This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
Accept
Reject

About Gun-Slinger

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Gun-Slinger
‎01-15-2023
since ‎08-06-2014
L4 Transporter
User Activity
User Profile
User Badges
Community Statistics
Member Since ‎08-06-2014 08:13 AM
Date Last Visited ‎01-15-2023 07:59 PM
Posts 110
Total Likes Received 13

Re: Cert Delete and Created new devicecert

by in Next-Generation Firewall Discussions
‎09-09-2022 04:57 AM
1 Kudo
‎09-09-2022 04:57 AM
1 Kudo
We contacted TAC to get clarity on this issue and here is the answer received: This is a new feature in 10.1. The firewall certificate is valid for 3 Months. 2 Weeks prior to expiration, the firewall will:      -Create a new CSR and send this to panorama for signing      -Panorama will sign this CSR and return, signed cert, device CA cert, SNI to use for this new certificate      -Switches the connection to new Cert on the next connect ... View more

Cert Delete and Created new devicecert

by in Next-Generation Firewall Discussions
‎09-06-2022 06:09 AM
‎09-06-2022 06:09 AM
Anyone run into this? We discovered around 0400 AM (outside business hours so no admins online) the following logs generated. They appear system generated as if the device is regenerating a cert. Problem is, it doesn't match the dates on the device certificate that is normally generated under the device tab and PAN has zero documentation to tell us if this is normal behavior.   ... View more

Re: App-ID Windows-Remote-Managment showing as Web-Browsing

by in General Topics
‎05-25-2022 05:37 AM
1 Kudo
‎05-25-2022 05:37 AM
1 Kudo
Closing the loop on this issue. After working with TAC there is a known issue that is resolved in the 10.1.6 code released yesterday. The issue is when a policy uses L7 app-id with specific ports configured in the service port field as opposed to using "application-default". I took the workaround I used and changed it to application-default, removed the specific tcp ports listed, and removed web-browsing; leaving just windows-remote-management. This resolved the issue and will plan on an upgrade in the near future to 10.1.6. ... View more

Re: App-ID Windows-Remote-Managment showing as Web-Browsing

by in General Topics
‎05-24-2022 08:59 AM
1 Kudo
‎05-24-2022 08:59 AM
1 Kudo
I have opened a TAC case on this issue and will update the thread if/when I hear back. As a work around I added "web-browsing" to the policy but kept the specified service port tcp/5985 and 5986. This resolved the issue AND the traffic started passing/identifying as "Windows-Remote-Management". Web-browsing is an IMPLIED application for Windows-Remote-Management but this behavior looks to be that relationship has changed and now is DEPENDENT on Web-browsing. I did not find any app-updates that would have caused/mentioned this and panorama/applipidea doesn't flag web-browsing as dependent for Windows-Remote-Management. ... View more

App-ID Windows-Remote-Managment showing as Web-Browsing

by in General Topics
‎05-18-2022 07:56 AM
‎05-18-2022 07:56 AM
We recently upgraded to 10.1.5-h1 and it appears after the upgrade the Windows-Remote-Managment traffic over tcp5985 is now being identified as Web-browsing. This is causing that traffic to drop. We checked dynamic updates and presently leveraging the latest update released on 5/16. Seeing if this is a growing issue? ... View more
Register or Sign-in
Contact Me
Online Status
Offline
Date Last Visited
‎01-15-2023 07:59 PM
LEGAL NOTICES
RESOURCES
Copyright 2007 - 2023 - Palo Alto Networks