Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About Hwinter
About Hwinter
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
06-28-2018
19Posts
2Likes
1Solution
Jun 28, 2018Last Visited
User
Activity
User
Profile
Latest posts by Hwinter
| Subject | Views | Posted |
|---|---|---|
| 834 | 11-03-2017 06:16 PM | |
| 883 | 07-26-2017 06:29 PM | |
| 896 | 07-26-2017 02:28 PM | |
| 900 | 05-11-2017 04:01 AM | |
| 909 | 05-10-2017 05:17 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 04-21-2017 10:26 AM | |
| 1 | 03-30-2017 07:45 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 3 | |||
| 2 |
User Badges
Public Statistics
| Date Registered | 03-30-2017 03:56 AM |
| Date Last Visited | 06-28-2018 05:29 AM |
| Total Messages Posted | 19 |
| Total Likes Received | 2 |
11-03-2017
06:16 PM
I even got support involved for this issue, but at the end, like you... reboot the box, it started working.
... View more
07-26-2017
06:29 PM
Ha! That was easy! Thanks a lot. I've had this issue for months, but I just kept postponing it. PS: since I'm using the PA as DNS Proxy, I created a static entry for the name I created (pa.local) and as used that for CN and Hostname. Works like a charm!
... View more
07-26-2017
02:28 PM
I'm trying to get rid of the warning when I open the PA GUI from Chrome. I'm getting the following warning: This server could not prove that it is 192.168.10.4 ; its security certificate is from [missing_subjectAltName] First of all, IE is fine, no errors! I have generated the certificate and imported it as my trusted Root CA: I have also created a certificate profile (called it GUI) under "Device -> Certificate Managemenet- > SSL/TLS Service Profile", which used the ceriticate above. Then I went to " Device -> Setup -> M anagemenet -> SSL/TLS Service Profile" and chose "GUI" (the cerifcate profile above). However, Google Chrome does not like it. Off course if I ignore the warning, it works no problem. Any ideas what I'm missing, or why google doesn't like me?! Thanks!
... View more
05-11-2017
04:01 AM
No, I have a few files from weeks ago. The last one I have, I did manually just for testing: I thought it might have stopped working when I upgraded to 8.0. However, after checking the logs, that is not the case: So I got uploads to wildfire after 24/04 so it must be related to something else I've might have changed in the FW.
... View more
05-10-2017
05:17 PM
Also, I'm getting the updates:
... View more
05-10-2017
04:55 PM
Where did you find that reference? I couldn't find anything! Anyhow, I original had it via management interface, then I changed it and used the the other interface via device -> setup -> Service Route Coniguration. But same result... changed it back to Management (default). After your sugestion, I added a universal policy at the top to permit any any application paloalto-wildfire-cloud, but still no luck. Still getting errors. admin@PA-VM> show wildfire statistics Packet based counters: DP Files upload initiated: 0 DP Files upload succeeded: 0 Counters for file cancellation: Counters for file forwarding: file type: apk file type: pdf file type: email-link file type: ms-office file type: pe file type: flash file type: jar file type: MacOSX file type: unknown file type: pdns Error counters: FWD_ERR_CONN_FAIL_PUB 44 FWD_ERR_GET_REPORT_FAIL_PUB 4 Reset counters: DP receiver reset cnt: 3 File cache reset cnt: 1 Public Cloud: Service connection reset cnt: 1 Log cache reset cnt: 1 Report cache reset cnt: 1 Private Cloud: Resource meters: data_buf_meter 0% msg_buf_meter 0% ctrl_msg_buf_meter 0% wr_debug_log_buf_meter 0% File forwarding queues: priority: 1, size: 0 (PUB), 0 (PRIV) priority: 2, size: 0 (PUB), 0 (PRIV) priority: 3, size: 0 (PUB), 0 (PRIV) priority: 4, size: 0 (PUB), 0 (PRIV) I actually see the traffic to wildfire\, and it is allowed.
... View more
05-10-2017
02:28 PM
Hi there, Wildfire is not submiting files. I have the simplest configuration possible, and I'm using the test file ( https://wildfire.paloaltonetworks.com/publicapi/test/pe ). However, nothing is getting to the portal, or logs for that matter. I'm running VM-100 on a ESXi server, 8G RAM, 4 vCores, PAN OS 8.2. The only thing I have noticed is on the CLI I can see two errors going up: FWD_ERR_CONN_FAIL_PUB 18 FWD_ERR_GET_REPORT_FAIL_PUB 4 Any ideas on how I can fix this? Here is what I get from the CLI: admin@PA-VM> show wildfire statistics Packet based counters: DP Files upload initiated: 0 DP Files upload succeeded: 0 Counters for file cancellation: Counters for file forwarding: file type: apk file type: pdf file type: email-link file type: ms-office file type: pe file type: flash file type: jar file type: MacOSX file type: unknown file type: pdns Error counters: FWD_ERR_CONN_FAIL_PUB 18 FWD_ERR_GET_REPORT_FAIL_PUB 4 Reset counters: DP receiver reset cnt: 3 File cache reset cnt: 1 Public Cloud: Service connection reset cnt: 1 Log cache reset cnt: 1 Report cache reset cnt: 1 Private Cloud: Resource meters: data_buf_meter 0% msg_buf_meter 0% ctrl_msg_buf_meter 0% wr_debug_log_buf_meter 0% File forwarding queues: priority: 1, size: 0 (PUB), 0 (PRIV) priority: 2, size: 0 (PUB), 0 (PRIV) priority: 3, size: 0 (PUB), 0 (PRIV) priority: 4, size: 0 (PUB), 0 (PRIV) admin@PA-VM> show wildfire status Connection info: Signature verification: enable Server selection: enable File cache: enable WildFire Public Cloud: Server address: wildfire.paloaltonetworks.com Status: Idle Best server: panos.wildfire.paloaltonetworks.com Device registered: yes Through a proxy: no Valid wildfire license: yes Service route IP address: 192.168.10.4 Best server update interval: 504 minutes. WildFire Private Cloud: Server address: Status: Disabled due to configuration Best server: Device registered: no Through a proxy: no Valid wildfire license: yes Service route IP address: File size limit info: pe 5 MB apk 10 MB pdf 200 KB ms-office 500 KB jar 1 MB flash 5 MB MacOSX 1 MB Forwarding info: file idle time out (second): 90 total concurrent files: 0 Public Cloud: total file fwded : 0 total file failed: 0 total file skipped: 0 total cloud queries: 0 total cloud queries failed: 0 file forwarded in last minute: 0 concurrent files: 0 Private Cloud: total file fwded : 0 total file failed: 0 total file skipped: 0 total cloud queries: 0 total cloud queries failed: 0 file forwarded in last minute: 0 concurrent files: 0 admin@PA-VM>
... View more
05-01-2017
06:08 AM
In my case the application was not identified when using the Facebook App (shows just SSL). Interesting enough, when using Chrome one the iPhone, it identifies it as Facebook-Video. So I had to create a rule to exempt any Social-Network category for iPhones, which isn't ideal, but it was the lowest denominator. Otherwise I have to exclude iPhone from decryption all together or at least iPhones SSL.
... View more
04-21-2017
10:39 AM
For what is worth, I went to Device tab > Response Pages screen, I unticked the "Enable SSL Opt-out Page" option. After that, it looks like it is working. Response Page So I believe the page was sent to the app and it was timing out as there would beno reply. Not exacly what I was execting, but that is the only explanation on my mind. UPATE: problem still presists. VIdeo must have been cached when I was testing it.
... View more
04-21-2017
10:26 AM
1 Kudo
When opening iOS Facebook app I''m unable to play a movie... however, from the same device if I login to facbook via browser I can play the video. I'm trying to find out why the iOS App is getting blocked, as my policies clearly allow it. Rule iPhones: Iphone Rule allowing all traffic Log when using Facebook via Chrome Log when using Facebook via iOS App Decryption Policy I'm not sure what I'm missing here. I'm trying to understand what is causing the traffic to be blocked. The only thing I see different is the fact that when the user is using the App PA shows the traffic as SSL and when using the Chrome PA shows it as facebook-Video. However, both should be allowed. Any ideas? I'm running VM-100 on 7.1.9. Thanks!
... View more
04-07-2017
02:21 PM
Actually, I do have all the info in the config file... unfortunately I don't know how to use it though: client
dev tun
proto udp
remote vpn.vpn.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo no
route-delay 5
verb 3
explicit-exit-notify 5
<ca>
-----BEGIN CERTIFICATE-----
MIIGVDCCBDygAwIBAgIJAIzYQ+/kXyADMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNV
.
.
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIGnDCCBISgAwIBAgICRaAwDQYJKoZIhvcNAQEFBQAweTELMAkGA1UEBhMCSVQx
.
.
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
MIIJKAIBAAKCAgEA4hKsIsb3x4LJlYL35XivJr8FE/ak47OJbmZRfXB0l5jkLqc/
.
.
.
-----END RSA PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
7bb7a23a0f5f28d01e792df68f1764ab
.
.
.
-----END OpenVPN Static key V1-----
</tls-auth> I removed the actual key, but as you can see, it is actually there on the .ovpn file.
... View more
04-06-2017
07:55 AM
Yes, but the client is using an openVPN config file, which should have all that info (i.e. the .ovpn file). I can access that file... but I'm not sure what I would be looking for.
... View more
04-05-2017
05:30 PM
Is it possible to decrypt openVPN with SSL Forward Proxy? I'm pretty sure the asnwer is no, but I figured I would ask. My problem is that I have a Ubuntu Server running openVPN client behind a VM-100. I would like to continue to use openVPN, but I would like to intercept it, apply some policy on the decrypted traffic and re-encrypt. The server I basically uses: sudo openvpn --config VPN_UDP-443.ovpn Has anyone done something similar? One option (unfortunately non existent) would be implementing a opnVPN client direclty on the VM-100 and have my server just use that as the gateway... but that would be too easy! 🙂 Thanks!
... View more
- Tags:
- openvpn
04-02-2017
06:51 AM
Turns out iCloud and gmail are using non-standard ports. I had to change the policy (Policies -> Security) from: - Application: application_default .to. - Application: any I suppose I could have tweeked the application_default to allow the gmail and icloud custom ports too. That will be my next step. However, it is working with any. It looks like there was a change on 7.1: https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Policy-behavior-change-application-default/ta-p/75664
... View more
04-02-2017
05:02 AM
I have a weird problem. I installed a VM100 connected via PPPoE to the ISP, standard NAT, DHCP configured on the LAN side. Issue: unable to receive/send emails from iPhone from SOME providers using inherid IOS app: Corporate email: working via IOS email app iCloud email: not working via IOS email app Gmail email: not working via IOS email app, but works from "Inbox" app (on the same iPhone!!) PS: Web browsing is fine and even my SIP Trunk is working. Any ideas? I have set MTU to 1480 on the WAN interface. which was my first thought... Thanks!
... View more
04-02-2017
04:52 AM
If anyone is having this problem, I was not able to get it to work. I open a case and they are working on it. In the meantime, I changed the configuration using L3 interface and I see all sessions, everything works. However, when I configure the VM-100 with Layer 2 interfaces or Virtual Wire did not work at all. Traffic goes through but PA sees no sessions, no logs, no gits on any policy.
... View more
03-30-2017
07:45 AM
1 Kudo
Thanks Bryp. I tried re-uploading the key, but everything looks fine from a licensing perspective. process look fine too, logrcvr is running: I'm actually on the line with PA Support... for almost one hour! I'm actually glad they didnt figure it out in seconds... as I have spent HOURS on this!
... View more
03-30-2017
06:00 AM
Yes, it is: VM License VM-100 VM Mode VMWare ESXi Software Version 8.0.0 GlobalProtect Agent 0.0.0 Application Version 678-3929 (03/28/17) Threat Version 678-3929 (03/28/17) Antivirus Version 2197-2684 (03/29/17) WildFire Version 126980-128338 (03/29/17) URL Filtering Version 20170329.40154 GlobalProtect Clientless VPN Version 61-62 (03/03/17)
... View more
03-30-2017
04:02 AM
Hi guys, I'm new to PA so I hope this is not a stupid question. I configured my VM-100 with two interfaces (plus manegment), the two interface were setup as Virtual Wire. I can capture traffic going through and everything works from a user perspective. However, I get 0 sessions on the FW and no hits on any of the policies. I even created an universal policy with any-any, alow, log and nothing. I get 1 hit "insuffient data" every 12 hours or so. Any suggestion would be greatly appreciated!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-28-2018
05:29 AM
|
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
