About KotreshaMC

KotreshaMC · ‎11-05-2017

Version 747 Notes: This emergency content update provides coverage for recent generic exploit host page updates that have been seen in the wild. We recommend that you upgrade all devices to the latest Applications and Threats content version and review your security policy to ensure the desired action is configured for each security policy rule. Palo alto says that it has seen this activity in the wild, can anyboady share any link to the base article or tecchincal article related to this signature?. I did not find anything useful details in the threat vault as it gives only generic discription. " This signature detects a landing page used by an exploit kit. Browser fingerprinting or attempts to direct a browser to download targeted malware are examples of behaviors that could indicate an exploit kit landing page and trigger this signature. " Regards, kotresha

KotreshaMC · ‎08-29-2017

Unknown-tcp means the firewall captured the three-way TCP handshake, but the application was not identified. This may be due to the use of a custom application for which the firewall does not have signatures. Seesion end reason is (n/a or unknown): PAN-OS provides a session end reason field for traffic logs. This field only applies to logs of subtype end . For all other subtypes, the value is not applicable (N/A)(example: logs of subtype: start it will show n/a) I guess you have enabled both Log at Session Start, Log at Session end on the associated security rule thats why it's showing both unknwon and and aged out on the session end reason, DNS uses UDP protocols so its obivisouly aged-out always. i dont think this caused internt slowness on the PC.

KotreshaMC · ‎08-28-2017

great insights aboubt Virtualization, i love the way you explain.

KotreshaMC · ‎04-20-2017

Thanks for all your support, after upgrading the firewall to 7.1.9 issue resolved.

KotreshaMC · ‎04-17-2017

1) Is there any other portal configuration that you get, other than the rest of the users? Ans: No 2) Although you mentioned the default method is IPsec, but please verify that you are indeed connecting via IPsec too. Once you are connected to the GP, check under Network->Gateway->Remote users(right side). See what the tunnel type column says. Ans: SSL 2) What's the connect method - on-demand? pre-logon? etc.? Ans: On-demand (with RSA token) 3) Have you tried your account from another machine? Ans: Yes, it worked fine 4) Have you tried re-installing the client? (I'd suggest trying with 3.1.6) Ans: Yes i tried but not usefull 5) Configure split-tunnelling, if you don't have it already. Send the private subnets traffic to firewall, send the internet traffic through your regular adapter. Run a continuous ping from cmd (ping -t 8.8.8.8). If you see the GP disconnecting, see if there is any ping drops. Ans: We have configured split-tunnel.

KotreshaMC · ‎04-12-2017

you can try # commit force from CLI

KotreshaMC · ‎04-12-2017

Can anybody help with this ?

KotreshaMC · ‎04-12-2017

PAN OS:7.1.3 GP version:3.1.5 Operating system: Windows 10 Pro We are connecting over:IPSec tunnel

KotreshaMC · ‎04-12-2017

I have reinstaled already but still fac @BPry wrote: If your getting a fatal:bad record mac then you have an issue as the error itself is completely fatal to the VPN communication process. This is caused by the first encrypted message has something wrong with it's crypto and immediately shows up as bad_record_mac. Just by the nature of VPN appliances this message is purposely cryptic and can be anything from failing integrity checks or for anything in the cryptographic layer. I would first start to troubleshoot by uninstalling and reinstalling GP, it might help to take off any other VPN application you have installed as well as this could potentially cause issues as well. ing the same issue.

KotreshaMC · ‎04-11-2017

Hi, Im facing issue with connecting to GP VPN, unfortunatly im the one who is having issue. VPN works fine on other cmputer but having issue with my computer below are the error msg i got during the VPN disconnect time (T10836) 04/11/17 18:51:28:501 Debug( 980): VPN handle dhcp packet (T10516) 04/11/17 18:51:46:676 Debug(1189): SSL3 alert write:fatal:bad record mac (T10516) 04/11/17 18:51:46:676 Error( 840): SSL_read() failed: 1 -1 socket error 0. ntry is 0 (T10516) 04/11/17 18:51:46:676 Error( 811): VPN: Socket Failed to receive! ret = -1 (T10516) 04/11/17 18:51:46:676 Error(1126): ProcPackets, RecvFromSocket() failed (T10516) 04/11/17 18:51:46:676 Error( 410): ProcPackets() failed, get out of ProcMonitor (T10836) 04/11/17 18:51:46:676 Info ( 553): ProDrv: VPN disconnect event, get out of ProcDrv (T10836) 04/11/17 18:51:46:676 Info ( 570): ProcDrv thread dies (T10516) 04/11/17 18:51:46:676 Info ( 527): ProcDrv quit (T10516) 04/11/17 18:51:46:676 Info ( 504): Before ProcMonitor quit, disconnect vpn Can anybody know whats the issue and how to overcome from this? Kindly help me. Kotresha

KotreshaMC · ‎11-29-2016

I hope its future of Global protect, check this configuration under Network->Gllbal protect->gateway->selcet gateway->agent->external gateway check is it manuall or not?

KotreshaMC · ‎08-17-2016

Hi Reaper, i don't think aged-out is the naturall way of seeion end, Aged out - Occurs when a session closes due to aging out I'm sorry if i'm worng,

KotreshaMC · ‎07-01-2016

There is one another way i found, we can create the objets with the FQDN provided in the article and create security policy for it (FQDN initially resolves at commit time. Entries are subsequently refreshed when the firewall performs a check every 30 minutes; all changes in the IP address for the entries are picked up at the refresh cycle) so this might helpful in blocking the IP that resolves to specified shodan domain.

KotreshaMC · ‎06-30-2016

It's inbound not outbound traffic.

KotreshaMC · ‎06-30-2016

We are aslo observing the simmilar kind of traffic triggering from the IP's listed in that article. blocking individual IP is not good idea but if there is any way that we can block IP's thase resolves to * shodan.io will be best approach. Im not sure how we can do this 😞

KotreshaMC · ‎06-21-2016

Me too.

KotreshaMC · ‎06-15-2016

After renewing the both certificate also we are getting the same alert 😞 😞

KotreshaMC · ‎06-13-2016

Any thoughts about this query??? @reaper

KotreshaMC · ‎06-12-2016

After adding icmp to application it's started working fine. Thanks for your all support guys.

KotreshaMC · ‎06-09-2016

We are receving this alert for the certificate expiration we have configured MDM with one of trusted root certificate (this got expired and we renewed that recently) MDM---->created with root-CA certificate certificate: --root-CA (this was expired but nenewed now) Another certificate( this is expired) but still we are getting this alert? do we need renew the chained certificate of the trusted root certificate also? and we can see that MDM is showing idle (red)

KotreshaMC · ‎06-09-2016

As we can see the link status is showing down in alert.

KotreshaMC · ‎06-09-2016

Hi All, We are using kaseya for monitoring palo alto firewall it was working fine month back but suddenly it stopped and we are getting "Timeout while waiting for response from agent." for all the montors we set up for the anyboady know the solution for this? Regards, Kotresha

KotreshaMC · ‎06-08-2016

You mean to say it's common?? like it'ss be default agedout for ping request?

KotreshaMC · ‎06-08-2016

Hi all, I was able to ping external server from firewall and getting reply back from the server without any issues, however in firewall log it's showing aged out. Anybody know the reason behind this?why we are getting agedout after proper response from the external server?? Regards, Kotresha

KotreshaMC · ‎06-07-2016

I hope below process helps you https://live.paloaltonetworks.com/t5/Management-Articles/How-to-upgrade-a-High-Availability-HA-pair/ta-p/57081 Regards, Kotresha

KotreshaMC · ‎06-07-2016

Yes i can confirm that the rule is above the default deny and we are allowing ping to and fro from cloud servers to internal servers. There no NAT applied on this. however i have added ICMP to the rule and waiting for the test

KotreshaMC · ‎06-07-2016

thanks for your all response We found solution We checked the logs and found that the tunnel was down due to reason "Timed out" - This means we were not getting any reply from the peer end - We took the captures and logs and confirmed that we were not receiving any replies - We checked on the peer end firewall and the traffic was getting dropped by policy "Drop Log" - We created one additional rule above Drop Log to allow the IKE and IPSEC-ESP traffic - As soon as we did that, we confirmed that the tunnel was up.

KotreshaMC · ‎06-07-2016

I can see ICMP IP protocol in the logs.

KotreshaMC · ‎06-07-2016

Yes we have enabled it and i can see it the Zones and ips are correct but still it's not working

KotreshaMC · ‎06-06-2016

the rule is on the top of default deny but still it's not working.

Date Registered	‎12-15-2015 11:19 PM
Date Last Visited	‎11-17-2017 05:11 AM
Total Messages Posted	48
Total Likes Received	4

Online Status	Offline
Date Last Visited	‎11-17-2017 05:11 AM

Strata

Prisma

Cortex

About KotreshaMC