About nikoo

Customer upgraded to 9.1.12 and after that it was noticed that for some of the zones, traffic was dropped. During debug,it was concluded that reason is  Strict IP Address Check in the Zone Protection Profile: "flow_dos_pf_strictip 1 0 drop flow dos Packets dropped: Zone protection option 'strict-ip-check'" In the 9.1.12 release notes it is noted: PAN-175934 Fixed an issue where packed-based zone protection settings (such as Strict IP Address Check) were not applied to return traffic. So one may think it is a bug that was fixed and customer has his routing table messed up, but after checking - routing seems to be fine. Traffic was dropped even from outside interface (with default route) to GlobalProtect interface which is loopback on the device. Same for Outside <-> DMZ traffic, which is directly connected interface, so essentially no dynamic/static routing is done there. Behavior can be confirmed and reproduced by turning on and off strict IP check in the zone protection profile.   Can anyone confirm this? Checking before opening TAC case.   Edit a bit later: PBR is not configured. ... View more

VM-300, 10.0.8-h4 on KVM. At one point issue with commit showed up: Error: Error reading signature DFA data failed to handle CONFIG_UPDATE_START Also updates for Wildfire & Apps/Threats were not being installed. HA sync started to fail. It was concluded that CTD resource usage is high - show system setting ctd state, Content Allocator Usage was 100%. Restarting VM helped, but just for a while, almost instantly usage was back when tried to install dynamic updates and same result - commit failed. Next step as per discussion found in the Live Community - Data Pattern Object was present on the firewall and it was deleted. Memory usage instantly dropped to 95% and after a while to 88% - commits, HA sync and updates are working as expected. Tried the same on the lab VM (no configuration, pretty much empty VM) - by creating custom Data Pattern and Spyware object, installing all the updates, etc. I got the usage to 91%, so couldn't really reproduce the 100% usage and didn't get the commit to fail.   Anyway, currently using Data Patter object is not mandatory, but overall - has anyone seen something similar? Is there a solution to use the custom objects while still keeping the memory usage in order? ... View more

Hello,   There are Smart Cards being used for the GP authentication. One of the options for Windows endpoints is to disconnect the GP as soon as Smart Card is removed and that was tested, option in the app settings: "Retain Connection on Smart Card Removal" set to No. But the result after removing the Smart Card is that prompt is shown to the user with two options: OK or Cancel. If clicking OK - GP is disconnected and no new connection can be established as there is no Smart Card connected. If clicking Cancel - connection is retained, all the previous resources work as expected and there's nothing preventing user to continue. Is this really expected behavior? Is anyone using this feature and may have any input? ... View more

Hello,   Configuring host firewall via XDR and I cannot seem to get the Windows environment variables running. Basically, there's an implicit deny for inbound/outbound connections, so there are applications that require some internal/localhost connections that are blocked. Due to this specific allow rule for such an application has to be made - based on the application path.  Specific application I'm talking about - Zoom. I've created rule that allows %USERPROFILE%\AppData\Roaming\Zoom\bin\Zoom.exe and %USERPROFILE%\AppData\Roaming\Zoom\bin\Zoom_launcher.exe, but this is not working and it can be seen in the Event Viewer that this app is being blocked by WFP by the implicit deny rule. If adding specific host firewall rule with full path (C:\Users\<username>\AppData\Roaming\Zoom\bin\Zoom.exe - app is working as expected, but that does not cover all the user cases, as this path depends on the user logged into the computer. Documentation says that it should be possible to user these environment variables: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/hardened-endpoint-security/host-firewall.html " Enter the full path and name of a program you want the rule to apply to. If you use system variables in the path definition, you must re-enforce the policy on the endpoint every time the directories and/or system variables on the endpoint change. "   Has anyone tried adding such a rules and did it succeed, is there any trick behind this? ... View more

There is a Smart Card solution that uses pkcs#11 and middlware that provides OS communication to the card. Is there a way to use this certificate from the card for GlobalProtect authentication? GP is looking for a cert in a specific location, but it is not possible to extract it from the Smart Card and import for GP (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLMaCAO).   Is this supported at all? If so, is there any information available? ... View more

There's deployment with Panorama and currently one HA PA pair managed by it. Panorama sitting at 9.1.5, firewalls at 9.1.4. Cortex Data Lake license is assigned to Panorama and seen in the Panorama -> Licenses section. In order for the firewalls to send the logs to Data Lake, I followed this guide: https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/panorama-and-cortex-data-lake/license-the-panorama-and-install-the-plugin and then https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/panorama-and-cortex-data-lake/forward-logs-from-panorama-managed-firewalls.html#id35a50f81-3b75-4919-b60d-1db38d6ee7b8  Issue: Cannot assign Logging Service license from the Panorama to managed devices - it is simply not present and refresh does not help, meaning I fail at step 2 from the 2nd link. Cloud service from Panorama perspective is validated and seems to be communicating just fine. So far I've tried: Upgrading Panorama from 9.1.4 to 9.1.5. Removing/re-adding Cloud Plugin to Panorama. Deleting all licenses from the PA and fetching once more via Panorama. There could be something obvious, but any ideas? ... View more