About hshawn

While I do agree with you, my guess is they rely on their customers using something else for this (PRTG, LibreNMS, Obersvium, other). You can also use the Pan(w)achrome extension in your browser which will use the API to generate the data/charts/graphs. ... View more

For me the issue is that if you are running a GP portal on port 80/443 then these methods for getting an LE cert won't work. Even NATing port 80 into another server that will only work when accessed by IP (hostname will try to use https)    Changing the ports that GP runs on is not a very elegant solution. I think having functionality built into PANOS that will take the GP portal into consideration might be helpful. For example in my case it would be nice to have a cert on my lab portal. ... View more

When we see this it is 100% of the time due to the user(s) not being in the AD group that is allowed to use the VPN. Once they are added to the proper group then they get a valid IP.    I did see this one other time after a PANOS upgrade everyone had 0.0.0.0 and that was a visual "glitch/bug" the user still had an IP address when checked on the CLI.     ... View more

Disable HA, boom you have two firewalls. If they are already licensed then that should do it. You will need to then do what you need for your network so that each is running the config they need. Make sure to cross your fingers and hope that you do not need the benefits of HA anymore. ... View more

Nah, you can do this without impacting any currently connected users. Yesterday we added more IPs to the pools   * Make sure the range you are using is not already in use * Add the new range to appropriate pool(s) * Edit/update any routes and objects you may have   all existing connections will be untouched ... View more

I don't think they have it setup to:   * Use the gnome task bar * Adapt to "dark" themes   But it does work, here is what I did:   * Create a "shortcut" on your desktop or in the dash-to-dock or wherever you like * Download a nice GP icon from the internet and pop that onto your shortcut properties   It should get better over time, it didn't used to show the GUI version at all and now with 5.1.1 it does. It also did not work with all flavors of Linux without some hacks and it should now work with any Linux. ... View more

Thanks for the info! I have been researching and I believe I am out of luck since I use Google Domains (not gcloud) and they do not have an API. I may have to move to another service to take advantage of the script. ... View more

This is interesting, I am glad I found this thread because it appears this acme.sh script may be what works for my lab setup however reading through the docs I do not see an option that would work for a PAN firewall that is hosting a GP VPN (ports 80 and 443 are in use). There is mention in this thread about this working without needing inbound connections but I am not seeing that outlined here: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert   I will comb through the docs more when I get off home tonight but am I missing something? Is this still in the works or should this give me a Let's Encrypt cert with auto renewal for the firewall (without needing a server behind the firewall exposed to the internet) as it is today?    Use case:  Generate a valid cert for the GP VPN portal domain. ... View more

I was not on the beta.    My main issue with this UI version is there seems to be no way of actually running it (no icon, no menu entry, the binary just complains about CLI mode).    Maybe its just a fresh bug.  ... View more

Seems pretty easty to set up but I think the question here is then what do you do with it? I am also curious about this. I have reached out to engineering to see about setting this up and see if we can get a value add from this feature but the individual is out for the next few days. Will watch this space for anyone chiming in and will report back if I make any progress setting things up. ... View more

I ended up doing a fresh install of 0.9.62 to resolve the issue for me. ... View more

I am using GP version 5.0.3 with a cert created by the firewall itself and imported into Linux. P.S. Fedora will not work since they are hard coding the supported Linux distros into the GP elf binary.    you can *force* it to work... if you are determined enough ... View more

Unfortunately we cannot run Ubuntu here the supported server OS is CentOS so I may have to just keep poking at it on my own. ... View more

I did try that before, tried it just now again and get the same error, I wonder if it is related to something on the distro version I am running. The error sounds like it has to do with the function being called rather than the conenction to FS-ISAC   $ uname -a Linux 3.10.0-957.21.3.el7.x86_64 #1 SMP Tue Jun 18 16:35:19 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux   cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) ... View more

Thanks I gave that a shot, getting the same error.   FS-ISAC provided:   filenanme.crt filename.key filename.p12 filename.pem   I am using the .crt and the .key file I am using the username and password for the CIR portal   stuck at this point, seems like it should be pretty simple ... View more

I can try that but I feel like the names are arbitrary, can anyone confirm?   Maybe it has to do with the version of MM I am using, and is possibly a bug. I am currently on ver 0.9.62 ... View more

Sure thing, Here is our prototype:   ... View more

Thanks to all the pieces everyone has provided to this puzzle in this thread I was able to finally get a FS-ISAC feed setup however it errors out when polling.   I noticed in the log files I was seeing:   2019-07-15T13:35:07 (2425)basepoller._actor_loop INFO: FS-ISAC-Feed-1563221567853 - command: 1563222907645 poll 2019-07-15T13:35:07 (2425)basepoller._polling_loop INFO: Polling FS-ISAC-Feed-1563221567853 2019-07-15T13:35:07 (2425)basepoller._poll ERROR: Exception in polling loop for FS-ISAC-Feed-1563221567853: global name 'HTTPSClientAuthHandler' is not defined Traceback (most recent call last): File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 724, in _poll performed = self._polling_loop() File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 571, in _polling_loop iterator = self._build_iterator(now) File "/opt/minemeld/engine/core/minemeld/ft/taxii.py", line 1131, in _build_iterator self._discover_services(tc) File "/opt/minemeld/engine/core/minemeld/ft/taxii.py", line 292, in _discover_services resp = self._call_taxii_service(self.discovery_service, tc, request) File "/opt/minemeld/engine/core/minemeld/ft/taxii.py", line 282, in _call_taxii_service port=port File "/opt/minemeld/engine/current/lib/python2.7/site-packages/libtaxii/clients.py", line 307, in call_taxii_service2 handler_list.append(HTTPSClientAuthHandler(k, c)) NameError: global name 'HTTPSClientAuthHandler' is not defined 2019-07-15T13:35:11 (2425)basepoller._polling_loop INFO: Polling FS-ISAC-Feed-1563221567853 2019-07-15T13:35:11 (2425)basepoller._poll ERROR: Exception in polling loop for FS-ISAC-Feed-1563221567853: global name 'HTTPSClientAuthHandler' is not defined Traceback (most recent call last): File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 724, in _poll performed = self._polling_loop() File "/opt/minemeld/engine/core/minemeld/ft/basepoller.py", line 571, in _polling_loop iterator = self._build_iterator(now) File "/opt/minemeld/engine/core/minemeld/ft/taxii.py", line 1131, in _build_iterator self._discover_services(tc) File "/opt/minemeld/engine/core/minemeld/ft/taxii.py", line 292, in _discover_services resp = self._call_taxii_service(self.discovery_service, tc, request) File "/opt/minemeld/engine/core/minemeld/ft/taxii.py", line 282, in _call_taxii_service port=port File "/opt/minemeld/engine/current/lib/python2.7/site-packages/libtaxii/clients.py", line 307, in call_taxii_service2 handler_list.append(HTTPSClientAuthHandler(k, c)) NameError: global name 'HTTPSClientAuthHandler' is not defined 2019-07-15T13:35:12 (2425)basepoller._actor_loop INFO: FS-ISAC-Feed-1563221567853 - command: 1563222907645 age_out 2019-07-15T13:35:12 (2425)table._query_by_index INFO: Deleted in scan of _age_out: 0 2019-07-15T13:35:12 (2425)basepoller._actor_loop INFO: FS-ISAC-Feed-1563221567853 - command: 1563222907645 gc 2019-07-15T13:35:12 (2425)table._query_by_index INFO: Deleted in scan of _withdrawn: 0 I tried the change suggested by @lukasj but that just hard downed Minemeld until I replaced the gevent directory with the old one again.   This is the error I am running into, what am I missing? The cert and username/password fields have green checks     Any suggestions?   TIA! ... View more

Might need a bit more info, are you looking on the panorama software tab or the panorama device deployment software tab? what version are you on now? if you are on 8.1.9 then there are no newer versions. You could log into your support portal and download the OS version you want that way.    Make sure your config is using the correct update server and your liceneses are still valid. You should see these as the latest M-100 versions:   ... View more

This is a known "cosmetic bug" There is another thread with more details on this but apparently it is going to be fixed in the next release coming up soon ... View more

We are also seeing this, the SaaS report that auto generates and emails each Friday as a PDF is empty. If I generate it manually and view the HTML version it is populated but saving as PDF gives me an empty report file.   Panorama 8.1.8 ... View more