About dstjames

I notice that if a connection comes in and does not hit any policy correctly I do not see the deny in the logs. I think this is because the default behavior of the intrazone-default  rule is not to log anything. Is there a down side to setting this to log events so that we can see when a connection fails? Sometimes from a troubleshooting perspective this would be helpful but I wonder if its not enabled for a reason by default. I assume because it will generate a lot of logs but was wondering what everyone else thinks before I do this.      ... View more

I have the User-ID agent on one of my domain controllers and I have the firewalls set to get the ID from that and it gets some ID's but doesnt seem to get all. So I thought maybe add active directory and exchange server monitoring.    But I get errors in the panorama sysem log that just say connect-server-monitor-failure I set the account to domain admn even to see if it was a permission issue and its still saying this. Is there any way in the PA to get a better error that will give me more detail about why exactly its failing to connect?   ... View more

In pamorama I created a default template with basic configuration settings for all firewalls and then create a site specific template and put them both in a template stack to apply the stack to each firewall. This way the default settings apply to all firewalls for consistancy and we can apply site specific settings like individual rules. This works great so far.    One of the default settings we pushed out is a wildcard cert and a ssl/tls service profile so that we can use our domain to secure communication to the management web sites over SSL. This works great.    Later I setup global protect vpn for remote clients to connect. I  am doing this on only 1 locaiton currnetly so I made these changes to the site specific template and not the default template. When I go to add the cert and the TLS profile in the site sepecific template it doesnt see the cert or ssl/tls service profile pushed out with the default template even though its the same wildcard cert. I installed the cert and in the site specific template and created a new service profile and global protect works fine.    The issue is every time I commit to this firewall group now I get an error saying duplicate certificate subject found.    What is the best way to fix this? I thought maybe I had to make the change on the stack rather than the individual certs but everything is read only when I go to modify the stack.    Everything is working fine but my OCD finds it really annoying that the commit comes back with succedeed with warnings.  ... View more