About Hwinter

Hwinter · ‎11-03-2017

I even got support involved for this issue, but at the end, like you... reboot the box, it started working.

Hwinter · ‎07-26-2017

Ha! That was easy! Thanks a lot. I've had this issue for months, but I just kept postponing it. PS: since I'm using the PA as DNS Proxy, I created a static entry for the name I created (pa.local) and as used that for CN and Hostname. Works like a charm!

Hwinter · ‎07-26-2017

I'm trying to get rid of the warning when I open the PA GUI from Chrome. I'm getting the following warning: This server could not prove that it is 192.168.10.4 ; its security certificate is from [missing_subjectAltName] First of all, IE is fine, no errors! I have generated the certificate and imported it as my trusted Root CA: I have also created a certificate profile (called it GUI) under "Device -> Certificate Managemenet- > SSL/TLS Service Profile", which used the ceriticate above. Then I went to " Device -> Setup -> M anagemenet -> SSL/TLS Service Profile" and chose "GUI" (the cerifcate profile above). However, Google Chrome does not like it. Off course if I ignore the warning, it works no problem. Any ideas what I'm missing, or why google doesn't like me?! Thanks!

Hwinter · ‎05-11-2017

No, I have a few files from weeks ago. The last one I have, I did manually just for testing: I thought it might have stopped working when I upgraded to 8.0. However, after checking the logs, that is not the case: So I got uploads to wildfire after 24/04 so it must be related to something else I've might have changed in the FW.

Hwinter · ‎05-10-2017

Also, I'm getting the updates:

Hwinter · ‎05-10-2017

Where did you find that reference? I couldn't find anything! Anyhow, I original had it via management interface, then I changed it and used the the other interface via device -> setup -> Service Route Coniguration. But same result... changed it back to Management (default). After your sugestion, I added a universal policy at the top to permit any any application paloalto-wildfire-cloud, but still no luck. Still getting errors. admin@PA-VM> show wildfire statistics Packet based counters: DP Files upload initiated: 0 DP Files upload succeeded: 0 Counters for file cancellation: Counters for file forwarding: file type: apk file type: pdf file type: email-link file type: ms-office file type: pe file type: flash file type: jar file type: MacOSX file type: unknown file type: pdns Error counters: FWD_ERR_CONN_FAIL_PUB 44 FWD_ERR_GET_REPORT_FAIL_PUB 4 Reset counters: DP receiver reset cnt: 3 File cache reset cnt: 1 Public Cloud: Service connection reset cnt: 1 Log cache reset cnt: 1 Report cache reset cnt: 1 Private Cloud: Resource meters: data_buf_meter 0% msg_buf_meter 0% ctrl_msg_buf_meter 0% wr_debug_log_buf_meter 0% File forwarding queues: priority: 1, size: 0 (PUB), 0 (PRIV) priority: 2, size: 0 (PUB), 0 (PRIV) priority: 3, size: 0 (PUB), 0 (PRIV) priority: 4, size: 0 (PUB), 0 (PRIV) I actually see the traffic to wildfire\, and it is allowed.

Hwinter · ‎05-10-2017

Hi there, Wildfire is not submiting files. I have the simplest configuration possible, and I'm using the test file ( https://wildfire.paloaltonetworks.com/publicapi/test/pe ). However, nothing is getting to the portal, or logs for that matter. I'm running VM-100 on a ESXi server, 8G RAM, 4 vCores, PAN OS 8.2. The only thing I have noticed is on the CLI I can see two errors going up: FWD_ERR_CONN_FAIL_PUB 18 FWD_ERR_GET_REPORT_FAIL_PUB 4 Any ideas on how I can fix this? Here is what I get from the CLI: admin@PA-VM> show wildfire statistics Packet based counters: DP Files upload initiated: 0 DP Files upload succeeded: 0 Counters for file cancellation: Counters for file forwarding: file type: apk file type: pdf file type: email-link file type: ms-office file type: pe file type: flash file type: jar file type: MacOSX file type: unknown file type: pdns Error counters: FWD_ERR_CONN_FAIL_PUB 18 FWD_ERR_GET_REPORT_FAIL_PUB 4 Reset counters: DP receiver reset cnt: 3 File cache reset cnt: 1 Public Cloud: Service connection reset cnt: 1 Log cache reset cnt: 1 Report cache reset cnt: 1 Private Cloud: Resource meters: data_buf_meter 0% msg_buf_meter 0% ctrl_msg_buf_meter 0% wr_debug_log_buf_meter 0% File forwarding queues: priority: 1, size: 0 (PUB), 0 (PRIV) priority: 2, size: 0 (PUB), 0 (PRIV) priority: 3, size: 0 (PUB), 0 (PRIV) priority: 4, size: 0 (PUB), 0 (PRIV) admin@PA-VM> show wildfire status Connection info: Signature verification: enable Server selection: enable File cache: enable WildFire Public Cloud: Server address: wildfire.paloaltonetworks.com Status: Idle Best server: panos.wildfire.paloaltonetworks.com Device registered: yes Through a proxy: no Valid wildfire license: yes Service route IP address: 192.168.10.4 Best server update interval: 504 minutes. WildFire Private Cloud: Server address: Status: Disabled due to configuration Best server: Device registered: no Through a proxy: no Valid wildfire license: yes Service route IP address: File size limit info: pe 5 MB apk 10 MB pdf 200 KB ms-office 500 KB jar 1 MB flash 5 MB MacOSX 1 MB Forwarding info: file idle time out (second): 90 total concurrent files: 0 Public Cloud: total file fwded : 0 total file failed: 0 total file skipped: 0 total cloud queries: 0 total cloud queries failed: 0 file forwarded in last minute: 0 concurrent files: 0 Private Cloud: total file fwded : 0 total file failed: 0 total file skipped: 0 total cloud queries: 0 total cloud queries failed: 0 file forwarded in last minute: 0 concurrent files: 0 admin@PA-VM>

Hwinter · ‎05-01-2017

In my case the application was not identified when using the Facebook App (shows just SSL). Interesting enough, when using Chrome one the iPhone, it identifies it as Facebook-Video. So I had to create a rule to exempt any Social-Network category for iPhones, which isn't ideal, but it was the lowest denominator. Otherwise I have to exclude iPhone from decryption all together or at least iPhones SSL.

Hwinter · ‎04-21-2017

For what is worth, I went to Device tab > Response Pages screen, I unticked the "Enable SSL Opt-out Page" option. After that, it looks like it is working. Response Page So I believe the page was sent to the app and it was timing out as there would beno reply. Not exacly what I was execting, but that is the only explanation on my mind. UPATE: problem still presists. VIdeo must have been cached when I was testing it.

Hwinter · ‎04-21-2017

When opening iOS Facebook app I''m unable to play a movie... however, from the same device if I login to facbook via browser I can play the video. I'm trying to find out why the iOS App is getting blocked, as my policies clearly allow it. Rule iPhones: Iphone Rule allowing all traffic Log when using Facebook via Chrome Log when using Facebook via iOS App Decryption Policy I'm not sure what I'm missing here. I'm trying to understand what is causing the traffic to be blocked. The only thing I see different is the fact that when the user is using the App PA shows the traffic as SSL and when using the Chrome PA shows it as facebook-Video. However, both should be allowed. Any ideas? I'm running VM-100 on 7.1.9. Thanks!

Hwinter · ‎04-07-2017

Actually, I do have all the info in the config file... unfortunately I don't know how to use it though: client dev tun proto udp remote vpn.vpn.com 1194 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server cipher AES-256-CBC comp-lzo no route-delay 5 verb 3 explicit-exit-notify 5 <ca> -----BEGIN CERTIFICATE----- MIIGVDCCBDygAwIBAgIJAIzYQ+/kXyADMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNV . . -----END CERTIFICATE----- </ca> <cert> -----BEGIN CERTIFICATE----- MIIGnDCCBISgAwIBAgICRaAwDQYJKoZIhvcNAQEFBQAweTELMAkGA1UEBhMCSVQx . . -----END CERTIFICATE----- </cert> <key> -----BEGIN RSA PRIVATE KEY----- MIIJKAIBAAKCAgEA4hKsIsb3x4LJlYL35XivJr8FE/ak47OJbmZRfXB0l5jkLqc/ . . . -----END RSA PRIVATE KEY----- </key> key-direction 1 <tls-auth> # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 7bb7a23a0f5f28d01e792df68f1764ab . . . -----END OpenVPN Static key V1----- </tls-auth> I removed the actual key, but as you can see, it is actually there on the .ovpn file.

Hwinter · ‎04-06-2017

Yes, but the client is using an openVPN config file, which should have all that info (i.e. the .ovpn file). I can access that file... but I'm not sure what I would be looking for.

Hwinter · ‎04-05-2017

Is it possible to decrypt openVPN with SSL Forward Proxy? I'm pretty sure the asnwer is no, but I figured I would ask. My problem is that I have a Ubuntu Server running openVPN client behind a VM-100. I would like to continue to use openVPN, but I would like to intercept it, apply some policy on the decrypted traffic and re-encrypt. The server I basically uses: sudo openvpn --config VPN_UDP-443.ovpn Has anyone done something similar? One option (unfortunately non existent) would be implementing a opnVPN client direclty on the VM-100 and have my server just use that as the gateway... but that would be too easy! 🙂 Thanks!

Hwinter · ‎04-02-2017

Turns out iCloud and gmail are using non-standard ports. I had to change the policy (Policies -> Security) from: - Application: application_default .to. - Application: any I suppose I could have tweeked the application_default to allow the gmail and icloud custom ports too. That will be my next step. However, it is working with any. It looks like there was a change on 7.1: https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Policy-behavior-change-application-default/ta-p/75664

Hwinter · ‎04-02-2017

I have a weird problem. I installed a VM100 connected via PPPoE to the ISP, standard NAT, DHCP configured on the LAN side. Issue: unable to receive/send emails from iPhone from SOME providers using inherid IOS app: Corporate email: working via IOS email app iCloud email: not working via IOS email app Gmail email: not working via IOS email app, but works from "Inbox" app (on the same iPhone!!) PS: Web browsing is fine and even my SIP Trunk is working. Any ideas? I have set MTU to 1480 on the WAN interface. which was my first thought... Thanks!

Member Since	‎03-30-2017 03:56 AM
Date Last Visited	‎06-28-2018 05:29 AM
Posts	19
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎06-28-2018 05:29 AM

About Hwinter

Re: No incendios forestales las presentaciones (errores FWD_ERR_CONN_FAIL_PUB)

Re: SSL/TLS vs. Chrome [missing_subjectAltName]

SSL/TLS vs. Chrome [missing_subjectAltName]

Re: No wildfire submissions (FWD_ERR_CONN_FAIL_PUB errors)

Re: No wildfire submissions (FWD_ERR_CONN_FAIL_PUB errors)

Type=Deny while Action=Allow

Re: VM-100 Virtual Wire doesn't show any sessions

Re: SSL/TLS vs. Chrome [missing_subjectAltName]

Re: Type=Deny while Action=Allow

Re: No incendios forestales las presentaciones (errores FWD_ERR_CONN_FAIL_PUB)

Re: SSL/TLS vs. Chrome [missing_subjectAltName]

SSL/TLS vs. Chrome [missing_subjectAltName]

Re: No wildfire submissions (FWD_ERR_CONN_FAIL_PUB errors)

Re: No wildfire submissions (FWD_ERR_CONN_FAIL_PUB errors)

Re: No wildfire submissions (FWD_ERR_CONN_FAIL_PUB errors)

No wildfire submissions (FWD_ERR_CONN_FAIL_PUB errors)

Re: Type=Deny while Action=Allow

Re: Type=Deny while Action=Allow

Type=Deny while Action=Allow

Re: Decrypting OPENVPN?

Re: Decrypting OPENVPN?

Decrypting OPENVPN?

Re: Some emails not working on iPhone behind PA

Some emails not working on iPhone behind PA

Network Security

Cloud Security

Security Operations

About Hwinter