About Farzana

Farzana · ‎09-25-2018

Hello, The issues we are experiencing are with SSL decrypt. When this setting is enabled we are experiencing significantly degraded internet performance. We understand that this would have an overhead but the current overhead makes it almost unusable. The symptoms are worse on pages such as youtube.com due to the ads. We have tested with SSL decrypt disabled and performance is as expected however as soon SSL decrypt is enabled an significant performance decrease is notice. In the hope to resolve we have tested on the following versions however the issue is present on both versions. Reproduced issue on PAN-OS 7.1.8 Reproduced issue on PAN-OS 8.0.12 Any advice would be appreciated.

Farzana · ‎09-16-2018

Hello, Our wildcard certificate doesn't have any SANs associated with it. Is this a requirement for usage of a wildcard cert? Can I use the same certificate for both web management and GP? Thanks in advance.

Farzana · ‎09-11-2018

Hello, We've been using GlobalProtect on Windows and Mac for a long time now in conjunction with our RSA SecureID MFA appliances. We've recently started trialling the GlobalProtect client on Linux, however no users are able to authenticate against the RSA SecureID appliance via the Linux client due to a "Passcode format error". I have tried multiple users on the Linux client with the same result. I can however, jump back on my windows device and using the exact same credentials as I tried on Linux, connect successfully using the Windows GlobalProtect client. Therefore, it seems to be the way the Linux client is sending the RSA SecureID details back to the Palo Alto's to pass on the the Radius server. Any help would be appreciated.

Farzana · ‎09-06-2018

Thank you @reaper. We are using VM-200. Does that mean the firewall is not utilizing the CPU cores that we assign to the Hyper-V? For example, we've assigned 8 cores to the Hyper-V and in the chrome extension picks up that it has 8 cores assign to it. In that case, does the management plane and the dataplane share all 8 or is it like one core for the dataplane and the rest for the management plane according to the website? (https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/about-the-vm-series-firewall/vm-series-models/vm-series-system-requirements) I was also looking for a MIB OID to monitor the throughput of the firewall. The maximum I could see was 660Mbps. Could you please advise me the OID for the throughput monitor?

Farzana · ‎09-03-2018

@reaper, @vsys_remo Thank you both. After upgrading the Primary firewall and make it functional again, will it not prompt about the mismatch of the IOS version on the peers in HA. Will The HA work? Will it allow me to suspend the secondary from the HA pair so that primary which will run on new version can take over?

Farzana · ‎09-02-2018

Hello, What is the difference between the System Resources in the GUI and the CLI? The CPU percentages are different.

Farzana · ‎08-30-2018

Hello, We are using PAN-OS 7.0.2 which is end of life and wanting to upgrade to 7.1.17. Can we upgrade one firewall through all the versions 7.0.2-->7.0.19-->7.1.0-->7.1.17 before moving on to another in the pair or do we have to bring both firewalls in pair on same version before making a move onto the next version in line? Thanks in advance!

Farzana · ‎08-23-2018

Hi @vsys_remo Thank you for your reply. Actually I am not talking about adding a system disk. I’m talking about adding a another 2TB disk for logging. This panorama is not coming from ver 7.X.X. This was provisioned with base version 8.0.2, so it already has a system disk of 81GB. So, we don't need to add an additional system disk in this case. Only thing is, it’s in Legacy mode. So, I want to change the mode and add a 2TB logging disk. Is this okay?

Farzana · ‎08-23-2018

Our panorama is in Legacy Mode with no additional disks. We are planning to do two things. • Adding another 2TB disk for logging • Change it from Legacy Mode to Panorama mode. I’d like to know the best order to follow. Can we add the disk first (which will also start moving the logs from the system disk to the new disk) and then change it to Panorama mode. Or should it be the other way around ? Thanks in advance!

Farzana · ‎08-21-2018

Hello, I am unable to uninstall Traps from my machine. I want to uninstall it so that I can do a clean reinstall. I tried following the article on this link https://www.paloaltonetworks.com/documentation/41/endpoint/endpoint-admin-guide/set-up-the-traps-infrastructure/install-traps-components-using-msiexec/uninstall-traps-components But then it says I cannot uninstall something which is not there. The Traps client is on my task tray but not in control panel. Thanks in advance.

Farzana · ‎08-16-2018

@gwesson, thank you once again for the explanation. So if we set the option to 'disallow', do we need to push out the GP client via another mechanism or it will auto upgrade in client pc?

Farzana · ‎08-16-2018

@gwesson thank you for your prompt reply. Any idea why is it prompting to download an older version even though I have downloaded 4.1.0 on my machine?

Farzana · ‎08-16-2018

Hello, We have PAN OS 8.0.3 with the GP client version 4.0.2 deployed to our clients. This works fine. I've downloaded GP version 4.1.0 on my machine and when I connect it asks me to downgrade to an older version. We haven't uploaded any GP client to the PAN itself. We want to deploy the new version to the users but we don't want them to see this message of course. What should we do? Thanks in advance.

Farzana · ‎08-06-2018

Hi @vsys_remo, Thank you for your response. We have two 400mb internet connections which are load balanced using ECMP on the PA-3020. We have 80mb configured for class 1 on our QoS profile for the outbound internet links. We have 200mb configured for class 1 on our WAN connections. There are also class 4 & 5 configured, but no QoS policies exist for these. Our speed issue is from our remote sites connected through our ISP MPLS (coming in on our WAN link). There are many factors involved in this solution, so I’m just trying to rule out QoS as a potential cause. Screenshots are below. QoS Policy QoS Interfaces QoS Profile

Farzana · ‎08-05-2018

Hello, I am experiencing speed issues that I believe may be related to the current QoS configuration on my PA-3020 firewall. I currently have 2 different QoS classes defined: Class 1 & 2. I have three applications under class 1, and one application under class 2. However, under the QoS profile assigned to my outbound internet links, I have an additional 2 classes defined. I have class 4 assigned with a guaranteed egress of 250mbps, and class 5 with a guaranteed egress of 49mbps. I am wondering if these 2 additional classes still have bandwidth set aside for them (250mbps & 49mbps), despite the fact that there are no applications defined as class 4 or 5. PAN-OS is 8.0.9 Thanks in advance.

Farzana · ‎08-05-2018

Hello, When I try to download PAN-OS software directly to the passive firewall it says “Failed to check upgrade info due to generic communication error. Please check network connectivity and try again”. It is working fine in Active device. Is it the case in active/passive scenario, the passive can’t talk unless it takes over? I have checked all the interfaces and connectivity looks fine. Thanks in advance.

Farzana · ‎07-12-2018

Hello, We have 500 users on site and currently using Agentless User-ID with PANOS 7.1.7 We are thinking of scaling up to Agent based. Can someone please guide me to a link/article that discusses the Pros and Cons of both? What are the common issues one facing with Agent based? Are there any limitations? etc. Thanks in advance!

Farzana · ‎06-06-2018

Hello, We are not getting the list of individual users in the command: show user group name <name> > show user group name "CN=adminstaff,OU=staff,OU=security,OU=Groups,OU=College,OU=Schools,OU=CEWA,DC=test,DC=edu,DC=au" short name: test\adminstaff source type: ldap source: TEST_AD_Groups We can see them in the Webgui. We followed the setup as per the link below. https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Active-Directory-Server-Profile-for-Group/ta-p/58089 Thanks in advance!

Farzana · ‎05-29-2018

Hello, I’ve got a single public IP address, which is used for GlobalProtect SSL VPN. I also want use this single public IP address to allow inbound static NAT to a SSL web server on my LAN. Using GP 4.0.5 When I do this, the GlobalProtect SSL VPN client stops working and starts redirecting the traffic to the SSL web server. Is there a way around this so that both the GlobalProtect SSL VPN client and SSL web server will work on a single public IP address without having to use a separate IP address? Thanks in advance!

Farzana · ‎05-23-2018

Hello, Can you please provide the steps how to block facebook messenger? Thanks in advance.

Farzana · ‎05-03-2018

Hello, After enabling SSL Decryption, we cannot download from Windows store. Getting error below. Tried excluding hostname with Microsoft but no luck. How to fix this issue? Thanks in advance.

Farzana · ‎04-08-2018

Hello, We have a VM-100 Palo Alto at version 7.1.12 and we are looking to use the Palo Alto pre-defined Block lists. The current Threat Protection license is using version 8001-4627 (04/06/18) however the 2 pre-defined lists are not displaying in the “External Dynamic Lists” section. I have found lots of information regarding the Dynamic lists supplied by Palo Alto in PANOS 8.0 documentation, see below: https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/content-inspection-features/palo-alto-networks-malicious-ip-address-feeds Can you confirm if this feature is available in version 7.1.12? Thanks in advance.

Farzana · ‎03-15-2018

@MickBall Many thanks for your reply. That sounds great! Is there any article on how to use a single gateway with multiple address pools to keep traffic separated?

Farzana · ‎03-13-2018

Hello, We are running PAN-OS 8.0.7 and require a second external gateway to connect a POS server (which can run the GlobalProtect client fine). The configuration has been done and the client successfully authenticates but for some reason the Agent configuration which would instruct the client to connect to the POS gateway is not being selected - the CorpVPN configuration is (this is definitely not desired). Note that neither of the agent configurations have more than one gateway. Even so, the gateway for the CorpVPN has a lower priority than that of the POSVPN. The response time is likely lower on the “MobilePOS VPN” Gateway. An external IP is assigned to the MobileVPN gateway but not to the MobilePOS VPN gateway. The client has only a single external facing IP (which is being used currently for both the portal and the CorpVPN gateway). Does each gateway require a separate public IP address? Thanks in advance.

Farzana · ‎03-07-2018

Hi, Raised case with TAC support. It is a bug in 8.0.2 We will upgrade Panorama to 8.0.7 or 8.0.8 I will close the loop.

Farzana · ‎03-05-2018

I was told that we can use a tool called Best Practice Assessment. Have you got the link/app to access it?

Farzana · ‎03-05-2018

Hello, We are trying to push the device config bundle to the first firewall in the HA pair, which I’ve successfully imported the configuration for. However, getting error message below when trying to 'Push to Commit' or 'Export' from Panorama. Note the configuration itself it very small – there are no security policies and less than 20 objects. Using PAN-OS 8.0.2. Tried following the article below: https://live.paloaltonetworks.com/t5/Migration-Articles/How-to-Perform-a-Device-Config-Import-into-Panorama/ta-p/67742

Farzana · ‎03-05-2018

Hello, We need to export our FW rules into an excel sheet and then have a column that has a description of what the rule is for and who authorized it, what is the best and faster way of doing it ? I tried following the link below and tried to export the named configuration snapshot but I am unable to see the security policies in the xml file, which is weird because I can’t see the whole configuration in the xml file. https://indeni.com/how-to-export-palo-alto-networks-firewalls/ I had a look at the link below but not sure how to perform the task. https://live.paloaltonetworks.com/t5/API-Articles/Simple-export-of-rules-as-Excel-or-HTML/ta-p/65082 Can someone please summarize the steps? Thanks in Advance.

Farzana · ‎03-04-2018

Hello, We implemented the blocking policy for the custom URL categories however now once committed we receive commit warning like the following: Application 'dropbox-base' requires 'web-browsing' be allowed, but 'web-browsing' is denied in Rule 'outbound-advertisement-block' Application 'google-drive-web' requires 'google-base' be allowed, but 'google-base' is denied in Rule 'outbound-advertisement-block' The policies for Dropbox and Google drive are policy 14 and 19, and the advertisement block is 53. Why would the allow policies above the deny policy be generating warning? We have other deny policies and they do not generate the warning messages. It’s just that we can’t really have the following showing every time we commit a change. It will blind us to actual issues...? vsys1: Rule 'outbound ms-update' application dependency warning: Application 'ms-update' requires 'ssl' be allowed vsys1: Rule 'outbound_dropbox' application dependency warning: Application 'dropbox-base' requires 'web-browsing' be allowed, but 'web-browsing' is denied in Rule 'outbound-advertisement-block' Application 'dropbox-uploading' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block' Application 'dropbox-paper' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block' Application 'dropbox-paper' requires 'web-browsing' be allowed, but 'web-browsing' is denied in Rule 'outbound-advertisement-block' Application 'dropbox-downloading' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block' Application 'dropbox-sharing' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block' Application 'dropbox-editing' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block' Application 'dropbox-posting' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block' vsys1: Rule 'Google Drive Access' application dependency warning: Application 'google-drive-web' requires 'google-base' be allowed, but 'google-base' is denied in Rule 'outbound-advertisement-block' Application 'google-drive-web' requires 'google-docs-base' be allowed, but 'google-docs-base' is denied in Rule 'outbound-advertisement-block' Application 'google-drive-web' requires 'google-docs-editing' be allowed, but 'google-docs-editing' is denied in Rule 'outbound-advertisement-block' Application 'google-drive-web' requires 'google-docs-uploading' be allowed, but 'google-docs-uploading' is denied in Rule 'outbound-advertisement-block' vsys1: Rule 'Video Streaming RTMP Pull' application dependency warning: Application 'rtmpt' requires 'web-browsing' be allowed, but 'web-browsing' is denied in Rule 'outbound-advertisement-block' (Module: device) Thanks in advance.

Farzana · ‎03-01-2018

Hello, I go to ACC tab -->Onleft side select the time frame --> Network Activity -->User Activity --> Export to PDF 1) User activity report when it is pulled it shows Source User and destination User. What is that destination user means? 2)Under Destination IP activity tab, once the report is pulled it shows the destination IP's but we want the destination URL's to be shown. Can we achive this? Thanks in advance.

Date Registered	‎07-24-2016 02:36 AM
Date Last Visited	‎10-01-2018 09:07 PM
Total Messages Posted	196
Total Likes Received	20

Online Status	Offline
Date Last Visited	‎10-01-2018 09:07 PM

Strata

Prisma

Cortex

About Farzana