About MPI-AE

MPI-AE · ‎03-22-2019

@hshawn for mac and windows, we use custom checks (registry / plist) to identify devices. how can that be done with linux?

MPI-AE · ‎03-20-2019

Has been a permission problem. Does the linux client support HIP? For example a maching string?

MPI-AE · ‎03-19-2019

@mmeehan I installed GlobalProtect_deb-4.1.9.0-2.deb on my Ubuntu Desktop 18.04 via dpkg -i. But I'm not able to open a vpn connection. It seems that the global protect client doesn't work at all. For example, I cannot get into prompt mode.I type in "globalprotect" and hit enter. The cursor gets into the next line but I can't type in anything there. Neither can I do a "globalprotect show --status. I don't get any output. Can you give me some tips?

MPI-AE · ‎03-15-2019

There is no version 4.1.8 for linux available. Should I take 4.1.7 then?

MPI-AE · ‎03-15-2019

Hey all, I've just updated the global protect version to 4.1.8 In the docs, it says that the client supports linux. I've followed that doc: https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-user-guide/globalprotect-app-for-linux/download-and-install-the-globalprotect-app-for-linux# It says I should download the package " PanGPLinux-4.1.0.tgz " to a mac endpoint. But I can only download "GlobalPortect.pkg" for macs from the portal. Can someone tell me how to get the package for linux clients? (for example ubuntu) Thank you!

MPI-AE · ‎02-26-2019

@Chacko42 Wow thank you! I have never used unified log before. But it helped me a lot because it's a url problem. Normally a url banner appears so I never expected that it's a url problem.

MPI-AE · ‎02-25-2019

Thank you, that makes it clear!

MPI-AE · ‎02-25-2019

@reaperWhen I compare the two configs as your screenshot shows, it shows me a lot of local settings that differ, for example: hostname, management ip address, peer-ip, ha ip addresses. I mean, that's okay since that are two physical firewalls. But what happens when I sync the config?

MPI-AE · ‎02-25-2019

Hey all! there are two pa 3020 with 8.0.7 in HA active passive. Three days ago, I switched the passive fw to active. Yesterday I switched back. I stated that the running config isn't synchronized, but I switched nevertheless. So I think I should "sync to peer" in the HA dashboard. But from which firewall to which firewall?

MPI-AE · ‎02-24-2019

@Chacko42No, I don't have a decryption policy

MPI-AE · ‎02-22-2019

Hey all, PA-3020 8.0.7 I would like to access https://experimental-concert-research.org and I get "Secured connection failed" The traffic log allows those packets, but session end reason says "policy-deny". I have never seen this before. Can someone tell me what's the problem here? Thank you.

MPI-AE · ‎02-21-2019

Hi @kiwi Where can I look up all those recommendations? Not only for GP, but also for PAN OS for example.

MPI-AE · ‎02-21-2019

Hey guys, PA-3020 with 8.0.7 and GP Client 4.0.5 I want to upgrade GP Client. Are there 4.1.X versions I should avoid or can I use the latest 4.1.10? Clients are Windows 7-10 and macos 10.12-10.14

MPI-AE · ‎02-18-2019

@OtakarKlierI think I can agree. I don't do anything until the end of life of 8.0. Then I decide to either upgrade to 8.1.6 (or 8.1.8/8/9....) or to 9.X if there's a stable release then.

MPI-AE · ‎02-14-2019

@BPryBut you wrote that 8.1 isn't perfect yet so maybe I should wait until September 2019 to install 8.1 ? Futhermore, if 8.0 hits EOL on October 2019, I can save myself the effort to upgrade to 8.0.15, since I have to upgrade to 8.1 anyhow.

MPI-AE · ‎02-14-2019

@BPryWhich version do you run on your 3020s?

MPI-AE · ‎02-14-2019

@BPryWhich version do you run on your 3020 pair? Can you tell me an approx. date when 8.1 will be recommended? I don't run special features, Global Protect, URL Filter, the normal stuff I would say.

MPI-AE · ‎02-14-2019

Hey guys, Can someone tell me how exactly the Palo Alto firewalls, especially the PA-3020, process traffic? Is that done via Software/CPU or via hardware? I mean, if it's done via Software, the palo alto firewalls are just workstations with a linux os and network cards, aren't they? Sometimes I observe that the latency in the network rises. That is when large files are copied to the fileserver with 1Gbit/s. (That's the speed of the interfaces of the Palo Alto, full speed so to say). That traffic is routed over the pa-3020 (8.0.7) since there are different vlans. (client in another vlan than the fileserver). Besides, the management and data plane cpu utilization rise, too.

MPI-AE · ‎02-14-2019

Hey guys, we need to renewal our licenses and I'm thinking if I should renew the wildfire subscription. The problem is that we are not allowed to upload data to the public cloud (because of data privacy reasons) So we actually don't really use wildfire fully. What do you think? Is it worth to do the renewal under that circumstances?

MPI-AE · ‎01-30-2019

Hey guys, When I want to do a video call with Signal messenger, I need to add two rules: Rule1: App: Signal Service: application default Rule2: App: STUN Service: any Signal accesses random destination ips on random ports. Skype and Google Hangouts need those rules: App: Skype, Google-Hangouts Service: application default App: rtp Service: application default App: rtcp Service: application default As a result I had to add those 3 rules for all 3 apps to work: App: rtp Service: application default App: rtcp Service: application default App: STUN Service: any Do you experience the same?

MPI-AE · ‎01-30-2019

Hey guys, There are two 3020s in HA that run 8.0.7 I'm wondering if I can upgrade to a new version in 8.1.X train? Or should I stay at 8.0.7? Can someone share their experiences? Thank you.

MPI-AE · ‎01-11-2019

Hey Luke, that works, thank you! The only thing I had to adjust was the Application in the policy rule: App any and select service tcp 11111.

MPI-AE · ‎01-11-2019

Hey all, there is a ssh server in an internal network. I want to access that server from public, but with source port for example 11111. The server listens on normal ssh port 22. So I would like the firewall to do a port translation from 11111 to 22. Is that possible?

MPI-AE · ‎12-10-2018

@BPryI'm still overwhelmed. There is that top egress interfaces report that shows all interfaces and the bytes which were transmitted. How can I create a custom report for that, but not for one day, but for a whole week? To see the weekly amount of bytes of my interfaces.

MPI-AE · ‎12-06-2018

Thank you, so I don't need to extend my network 😉 Would be really useless though, you would have to extend your network regulary..

MPI-AE · ‎12-04-2018

@BPryWhat would be a requirement for the firewall to reassign an expired ip address to another/new client?

MPI-AE · ‎12-03-2018

@BPry But what exactly does that mean? currently, there are 96% used ip addresses. Does the firewall reassign expired ip addresses to anonther host before 100% are used?

MPI-AE · ‎11-30-2018

Hi all, there is a dhcp server for a network with a lease time of 14 days. When I open the allocation, there are a lot of expired dhcp leases. Doesn't the firewall automatically delete them?

MPI-AE · ‎11-20-2018

@BPry Would like to ask an additional thing: I want to search for all google apps in the monitor. Is there an operator for that? I tried: ( app contains google ) but that doesn't work.

MPI-AE · ‎11-09-2018

Hi, does the HA pair inherit that configuration change?

Date Registered	‎11-01-2016 01:17 AM
Date Last Visited	‎08-06-2019 11:03 AM
Total Messages Posted	143
Total Likes Received	7

Online Status	Offline
Date Last Visited	‎08-06-2019 11:03 AM

Strata

Prisma

Cortex

About MPI-AE