About dtran

I don't expect PAN to be perfect but PAN claimed that version 9.1.11 should fix this issue, but it does NOT.  We're running version 9.1.12. ... View more

I opened a S1 ticket and waited on the phone for almost an hour, finally gave up after that.  Didn't get a call back until more than two hours after that, and the engineer doesn't have root access to fix the issue, he had to get another engineer to get root access, more waiting time.  What a waste of time and resource. ... View more

I am still waiting for TAC support.  PaloAlto support is so bad now that I am actually regretting going with PAN ... View more

I am also running into the same issue after upgrading from 9.1.12 to 10.0.9.  Open a S1 ticket with PAN support, called in and still waiting on the phone. ... View more

Opened a TAC case yesterday at 4pm EST as a Sev 2 (SLA is 2 hours response).  Called in and waited for 45 minutes with no response so I hung up.  Got no response from PAN support until 4:15am EST this morning.  The TAC engineer didn't even read the ticket.  I complained in the email and got a response from one of the manager and it said:  "My name is Raja and I am a Support Manager at Palo Alto Networks. I will have an Engineer working according to US Time to engage in your case and provide your an update." I called back into support this morning and still in waiting mode, not 1 person has picked up.  I am just speechless.   My daughter said something rather funny, that I should make a video on PAN support on Tiktok, LOL... ... View more

Just checked one of the firewalls and the issue is still there:   top - 16:44:11 up 206 days, 1:51, 1 user, load average: 1.12, 1.13, 1.14 Tasks: 313 total, 1 running, 311 sleeping, 0 stopped, 1 zombie %Cpu0 : 1.0 us, 0.3 sy, 0.0 ni, 98.7 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu1 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu2 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu3 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu4 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu5 : 59.8 us, 40.2 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu6 : 0.7 us, 0.3 sy, 0.0 ni, 98.0 id, 0.0 wa, 0.0 hi, 1.0 si, 0.0 st %Cpu7 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu8 : 0.0 us, 0.3 sy, 0.0 ni, 99.7 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu9 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu10 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu11 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu12 : 0.0 us, 0.3 sy, 0.0 ni, 99.7 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu13 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu14 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu15 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu16 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu17 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu18 : 0.3 us, 0.0 sy, 0.0 ni, 99.7 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu19 : 0.3 us, 0.3 sy, 0.0 ni, 99.3 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu20 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu21 : 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st %Cpu22 : 0.0 us, 0.0 sy, 0.0 ni, 99.7 id, 0.0 wa, 0.0 hi, 0.3 si, 0.0 st %Cpu23 : 0.7 us, 0.7 sy, 0.0 ni, 98.7 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st KiB Mem : 32640128 total, 187960 free, 6024212 used, 26427956 buff/cache KiB Swap: 0 total, 0 free, 0 used. 26133916 avail Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 6473 root 20 0 725852 265368 132752 S 100.7 0.8 199354:31 useridd 6835 root 20 0 4826292 3.086g 23240 S 3.0 9.9 10235:59 logrcvr ... View more

I gave up on PAN TAC support because the support is completely useless.  Lot of times, I feel like I am dealing with a five years old who has no clue what he/she is doing.  About 10% of the times, I get a good engineer who can understand the issue I am facing with; however, 90% of the times, they are just clueless.   Enough of my ranting, I ended up rebooting the device after the case got nowhere with TAC support.  I've also upgraded to 9.1.11hf3 and 9.1.12 so it might have resolved the issue.   YMMV. ... View more

Just as I expected, another bug from Palo Alto.  It is resolved in 9.1.11 and later version:   PAN-160253 Fixed an issue where only one medium-severity system log was generated if either the EDL file wasn't updated at the remote end or the downloaded file wasn't a text file. ... View more

I am 100% positive that the server is offering the file and confirmed by the capture.   I opened a TAC case with PAN and they suspsect a "bug".  What else is new, right?   I am not seeing this issue with PAN-OS 8.1.17   Btw, there is another issue with 9.1.x.  Look like PAN takes away the ability for you to see whether you use http or https from the CLI.  You can see that in 8.1.x, you can see the source as http but nowhere to be found in 9.1.x.  WTF!!!   PAN-OS: 8.1.17 request system external-list show type ip name EDL_XXX_YYY vsys1/EDL_iplist.txt: Next update at : Mon Nov 8 16:00:19 2021 Source : http://X.X.X.X/EDL_iplist.txt Referenced : Yes Valid : Yes Auth-Valid : Yes Total valid entries : 418 Total invalid entries : 0 Valid ips: 101.80.0.0/16 101.81.0.0/16 PAN-OS: 9.1.10 request system external-list show type ip name EDL_XXX_YYY EDL_XXX_YYY Total valid entries : 418 Total ignored entries : 0 Total invalid entries : 0 Total displayed entries : 100 Valid ips: 101.80.0.0/16 101.81.0.0/16 ... View more

@BPry:  I knew you were going to ask me that.  The answer is YES.  Even when I see that message on the PAN firewalls, I get 200 OK and the proper Content-Type is being recorded.   Here is an snip of it, the capture on the management interface:   GET /Internet-cciesec2011_iplist.txt HTTP/1.1 Host: edl.cciesec2011.com Accept: */* HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 16:00:04 GMT Server: Apache/2.2.15 (Red Hat) Last-Modified: Mon, 01 Nov 2021 19:56:59 GMT Accept-Ranges: bytes Content-Length: 6309 Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Note: CACHING IS DISABLED ON HOST Expires: Wed, 11 Jan 2023 05:00:00 GMT Connection: close Content-Type: text/plain; charset=UTF-8 4.2.2.2/32 4.2.2.1/32 Any other ideas?   Any other ideas? ... View more

@TomYoung:  Unfortunately, that will not help me.  I am currently running 9.1.10, and we're not going to 10.x anytime soon ☹️ .  ... View more

@TomYoung:  Thank you.  Can you also elaborate on the SSH service profile?  How do I go about doing this? ... View more

@TomYoung:  The thread you mentioned can not be done via scripting.  If you read closely, it stated "require console".  Unfortunately, console is NOT available in AWS. ... View more