About BPry

BPry

@Rajendranahak, This is a known limitation; you can't have more than 250 proxy-IDs assigned on any one tunnel, and it looks like you do.

BPry

Nope, ran into the same thing today as well. Solved it by simply using the GUI to go into the portal configuration, going into the agent configuration and simply clicking okay. That seemed to get things sorted, but didn't change anything within the XML configuration (where I actually make any changed) and allowed the validation error to clear. Super annoying and took me way to long to get to the bottom of it, especially since it didn't change anything other than order in the XML between commits.

BPry

@SAugustin, Do you actually have an active GlobalProtect subscription on this firewall? If not, you can go to the support portal and generate a trial subscription for the next 60-days.

BPry

@JohnQuile, Changing to Always-On doesn't require you to re-install the agent, it will simply update it's configuration in the background the next time it connects to the portal. Short answer is this will work perfectly fine, here is a KB article about getting it setup.

BPry

@Sourav_Saha, Personally I would recommend using something like pan(w)achrome, a chrome extension, for monitoring things like this if you don't already have something setup via SNMP monitoring.

BPry

@vmtechzakirhussain, To verify that what I'm saying was understood; if you want to pull data from two different domains you would do this by installing the standalone user-id agent on windows server, instead of using the integrated user-id agent on the firewall. You would simply configure the firewall to connect to these windows-based user-id agents and pull the information from these agents. Windows-user-id Agent Configuration Numerous Mapping Sources Documentation

BPry

@Graeme_Riddell, So your system log forwarding will be under Device->Log Settings in the GUI, which is probably where your SIEM is getting these logs, not the log forwarding profile. Look what you have under 'System' and configure the filter as required for the entry sending the logs to your SIEM.

BPry

@jfritchey, This should be working perfectly fine, the one thing that you have to check when doing something like this, is if the traffic is actually being allowed through your security rulebase (if it's passing through your firewall).

BPry

@BrianAllison, Unless you absolutely need 5.1, I would be sticking with 5.0.6. 5.1 is still early in its release cycle and I've found plenty of odd bugs with it. If you absolutely need 5.1, reach out to TAC and open a case on it.

BPry

@vmtechzakirhussain, This is only a limitation of the built-in user-id agent; if you setup the agent on antoher Windows machine the firewall can pull information from two different domains easily.

BPry

@RussMcIntire, As long as you have configured the vlan interfaces as layer-3, follow the following KB to setup the DHCP relay on the firewall. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFXCA0

BPry

@aaobuhov, You could. As you said, it would be less restrictive and potentially allow additional traffic that you otherwise could have decrypted and gained insight into.

BPry

@aaobuhov, That is the actual list yes. You can exclude these domains in either method, personally I like doing it in the decryption rulebase via a custom No-Decrypt URL category.

BPry

@NetWright, I guess if you don't trust what the CLI is telling you can the certificate as specified in your decryption rulebase entires you would need to perform a PCAP and verify that the client is actually getting the correct cert. Really though as long as the above command is showing you what you need and the actual decryption entries reference the correct certificate I can't think of a reason why you would need to verify it further; but if for some reason you do, a simple PCAP on the client traffic would work perfectly fine.

BPry

@idelconsulting You're just missing the rsa-nbits part of the command. request certificate generate name "paab.xyz.local" certificate-name "paabself" algorithm RSA rsa-nbits 2048

BPry

@Shawverr @1onerobertone1, There really isn't a good way to do something like this through the firewall itself. I know that creating a custom data pattern and utilizing it within a DLP profile was a way that people have worked around this limitation in the past. Sadly the way that Google recommends restricting this access with a special HTTP header isn't something that PAN supports at the moment, and Google doesn't offer anything to make categorizing the application anything other than gmail. So a custom data pattern is going to be the best solution that you can really do at the moment, but that isn't the best solution and isn't without problems in it's own.

BPry

@vravindra, This can be a large number of things, without additonal insight into how you have things configured saying exactly what it is isn't going to be possible. I personally would be reaching out to TAC so that someone can actually look at how a firewall you are deploying is actually configured. A few things to check though: The firewall has corresponding routes for all subnets pointing to the first IP of the subnet the firewall is attached to. Ensure the interface itself has IP Forwarding enabled on the Azure side of things when configured through terraform. The UDR is being properly assigned to the subnets.

BPry

@iscott, The process that you are looking at is very specific to the management interface; if the data is going across a dataplane interface you would simply follow the usual PCAP process.

BPry

You're looking for the following command in the CLI show system setting ssl-decrypt certificate

BPry

@nextgenhappiness, So you went from a non-recommended upgrade path to mirroring the recommended upgrade path and your issues went away, funny how that works out 😉 ; - ) In all seriousness, this is exactly why I stress following the actual recommended upgrade path as much as I do. 95% of the time it won't matter and everything will work perfectly fine, but then 5% of the time something breaks and can cause an outage. It's better that you follow the proper process and need a bit more time for the maintenance window than have an issue and cause an unexpected outage or unexpected extended maintenance.

BPry

@alterioc, Because you are utilizing user-id to accomplish this, you'll only ever be able to utilize this via a single IP address at a time.

BPry

@deepak12, Is this just for ease of use for the GUI/CLI or for automation? If it's for automation, you can actually utilize the API call below to show the high-availability state result. Once you have the result it's just as simple as parsing the result to determine the peers HA state, and then you can pass your automation calls to the active peer. https://firewall/api/?type=op&cmd=<show><high-availability><state></state></high-availability></show>&key=myfirewallkey If this isn't for automation and you simply want to have an easy way of only ever hitting the active unit, you don't have any other option outside of setting up an interface management profile as mentioned by @OwenFuller.

BPry

@Sailesh_Aryal, Demisto as in Palo's SOAR software? I'd be rather interested to see any playbooks that would actually do this from Demisto if you know of any examples that are published anywhere; while its certainly possible someone took the time to build one out, Demisto isn't really meant for anything like this.

BPry

Couple ways you can do it, as @OtakarKlier has already mentioned: CLI: set address "My Server" ip-netmask 192.168.1.1/32 You could set all of your set statements how you want and paste them in, which would work fine. Configuration File: # FQDN # <entry name="updates.cuasvc.com"> <fqdn>updates.cuasvc.com</fqdn> <tag> <member>Barracuda-Updates</member> </tag> </entry> # Netmask # <entry name="Test-GlobalProtect"> <ip-netmask>172.16.253.128/25</ip-netmask> <tag> <member>GlobalProtect</member> </tag> </entry> You can locate where these go in your configuration file easier if you search for <address-group> since <address> is referenced a bit in the configuration file. API: https://192.168.1.1/api/?key=MYAPIKEY&type=config&action=set&xpath=/config/shared/address/entry[@name='Google-DNS']&element=<ip-netmask>8.8.8.8/32</ip-netmask> You can use any of these methods to build out your address object base quickly. Personally; I'm a big fan of modifying the configuration file itself and feeding it back into the firewall, because you can put the configuration file into Git, but I also find XML easy to work with.

BPry

@danielarojas, PAN is just short for Palo Alto Networks; the Cisco SFP that you have listed is pretty standard, while you should be perfectly fine I'm never going to tell someone for certain an unsupported component will work with their equipment.

BPry

@alo_palto, Are you just talking about creating large numbers of address objects?

BPry

@FarzanaMustafa, The firewall isn't actually capable of doing this at the moment natively, but I believe a feature request that you could reach out to your SE and have them add your vote to. You can do this through extensive scripting and use of the API, but you are essentially just using information gathered from the firewall to update the firewall in an automated nature.

BPry · ‎03-03-2020

@DGonzalezAR, So you won't be able to do the transfer from a pen drive. You can do it through the GUI or directly through the CLI, but the actual file won't read from a USB. For downloading the license, you simply need to go to the Devices list under the Assets field on the support site and click the little download icon next to the License, that will download the license key file to your computer. Then you will simply go into the GUI and under the 'Licenses' section under 'Device' there is a section for License Management. You'll want to select the 'Manually upload license key' option and specify the license key file that you just downloaded from the support page.

BPry · ‎03-03-2020

@Mohammed_Yasin, You need to reach out to support and request that they add support for ARM processors; this is already in the works, but more people asking for it may prioritize the request higher in PANs internal processes. As it currently stands, you won't be able to install Traps on this endpoint.

BPry · ‎03-03-2020

@DGonzalezAR, Once you have the RMA unit you need to add the device to your support portal, and then transfer the licenses from your old firewall to the new RMA unit. You'll then be able to download the license key files straight from the support portal and load them onto your firewall without any internet access requirements for the firewall itself.

Date Registered	‎05-26-2016 07:16 AM
Date Last Visited	Tuesday
Total Messages Posted	3,702
Total Likes Received	1189

Online Status	Offline
Date Last Visited	Tuesday

Strata

Prisma

Cortex

About BPry