Palo Alto gateway. Globalprotect doesn't seem to be using the fine granular password expiry details from AD. Its saying the password will expire in 6 days when it wont actually expire for many months. Is there a setting i must change to have GP reference the correct source for password expiry in AD?

JimMcGrady · ‎07-20-2020

| make sure you enable 'success' audits from the local security policy, these are disabled by default so will not log succesfull logins Where would i find that setting?

JimMcGrady · ‎07-20-2020

Under device - user identification - group mapping settings - i can see AD being queried successfully. These objects are successfully being used in policy rules which restrict traffic according to user id However, when viewing the user mapping, anything other than GP (172.30) is listed as unknown: show user ip-user-mapping all IP Vsys From User IdleTimeout(s) MaxTimeout(s) --------------------------------------------- ------------------- ------- -------------------------------- -------------- ------------- 172.30.4.137 vsys1 GP corp\306271 13344 13344 172.30.4.233 vsys1 UIA corp\m062636 1876 1876 10.21.223.36 vsys1 Unknown unknown 3 6 172.30.4.120 vsys1 UIA corp\306976 2617 2617 10.21.166.30 vsys1 Unknown unknown 1 4 What else should i check?

JimMcGrady · ‎07-20-2020

The AD servers appear to be connected: show user server-monitor statistics Directory Servers: Name TYPE Host Vsys Status ----------------------------------------------------------------------------- pdcpvads01.corp.int AD pdcpvads01.corp.int vsys1 Connected pdcpvads02.corp.int AD pdcpvads02.corp.int vsys1 Connected Queries to these servers dont report failures: show user server-monitor state all Server: pdcpvads01.corp.int(vsys: vsys1) Host: pdcpvads01.corp.int num of log query made : 2755 num of log query failed : 0 num of log read : 3132630 last record timestamp : 1595303559 last record time : 20200721035239.595407-000 Server: pdcpvads02.corp.int(vsys: vsys1) Host: pdcpvads02.corp.int num of log query made : 2772 num of log query failed : 1 num of log read : 1410103 last record timestamp : 1595303701 last record time : 20200721035501.975727-000 User mappings is correct for GP clients (172.30.x.x) but shows unknown for everything else show user ip-user-mapping all IP Vsys From User IdleTimeout(s) MaxTimeout(s) --------------------------------------------- ------------------- ------- -------------------------------- -------------- ------------- 172.30.4.137 vsys1 GP corp\306271 13344 13344 10.75.123.36 vsys1 Unknown unknown 3 6 10.21.166.30 vsys1 Unknown unknown 1 4 Are there other commands i should use to investigate?

Member Since	‎12-08-2015 07:28 PM
Date Last Visited	3 weeks ago
Posts	58
Total Likes Received	7

Online Status	Offline
Date Last Visited	3 weeks ago

Re: migrating a VM firewall to availability zones within Azure?

migrating a VM firewall to availability zones within Azure?

site to site vpn using a PA inside Azure

Re: IPSec tunnel between PA-220 and VM300 in Azure

Re: Panorama custom reports hang

Re: GlobalProtect usage PDF Report

Azure natting and routing of internet inbound via Palo?

Re: Internal Host Detection in GlobalProtect

Re: migrating a VM firewall to availability zones within Azure?

migrating a VM firewall to availability zones within Azure?

site to site vpn using a PA inside Azure

Re: IPSec tunnel between PA-220 and VM300 in Azure

Re: Panorama custom reports hang

Panorama custom reports hang

PA management: secondary ip?

URL blocking Web Advertisements with exceptions?

Re: Panorama - deleting part of a template?

Panorama - deleting part of a template?

tcp session dropping after 5 minutes

Incorrect password expiry notice in GlobalProtect

Re: User-ID: ip-user-mapping not working from LAN

Re: Source user missing from log

Re: Source user missing from log

Network Security

Cloud Security

Security Operations