About Gun-Slinger

Gun-Slinger · ‎12-18-2019

Has anyone found a way to see a hosts generated connections per second? In other words we want to hone in on a specific host and see the CPS being generated in either a live or post event. All I have found so far is global cps (show session info) Thank you

Gun-Slinger · ‎12-18-2019

Thanks I have a TAC case opened and will update this thread once I have something.

Gun-Slinger · ‎12-13-2019

Thank you @BPry This is running on M600's with 32G of RAM

Gun-Slinger · ‎12-13-2019

We have completed the installation and integration of the Cisco ACI plug-in to our panorama environment. We have found that on 2 of the 3 APIC clusters we are tied into for 3 different fabrics we get the following error on synchronization. 'State of ACI fabric is currently changing, unable to retrieve tags. Will try again next iteration." My only thought is a resource issue? The 1 fabric that is successful is considerably smaller the the 2 that are failing. Anyone else run into this and what was the resolution? Thanks

Gun-Slinger · ‎10-30-2019

Correct that is it. The minor code version (aka the .11 of 8.1.11 for example) builds off the .0 code version which is why you just need to download that. As always (best practice) ensure you update your dynamic updates for all you app/content/threat services on the cluster before upgrading. Cheers!

Gun-Slinger · ‎10-30-2019

Situation: NFS Client src:828 dst: 2049 --> PAN 7050 HA Cluster --> NFS Server (NFS Session is up and connected without issue) Palo alto cluster fail-over occurs (upgrade/issue - doesn't matter) NFS Client src:828 dst:2049 -->PAN (Session is marked as "undecided" and dropping the syn packets) The timer continues to reset on the session on PAN since the client continues to send syn packets which are dropped. This keeps the session opened until the session is manually cleared by engineers on the PAN cluster. Is anyone else experiencing this? We haven't seen this occur on any other apps except NFS and seemed to start around 8.1.7.

Gun-Slinger · ‎10-30-2019

Like with any major code version upgrades you will need to DOWNLOAD the X.X.0 of the code you are upgrading to. In this case you will download the 8.1.0 code (do not need to install), then download AND INSTALL the 8.1.X version you want to go to.

Gun-Slinger · ‎07-02-2019

I am on Expedition version 1.1.26 I cannot get the Serach File function in M.Learning under a Panorama device to work. I have verified the permissions for the directory and the directory mapping. This had worked in earlier versions but does not appear to be working now.

Gun-Slinger · ‎05-14-2019

sigh*.... looks to be a chrome browser issue. Tried it with FIreFox and it is there. Thank you

Gun-Slinger · ‎05-14-2019

We are running 8.1.7 and discovered the Botnet report is missing from the monitor tab on the gateways. Does anyone know where this report went? PAN-OS 7.1.X PAN-OS 8.1.7

Gun-Slinger · ‎05-09-2019

Does anyone know if FR #5844 was approved for a future release? We could really use this capability for our PRTG monitoring. Thank you

Gun-Slinger · ‎04-08-2019

We presently have x2 PA-7050's with x2 20GQXM NPC's per chassis installed in each. Using split uplinks between the 2 cards in each chassis on the 40G interfaces with session distribution enabled for "session-load". We are still seeing a MAX of 20G throughput. I have a TAC case open but presently seeing the opposite of the claim on throughput with additional cards.

Gun-Slinger · ‎01-29-2019

Can anyone point me to the area in expedition that contains the lldp server profiles? I continue to get an a error with the lldp profile and can't find where this would be setup in expedition GUI. Thank you

Gun-Slinger · ‎01-11-2019

Anyone run into this issue? It raised a "Critical" log but appears to have occurred during a validate. Having issues finding any references on this alert discription. Base ID manager is reset - System Log

Gun-Slinger · ‎10-10-2018

@AR00473455 It is my understanding that the limitations are 500 for any of the rule sets according to Checkpoint. NAT and Security are treated as 2 SEPERATE groups. For example if you have 1000 security rules and 200 NATs; you will need 2 seperate security rules files of 500 each and 1 NAT rule file. This being said I have yet to get the zip file proceedure to work and actually had to export out my security policies in seperate files as perscribed, but then manually merge the files into 1 .json file using notepad++. Won't lie, it would be great if the zip proceedure worked

Gun-Slinger · ‎10-09-2018

I have confirmed there is a limitation on the Checkpoints of 500 rules when exporting through the API. With our environment, I had to break it up into groups of 200 due to time out and RAM issues. I have yet to get the zip file with the orders.txt file to work as perscribed above. I am on the latest version of the expedition tool and when I upload it, it will transistion from initilizing to reading config files, but stalls from there. Anyone else ran into issues like this or did something change with the new version?

Gun-Slinger · ‎10-08-2018

Anyone else getting the php-radius error on the install of the HF? This is deployed in an esx environment and works fine but noticed this error on the update install. expedition@Expedition:~$ sudo dpkg -i expedition_1.0.106.all.deb [sudo] password for expedition: (Reading database ... 209795 files and directories currently installed.) Preparing to unpack expedition_1.0.106.all.deb ... Unpacking expedition-beta (1.0.106) over (1.0.84) ... dpkg: dependency problems prevent configuration of expedition-beta: expedition-beta depends on php-radius; however: Package php-radius is not installed. dpkg: error processing package expedition-beta (--install): dependency problems - leaving unconfigured Errors were encountered while processing: expedition-beta expedition@Expedition:~$ ls -l total 39140 -rw-rw-r-- 1 expedition expedition 40078732 Oct 8 10:26 expedition_1.0.106.all.deb

Gun-Slinger · ‎09-28-2018

Where do you find the HF's for download?

Gun-Slinger · ‎09-19-2018

RESOLVED: The issue was with the .json files and piping the output to a seperate file. The commands above are correct, however the output files were adding the following "Username" at the TOP of the file: Username: { "uid" : "1cxxxx6-3bff-4xxxxxx8-7xxxxxxxxx", "name" : "blah-blah", "rulebase" : [ ], "total" : 111 } This appears to be an issue/bug within the R80.10 code when doing outputs to a file as this "Username" is coming from the prompt before launching the api call. Once this "Username:" line was removed from the json file, the import worked as expected.

Gun-Slinger · ‎09-19-2018

Completed all the config associated with that link How to Upload conf files with no luck. I have attempted to complete this instructions in this thread EXACTLY as perscribed with the most progress being the Import progress status flapping between Initializing and Reading Config.... of which it continues this back and forth for quite sometime. Next I attempted this option outlined in this thread Issue Getting Checkpoint R80 config to load No luck there. I only have 162 rules, no NAT rules, but a bunch of objects since this is an SMS with multiple policies. Any ideas?

Gun-Slinger · ‎09-18-2018

I ran the command in expert mode and the file generated correctly, however I have tried to import into the Expedition tool and each time it states There are not Objects defined. Import Failed! THis is being completed on a SMS R80.10 VM

Gun-Slinger · ‎09-18-2018

This isn't working, keep getting the following error: Running: SMS01-CKPT> mgmt_cli show access-rulebase name "Test-Policy Security" details-level "full" use-object-dictionary true --format json > Test-Policy.json Keep getting: MGMT9000 { "code" : "generic_err_invalid_parameter_name", "message" : "Unrecognized parameter [>]"

Gun-Slinger · ‎05-31-2018

Hey @vsys_remo Panorama will not let you change it from the default vsys1 (vsys1) in the webui. The local appliance webui has the field grayed out not allowing any changes. This is being done on a cluster managed by panorama that has already gone through the converison from s single-vsys to a multi-vsys and the vsys1 reamins unassigned... unless I can find a way to apply a name to it.

Gun-Slinger · ‎05-30-2018

@vsys_remo The option is grayed out in the GUI and see no options for the change in the CLI. I have pinged my SE for any hints of an FR for this since in a multi-vsys environment, the inability to apply a name to vsys1 makes it challenging to really classify the vsys.

Gun-Slinger · ‎05-25-2018

Hey @josggf Mgmt interface has to be used as it is the only interface that supports the mgmt. access to the box. The other eth interfaces can be used for other functiions as outlined: -Ping -Device Mgmt. and Device log collection -Collector group communication -Device Deployment As for eth2 for the backup... I am not following as the panorama platform does not support a backup link functionality. The only option I am tracking with the backup link would be for icmp path monitoring and that is it. Bottom line is you will/can use the mgmt. interface for admin access and any of the spare interfaces for the other functions except a backup interface. Depending on if these are M100's or M500's, I would reccemmend with the M500 to use eth1/4 and eth1/5 since those are 10G. Hope this helps.

Gun-Slinger · ‎05-24-2018

Does anyone know if there is a way to change the name of vsys1? This would be mainly for the identifcation of the vsys in panorama. My testing says no, but figured I would check the community. *Reason: we want to change a single vsys deployment to a multi-vsys and would like to continue use of vsys1 but with the name change to identify the purpose of this vsys. Thank you

Gun-Slinger · ‎02-05-2018

Update on this: So the annotation field leverages the "Notes" field of the guest in vsphere. So if you add a notation in the notes field (example a_host), the PAN will pick it up on the next refresh and add that as an actual filter to choose from for the dynamic address group. The piece I am still missing is can a guest have multiple annotations in the notes field and the PAN pick it up as seperate filters or annotations? If "Yes", what is the syntax? I have tried, seperate lines, ";", ",", and spaces with no success.

Gun-Slinger · ‎02-05-2018

Has anyone noticed in the MT the issue where when you go into the objects tab and filter on invalid or duplicate values. If you check the box next to the service/object(s) and click the "-" button to delete your selections.... it dosn't. Is this a bug that has been brought up? Thank you

Gun-Slinger · ‎01-29-2018

Does anyone know more on the use of the "annotation" field for use in a dynamic address group from a vm information source? Can the notes or tags field in the summary tab in vCenter be used to apply custom annotations? Any assistance on the syntax would be great since PAN dosn't seem to provide much on this that I could find. The goal is to be able to apply multiple custom annotations in order to apply the proper dynamic address group to the VM and a VM could belong to multiple dynamic address groups.

Gun-Slinger · ‎01-29-2018

What was the issue?

Date Registered	‎08-06-2014 08:13 AM
Date Last Visited	2 weeks ago
Total Messages Posted	101
Total Likes Received	6

Online Status	Offline
Date Last Visited	2 weeks ago

Enterprise

Prisma

Cortex

About Gun-Slinger