About Roby_Sreejith

Roby_Sreejith · ‎08-28-2018

I have requested palo alto uel re categorzation team for re categorizing the main url of a site for ex: abc dot com. It has re categorized correctlly by Palo as requested. However I am getting blocks when I access abc dot com /subdomain When i try re categorize request for this subdomain, I am getting a reply from PA about the main domain is categorized correctly. Is there any way to re-categorize the sub url from Palo Alto

Roby_Sreejith · ‎07-05-2018

Is the session is long live ( some applications like nfs,panorama) will start and last till 1 month. As we have configured log at session end, the log entry will be created once the session is ended. However we have configured netflow as well. Netflow is also reporting data to netflow server once the session ended on firewall ( which is 1 month later) Is this beghavior correct for netflow, I was think it used to report every session information based on interval configured which around 30 min. We are getting this information on netflow only after session ends. This is affecting for long duration sessions like 1 month. Is there any parameters to tweak this behavior

Roby_Sreejith · ‎07-03-2018

it happened only once. 7.1.7 is the version

Roby_Sreejith · ‎07-02-2018

what was the solution

Roby_Sreejith · ‎06-27-2018

We are using DHCP server relay in Palo Alto provide IPs to network. We have faced issues aboutpalo alto stopped processing DHCP relay It was not shown in system logs It was shown in dhcpd.logs == Warning: pan_dhcpd_cfgagent_initial_config_callback(pan_dhcpd_cfg.c:1902): pan_dhcpd_cfgagent_initial_config() failed 2018-05-13 14:44:35.441 +0200 Sending ALL Bound DHCP Client info to Peer since peer is now passive/susp 2018-05-13 14:44:35.458 +0200 The dataplane has come up 2018-05-13 14:44:35.763 +0200 HA local version 3; local compat 1; peer version 3; peer compat 1 2018-05-14 07:11:37.325 +0200 Warning: pan_hash_init(pan_hash.c:112): nbuckets 100 is not power of 2! 2018-05-14 07:11:37.338 +0200 Warning: pan_hash_init(pan_hash.c:112): nbuckets 100 is not power of 2! 2018-05-14 07:11:43.324 +0200 Warning: pan_hash_init(pan_hash.c:112): nbuckets 100 is not power of 2! == The reboot fixed the issue. However is there any way to monitor if similiar sitaution arrives.

Roby_Sreejith · ‎06-04-2018

I am having some issues new ISP. I have assigned my sub interface with /29 range of IP given by my ISP. I have added staic route towards gateway of ISP with exit interface( sub interface) specified in Palo Alto Virtual router. Can some tell who will initaite ARP between these interface( its same subnet) When I take the packet capture, only ISP sends the ARP request and Palo Alto interface reply back( arp reply). In Packet capture, I can not see any ARP request initaited from Palo Alto. Its just sending reply. ( i think i got answer this, in packet capture arp requests from PA wont be captured) The problem is after 30 min of arp cacahe in Palo , ARP is not updated in Palo. Why Sub interface of Palo Alto is not sedning ARP request. ISP only send ARP request in the begnning, after that it does not send the ARP request to Palo Alto Interface IP again. However it sends to other IPs in the /29 Subnet.

Roby_Sreejith · ‎06-01-2018

What will happen when arp expire after 30 min. I could not see palo alto sending arp towards ISP

Roby_Sreejith · ‎06-01-2018

I have done debug logs and I could not see ant NAT translation logs. Also Immeditaly, once i connect to different ISP it works fine. For this new ISP ,it learns ARP dynamically for first time. But after 30 min it expires then it never learns. Also if you configure static arp in Palo Alto sub interface it works fine

Roby_Sreejith · ‎05-31-2018

We are facing some starnge issue . We are having an ISP which is connected to sub interface. We are trying to repalce it with new one. Same Subnet /29 but different IP. NAT rules also same because same subnet. The issue we are facing is when new ISP configured , we are getting the ARP entries for ISP gateway on Palo Alto Sub interface however its expiring after 30 min which is normal arp interval. After 30 min ARP is not learning. I tried clearing arp. No success. Last I tried manually configured static ARP on sub interface and Now The sub interface can reach the gateway IP now. It seems after 30 min interval the Palo Alto is not trying to send the ARP request. However when I connect my old ISP back it works perfectly. Does some one face similiar issues

Roby_Sreejith · ‎04-18-2018

Thanks so much for this information

Roby_Sreejith · ‎04-12-2018

@kiwi I have checked and could not find this feature for filtering System logs, Have you tried this to filter system logs for specific pattern to crerate email alerts

Roby_Sreejith · ‎12-18-2017

any idea to configure email alert for this

Roby_Sreejith · ‎12-14-2017

I also look for this option ...i want to filter system logs in firewall and filter it with one keyword and send alerts via email only for those filtereed alerts

Roby_Sreejith · ‎12-14-2017

Can you help which document to refer for this

Roby_Sreejith · ‎12-14-2017

Is it possible to a custom report ands schedule an email in Palo Alto onbnly for succesful /failed SCP SFT backup done from Panorama

Roby_Sreejith · ‎12-06-2017

I have added the system logs screenshot in here. Can you tell me how to create custom email alerts for this issue. or is there any guide posted here for custom alerts

Roby_Sreejith · ‎12-06-2017

I have added some more details in the discussion with detailed pictures.

Roby_Sreejith · ‎12-06-2017

This feature is in PAN 8.x version

Roby_Sreejith · ‎12-06-2017

I beleive the backup in panoarama can not be extracted locally. This stays in Panorama. I have reqiremt of keeping a local backup copy of each firewall , so I choose an option to export to SCCP/SFTP server . So I have control in backup procedure. Now I need alert mechansim of which whethere this exort to SCP/SFTP server is success or not

Roby_Sreejith · ‎11-28-2017

There is is a problem with this bacakup. It stores in Panorama. I can not extarct this to locally.

Roby_Sreejith · ‎11-20-2017

I have configured Scheduled configuratio export for Panorama and all firewalls to an SCP server This is done via Panorama. Is there any way to schedule an email alert after evry succesful backup of configuration. Or in case of failed export of configuration . I can see the SCP export happening through system logs in panorama. I have filtererd with the SCP/SFTP server IP like below: Is it possible to filter this and create email alert:( custom email Alerts):

Roby_Sreejith · ‎10-31-2017

But we are in roduction alreaady with Palo Alto firewall. We have many rules with port wise. ( its runing for a long time) I need a tool which analyze the traffic logs of Palo Alto firewall and suggest this port can be replaced with Application.

Roby_Sreejith · ‎10-27-2017

Currently its not supported. However there is a workaround You can use custom signature option. For more details: https://live.paloaltonetworks.com/t5/Management-Articles/Limiting-File-Size-Upload-using-Custom-Signature/ta-p/69156

Roby_Sreejith · ‎10-27-2017

This seems to like an issue with control link times out before the data link connection happens. There is a timeout value for control connection which wait for data link connection. As there are no traffic reported during that time, while waiting for data link.

Roby_Sreejith · ‎10-26-2017

Please suggest any Automation tool or software which can be integrated to firewall: Main requirements: We have many port based rules. which the tools requires to analysze the traffic logs and suggest which application can be replaced with this. Similarly find the rule which can be combained : Rule combining if this can be done by Tools ( instead doing by Admins) this is preferrable.

Roby_Sreejith · ‎10-25-2017

I am also facing same issue can you share the results

Roby_Sreejith · ‎10-24-2017

This is my rule: The traffic is allowed, however suddenly the traffic will be denied and starts working after some time: Please refer the logs: The same traffic ( same porta and destination ) which was allowed suddenly denied in firewall.Data lane CPU percentage is below 20% during this time. its 5050 firewall with 7.1.7 verson. Have any one faced this sitaution

Roby_Sreejith · ‎08-22-2017

does the username show the same AD domain name or different

Roby_Sreejith · ‎08-22-2017

does user part of AD group, if not captive portal will be an option

Roby_Sreejith · ‎06-23-2017

@vsys_remoSo which means for data plane this OID only valid: Data plane -0- 1.3.6.1.2.1.25.3.3.1.2.2 ? I have seen some reference for tfor Data plane -1- 1.3.6.1.2.1.25.3.3.1.2.3 Was it removed or is there any reference to say only one OID for devices like 5050 where mutiple data planes are used

Date Registered	‎02-16-2016 12:56 AM
Date Last Visited	‎03-08-2019 10:10 AM
Total Messages Posted	98
Total Likes Received	7

Online Status	Offline
Date Last Visited	‎03-08-2019 10:10 AM

Strata

Prisma

Cortex

About Roby_Sreejith