About AitorGD

Hello,   We have detected in our 820 device the following alarm:   SYSTEM ALERT : critical : max registered-ip for the platform reached (1000)   Searching the objects, we have only 746. I'm not being able to find so much information about this.   Does anyone know how to check the alarm correctly?   Regards, Aitor ... View more

Hello,   We are being affected by a bug that disconnect the Virtual-Wire interfaces in the switches. We are in 8.0.8 version and we wanted to upgrade to latest 8.1. We discover recently if we upgrade to 8.1.0 the bug doesn't affect us and the TAC told us to upgrade to 9.0.   Anyway, the compatibility for 9.0 version requires also upgrading Panorama to 9.0 and user-ID to 9.0 too. The question would be   8.0 versions is compatible with Panorama 9.0 and user-ID 9.0? We would like to confirm it in case we have to do a rollback.   Regards, Aitor ... View more

Hello dear community,   I have a question about traps behaviour, we have a customer that have machines not able to connect agains their cloud services:   "2020-01-27T11:22:49.168+01:00 VMCO-13 [2004:2312 #24:24] {trapsd:Infrastructure:Heartbeat(user ID=S-1-5-21-2238142029-4184273230-3152458776-1774, name=testvv3):https://ch-best.traps.paloaltonetworks.com/operations/provision/register:} <Info> HTTP request body (JSON): { "agentId" : "", "computerName" : "VMCO-13", "computerSid" : "S-1-5-21-2238142029-4184273230-3152458776-3544", "distrId" : "f94430d8ec7996ec2e6c83248409ab08", "domain" : "tercat.local", "goldenImageId" : "bc50e0f31dbac129ab0debcae792aea1", "ip" : "172.16.10.112", "is64" : true, "osType" : 1, "osVersion" : "6.1.7601", "productName" : "", "productType" : 1, "protectionStatus" : 0, "trapsVersion" : "6.1.3.26103", "userName" : "testvv3", "userSid" : "S-1-5-18", "vdi" : 1 } 2020-01-27T11:22:49.330+01:00 VMCO-13 [2004:2312 #24:24] {trapsd:Infrastructure:Heartbeat(user ID=S-1-5-21-2238142029-4184273230-3152458776-1774, name=testvv3):https://ch-best.traps.paloaltonetworks.com/operations/provision/register:} <Info> HTTP status: 400, reason: Bad Request 2020-01-27T11:22:49.331+01:00 VMCO-13 [2004:2312 #24:24] {trapsd:Infrastructure:Heartbeat(user ID=S-1-5-21-2238142029-4184273230-3152458776-1774, name=testvv3):https://ch-best.traps.paloaltonetworks.com/operations/provision/register:} <Info> HTTP response body: { "error" : "authentication failed: failed to verify distribution"   According to them, this error appeared when they did a VDI clone of machines based on one template.   That's the template     I would like to confirm what is the Traps behaviour in this scenario because I've never seen that before. I think the most possible is that something on the machine change on its registers that affects to the traps agents and is not related with Traps. But I like to confirm. Can you help?   Regards, Aitor ... View more

Hello all,   We are detecting problems with a VPN Tunnel using IKEv2. The tunnel is a L2L tunnel agains a third party vendor (Sonic Wall) the tunnel works fine on all the aspects, but sometimes the tunnel falls down and we do not why exactly. When the tunnel falls it takes onlpy a few seconds to up the tunnel again.   The error that I saw on the logs when the tunnel fall is the following:   -Event: ikev2-nego-ike-dpd-dn -Description: IKEv2 IKE SA is down determined by DPD   It results that DPD no exists on IKEv2 and as substituction, liveness check appear, so I don't know what this error exactly is.   Can you help me?   Regards, Aitor ... View more

Hello I have the following scenario:   -PA-3020 Edge Firewall who provide as internet access -PA-200 LAN Firewall behind PA-3020   We are triying to configure Global Protect access for GP-200.   -I have a fqdn for the portal and gateway access which resolves a public IP for external access and resolves a privete IP for internal access -Public IP for fqdn name is different than other IPS which have assigned. So, we are not using puebli IP addres of PA-3020, because we are using it for other things and we are not allowed to uset it, so, we are using another public ip on the same range -We configure a NAT on PA-3020: Translates any source destinated to public IP address of GP on PA-200. The rule translates public GP address to private GP address. Since PA-200 have a different gateway to exit internet (IS not PA-3020) I had to configure a translate from source address also to being translate to the IP address that comunicate PA3020 to PA200 -That works, we are able to reach the portal and the user authentication works -The problem is the Global Protect client is not connecting. Is showing me that Cn of certificate is not the public IP that i put on the certificate -Regarding Palo Alto KBs. The problem is you must configure as CN the public IP address that GP use and as external gateway you must configure also the same address you have as CN on the certificate, but we are still seeing the CN error on GP client.   I'm not sure about what is not working well. Any suggestion? ... View more

Hello Dear Community,   I have a client who wants view user-id users name of the radius server on Palo Alto Logs (Like happens with LDAP Active Directory)   The SO of the Radius Server is Windows Server 2008. I saw there is a link on Palo Alto KBs to configure the user-id for Radius users from the Syslog Server:   https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/user-id/configure-user-id-to-receive-user-mappings-from-a-syslog-sender.html   But in this case, the customer has a Syslog but is not sending the Radius User logging to the Syslog, So I cannot apply this procedure.   Are there another form to do this?   Regards, Aitor ... View more