About dstjames

dstjames · ‎07-09-2019

I notice that if a connection comes in and does not hit any policy correctly I do not see the deny in the logs. I think this is because the default behavior of the intrazone-default rule is not to log anything. Is there a down side to setting this to log events so that we can see when a connection fails? Sometimes from a troubleshooting perspective this would be helpful but I wonder if its not enabled for a reason by default. I assume because it will generate a lot of logs but was wondering what everyone else thinks before I do this.

dstjames · ‎05-07-2019

You need to provide more information. What error are you getting and what was changed?

dstjames · ‎02-01-2019

Where is this listed officially? On the cisco site they put a star next to the recommended code release but for palo alto I never really know what the recomended release really is until I call support and they say "your on an unrecommended release you need to upgrade."

dstjames · ‎01-18-2019

Support requested I upgrade from 8.1.1 to 8.1.5 because of an issue we had. I was really worried after reading this but so far I have had no issues with 8.1.5. Just my 2 cents so far. 🙂

dstjames · ‎01-11-2019

Can we assume that HA1 on one device is plugged in directly to HA1 on the secondary? If so I also assume you have replaced the cable just in case there is a cable issue? I use the dedicated HA ports on mine but they are all set for auto/auto

dstjames · ‎01-09-2019

I usually setup the hostname, management IP and HA information locally on each firewall then push everything else out from a single template to both firewalls. I also have 2 templates that I have setup in a template stack. 1 that has basic configurations that I want all firewalls in the environment to have like NTP servers, logging servers, etc. Then I have a specific template for each HA pair in the template stack and push the template stack out to the firewalls. This way you can make sure that the common settings are applied the exact same to all firewalls in the environment but also maintain individual site settings. Not sure if this is best practice but its how I configured it.

dstjames · ‎11-16-2018

I have the User-ID agent on one of my domain controllers and I have the firewalls set to get the ID from that and it gets some ID's but doesnt seem to get all. So I thought maybe add active directory and exchange server monitoring. But I get errors in the panorama sysem log that just say connect-server-monitor-failure I set the account to domain admn even to see if it was a permission issue and its still saying this. Is there any way in the PA to get a better error that will give me more detail about why exactly its failing to connect?

dstjames · ‎11-08-2018

I would check that it committed successfully. I remember when I first started using panorama I thought since I did not get an error that it committed and pushed correctly even though if you go in and check it my have failed for some reason.

dstjames · ‎11-08-2018

Not sure if its the correct way but the HA settings, the management IP, and the host name are the only things I do manually on each firewall rather than through panorama.

dstjames · ‎07-13-2018

Yeah 8.1.1.

dstjames · ‎07-06-2018

When I run this I get the following: Server error : Failed to execute op command

dstjames · ‎06-27-2018

We changed over to SFTP rather than FTPS and are much happier. The issue we had with FTPS is the random ports that are used were causing us issues.

dstjames · ‎04-04-2018

I had to setup u-turn for webmail access on our guest wifi network. The reason is because they are segregated from our internal network they use public DNS to go out and query the IP and get the public IP for e-mail rather than the internal. Then when the client goes out to this IP the internet would send it right back in the same connection and come back in. By default routers do not like to receive traffic that they send out the same interface. So the U-turn basically just tells the DNS query to use the DMZ IP rather than the public IP to get to this service. This fixed the issue for us.

dstjames · ‎10-13-2017

I had similar issues when I moved from stand alone firewalls to panorama. It was a major pain but now that everything is moved over and I push everything out through panorama I love it.

dstjames · ‎10-13-2017

Thanks for the reply. Yeah I put them in as different names. If I go to the firewall directly rather than through panorama I do see that it installed both certs and both tls serivce profiles. Since these are technically both the same cert thats why when I commit its telling me I have a duplicate subject name. Just not sure what the best practice is to use the same cert in both scenarios? I guess I could remove it from the default template and put all the cert settings in the site specific template. I was just hoping there was a better way.

Member Since	‎07-22-2016 07:35 AM
Date Last Visited	2 weeks ago
Posts	17

Online Status	Offline
Date Last Visited	2 weeks ago

About dstjames

Default deny logging question

Re: Facing issue in pushing the policy from Panorama to firewall

Re: What is current PAN OS version is target or recommended

Re: PAN OS 8.1.5 - Thoughts?

Re: Query on HA1 link

Default deny logging question

Re: Facing issue in pushing the policy from Panorama to firewall

Re: What is current PAN OS version is target or recommended

Re: PAN OS 8.1.5 - Thoughts?

Re: Query on HA1 link

Re: Panorama templates for an Active/Passive setup?

User-ID Agent

Re: Network Interface not pushed from Panorama

Re: Configure Firewall HA through Panorama

Re: There's a debug command that can help you clean up old logs automatically

Re: There's a debug command that can help you clean up old logs automatically

Re: Enable FTP and FTPS for Active/Passive?

Re: u-turn - why?

Re: Panorama slowly driving me insane.

Re: Panorama Certificate question

Network Security

Cloud Security

Security Operations

About dstjames