About bmorris1

bmorris1 · ‎11-30-2017

Hi @Shye80 You've got two options. Connect to the device using a console cable and remove the permitted IP configuration on the CLI. Connect up a client to the network and give it Panorama's IP address. Pretty risky this one though as you'd have to shut down Panorama or change it's IP which could impact your PAN deployment if you're logging and making changes etc on it. hope this helps, Ben

bmorris1 · ‎11-22-2017

Hi @OMatlock, I wonder if you have asynchronus routing caused by the switch 1. Can you try running a packet capture on the interface circled to see if the return traffic is coming back to the wrong interface? As I understand it you want the traffic to be coming back to ethernet1/3 on the PA-200 #2. If this is the issue then I would think you can resolve it with a NAT rule. hope this helps, Ben

bmorris1 · ‎11-22-2017

Hi @rjdahav163 My advice would be to take a look at the certificate hierarchy in Windows, are you seeing the full chain there that is expected when you open up the file? Example here, taken from the live community website: hope this helps, Ben

bmorris1 · ‎11-16-2017

@MickBall Yes it is in the GP app config, in the GP portal @NIRAVK9 I'm not sure on this one as I have never done it myself as I've never needed portal redundancy due the above cookie authentication. A solution may be to allow users to change the portal address and use different portals but the same gateways. GP should connect to the gateway that responds first.

bmorris1 · ‎11-15-2017

Hi @NIRAVK9, You would need a script to automatically modify the DNS record if the 1st site was to go down. You can poll the firewall to see if it is up/interface up using SNMP. Though you can set the portal cookie to stay for a week on clients so they only need to connect to the portal once every 5-7 days, this is usually enough time to get the portal up and running again if it goes down (RMA/case with ISP etc.). Alternatively you could look at GP in the cloud? https://www.paloaltonetworks.com/products/innovations/globalprotect-cloud-service hope this helps, Ben

bmorris1 · ‎11-08-2017

@MickBall you can override the default inter-zone deny rule (panos 6.1 and above) and set the log action to get the information from a 'deny all' rule. Currently your rule would deny intra-zone traffic as well.

bmorris1 · ‎10-30-2017

The session browser will show you the size of the session in bytes but it won't tell you how many bytes downloaded/uploaded, just in total. Once you kill the session and a log entry is generated in the traffic log, you can see bytes sent and bytes receieved in the 'details' section. Click the spyglass icon on the left hand side of the log to open up the detailed log view.

bmorris1 · ‎10-30-2017

Hi Radmin_85, Yes you can do this in the session browser located in the monitor tab and clicking the 'x' on the desired session. Or you can do it via the CLI by using the commmand: > clear session id xxxx x being the number of the session of course. You can use the command: > show session all to show a list of sessions on the device currently (up to 1024). hope this helps, Ben

bmorris1 · ‎10-30-2017

Hi junior_r, SSO will try to authenticate against both portal and gateway. So you'll either need to keep SSO on and live with the error message of the 1st auth against the gateway or disable it and enter the username and password on the login screen and GP after login. https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-Single-Sign-on-SSO-for-GlobalProtect/ta-p/112186 Personally I think the first option is the best as it is more seamless to users, they will log in on the login window with their username and password and then be prompted for the OTP by GP, they won't see that it has failed the 1st gateway authentication.

bmorris1 · ‎10-29-2017

Hi Junior_r, Are you using the same auth profile for both portal and gateway? I suspect what is happening is that you are trying to do SSO/Authentication twice with the same OTP, so authenticating once against the portal and again against the gateway with the same OTP. Most OTP operators make it so that you can't use the same OTP twice, so your authentication is failing on the second go. The way to get around this is to use two different authentication profiles, one for the portal and one for the gateway. The portal authentication will be set as your standard login with username and password and your gateway config will have the auth profile set to use the OTP login. This way you will auth once to the portal with username/password, then you'll need to authenticate again against the gateway and thus be prompted for your OTP code. You can combine this with cookie authentication for the portal so after a first successful login to the portal this authentication gets cached and only a single authetncation using the OTP is required. Hope this helps, Ben

bmorris1 · ‎10-18-2017

Hi awawa100, NAT takes place separately to App-ID (app override). You can find full details in the packet flow document here: https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081 hope this helps, Ben

bmorris1 · ‎10-12-2017

Hi Larry, It might be easier to use User-ID for this purpose. Have a 'webinar' user group and have a single rule for them instead of constantly modifying a security rules, you just need to add the people that need access to webinars into the webinar user group on your AD for them to have access. If they're not in the user group then they can match the default-deny rule. You could combine this with a new feature in Windows Server 2016 which is 'timed group membership'. hope this helps, Ben

bmorris1 · ‎10-12-2017

Also make sure to restart the User-ID service once you've implemented the ignore user list so it picks up and reads the list.

bmorris1 · ‎10-10-2017

Hi Ronnie, I would suspect you need to speak to BT as it looks like their end causing the issue. If you leave the IP address as 'none' do the devices connect? If they do check then runtime info and see if you've been provisioned your 'static' IP. hope this helps, Ben

bmorris1 · ‎09-22-2017

Hi Miki, Do you mean configuration information? You can enter configure mode then take a look at the profiles > configure # show profiles virus 'av profile name' hope this helps, Ben

bmorris1 · ‎09-22-2017

Hi Mark, I've looked at your PCAPs and detailed log view. The traffic is being sourced from VLAN 403 but return traffic (the SYN ACK) is being sent down to VLAN 400 (so down a different sub interface) You can see this by checking the 802.1Q tag in the PCAP. I suspect that this is being dropped by a device between the firewall and the server or the server due to this. Its worth checking your policy based forwarding rule if you have any and/or routing. hope this helps, Ben

bmorris1 · ‎09-18-2017

Hi vbe, In order to achieve this, what you'll need to do is created a 'not equal to' type of HIP object/profile and create a seperate deny rule for this. On this new rule create a log forwarding profile and have it email you when this rule it matched. hope this helps, Ben

bmorris1 · ‎09-18-2017

Hi Myasin, What might be a solution for you would be to created a loopback interface and assign it an IP. You can then add all your globalprotect (GP) configuration to this loopback. Then with a destination NAT rule you can say that traffic for your 2nd public IP will be destination NAT to your loopback for access to the GP portal/gateway. The device will proxy ARP for the 2nd public IP configurated on the NAT rule. These links to the documentation can explain more proxy ARP: https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/networking/nat-policy-rules#_60332 GP on loopback: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Global-Protect-Gateway-on-Loopback-Interface/ta-p/56866 hope this helps, Ben

bmorris1 · ‎08-29-2017

Hi Anthony, According to the documentation, the Panorama downloads the update and then notifies the appliances that an update is available. The local appliance then connects to Panorama to download the update. 'When deploying updates, Panorama notifies the devices (firewalls, Log Collectors, and WildFire) that updates are available and the devices then retrieve the update packages from Panorama. By default, devices retrieve updates over the management (MGT) interface on Panorama.' So if you've got a schedule assigned to all 200 to download the update from Panorama at the same time, then all 200 will download it at the same time. hope this helps, Ben

bmorris1 · ‎08-23-2017

Hi Esutedy, In this situation it may be better to remove the exchange servers from user-id monitoring but I don't know enough about how your user-id and environment set-up to see if that would be the best solution. As always, I find the best way of doing user-id is using GlobalProtect. Not for the VPN side of it but for internal host detection as this will always identify the correct user and authenticated to the internal gateway on the firewall. hope this helps, Ben

bmorris1 · ‎07-24-2017

Maybe not crazy, but defintiely the nicest, Hyde Park in London.

bmorris1 · ‎07-24-2017

Hi Farzana, Do your passwords contain any letters not used in the english alphabet such as: ú or ﭫ If you do then I would create passwords that contain only english alphabet letters as I think this may be causing your issue. Try changing your keyboard to English (UK) or English (US).

bmorris1 · ‎07-24-2017

Not sure how this relates to Palo Alto Networks devices, but sure I'll try to help regardless... If you connect to your network using an ethernet cable do you get the same problems? This will help in diagnosing if the problem is due to the wireless RF environment or not. If everything is ok on the cable then maybe look into the RF around your network using a specturm analysis and make sure you're using 5GHz not 2.4GHz. You could have a microwave or other interfering device causing your problems.

bmorris1 · ‎06-28-2017

Hi ghafari47057, It may be worth increasing the timeout value to 8-9 hours (a full working day) to try and prevent this issue from occuring. It could be that the user times out. Additionally unless you have a genuine use case for WMI probing to be enabled, I would disable it as it a failed WMI probe will cause the user mapping to be removed. This could also be a cause of your issue. hope this helps, Ben

bmorris1 · ‎06-08-2017

Hi Jerm, Yes you can do this with a file blocking profile. First you will need to create a file blocking profile which can be done in the Objects tab then select file blocking on the left hand side menu. Click add at the bottom to create a new profile then add in a rule to have the action 'alert' on all applications, file types etc. Give the profile a name and click ok. Create file blocking profile Go to your security policies under the policies tab and select the policy in which your traffic is hitting. In the actions tab of the selected policy, you can choose your new file blocking profile from the drop down if you select profiles. Add file blocking to security policy Click commit in the top right hand corner to push the changes down to the data plane and make them active. Let me know if this helps, Ben

bmorris1 · ‎06-08-2017

Hi Javith, Seeing as you have a zombie process in that output, it might be worth giving the management server a restart. 32294 20 0 0 0 0 Z 0.0 0.0 0:00.03 mgmtsrvr <defunct> > debug software restart process management-server let us know if this helps, Ben

bmorris1 · ‎05-05-2017

Hi, Do you mind showing your 'internet' address object's subnet mask? I suspect you've added this in as a network and therefore the firewall has a pool of IPs to use for source NAT. Ben

bmorris1 · ‎05-05-2017

Hi, You could remove all the config on the gui/cli and save the config. On the next one you ship out to site you just load in the config with items removed. I will say though, the bootstrapping feature is available for situations like yours, do take a look: https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/management-features/bootstrapping-firewalls-for-rapid-deployment hope this helps, Ben

bmorris1 · ‎04-26-2017

Hi Laurent, How is the end user fixing it? I'm thinking the issue could be a possible timeout issue on the user mapping, so if the end user has to re-authenticate then that would fix it. You could try increasing the timeout value to keep the users logged in and/or enabling server session read. Additionally you could also try enabling WMI probes but be careful with these as a failed probe will remove the user mapping, you need to make sure client computers are set to respond ok to these. The best user-id method is to have GlobalProtect set up for internal host detection and internal gateways. hope this helps, Ben

bmorris1 · ‎04-25-2017

Whilst you can use the migration tool to copy over the VPNs, I have found that often Cisco ASA devices use poor encryption methods by default and these are not changed. Also they are usually set in a policy-based VPN mode. Depending on how you want to play it, you may be better off starting from scratch and creating proper route-based VPNs on both sides of the tunnel and forgoing the need for long lists of proxy IDs. In my experience I have found it more trouble than what is is worth when using the migration tool to move over VPNs from ASAs and have always re-created them manually using lovely excel spreadsheets and concatenate forumula to produce the CLI configuration commands for me. Alternatively if you're a decent scripter you could use the API to make it even easier. hope this helps, Ben

Date Registered	‎07-28-2014 06:19 AM
Date Last Visited	‎04-11-2019 06:45 AM
Total Messages Posted	227
Total Likes Received	59

Online Status	Offline
Date Last Visited	‎04-11-2019 06:45 AM

Strata

Prisma

Cortex

About bmorris1