About dburns

Did you happen to capture the GradARP packets on the passive device as it became active?   https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Capture-ARP-Packets-on-an-Interface/ta-p/55835         ... View more

What version? And are you sure the API is not being updated? The clear command worked for me. You could also add a timeout and send that to all your api know users therefor they would timeout. admin@PA-200> show user ip-user-mapping all IP              Vsys   From    User                             IdleTimeout(s) MaxTimeout(s) --------------- ------ ------- -------------------------------- -------------- ------------- 192.168.254.1   vsys1  XMLAPI  dominic                          Never          Never        Total: 1 users admin@PA-200> clear user-cache all All entries in user cache removed! admin@PA-200> show user ip-user-mapping all IP              Vsys   From    User                             IdleTimeout(s) MaxTimeout(s) --------------- ------ ------- -------------------------------- -------------- ------------- Total: 0 users admin@PA-200> ... View more

pa> show interface <interface> Interface management profile: allow_all   ping: yes  telnet: yes  ssh: yes  http: yes  https: yes    snmp: yes  response-pages: no  userid-service: no ... View more

Controlling Skype See page 4. ... View more

ok nothing to do with NAT the V-wire is not working at all. I would start with checking the V-wire configuration and security policy. ... View more

"No Active Sessions…" There's your first problem. Doesn't look like the traffic is even hitting the VWIRE. In the 'show session all filter' command you used Pre-NAT IPs to filter correct? D ... View more

Page 21 shows you the objects.. no subnets When you look at the session is the NAT rule being matched and NAT not applied? Or not matched at all. To view the session live from the CLI use the following; pa> show session all filter source <ip> destination <ip> pa> show session id <id> Look for NAT rule Dominic ... View more

Understanding PAN-OS NAT Page 26, have you reviewed this yet? Dominic ... View more

Packet Flow in PAN-OS See this document. You'll notice prior to the NAT policy look up there's a forwarding lookup. The information applied from this forward look up is what is used to match the nat rule (important to note it is not used to match the security rule). Dominic ... View more

Pre-Nat rule matching will use a route look up to match the NAT rule prior to applying NAT. I'm guessing 10.10.2.10 would go our the internet zone. Dominic ... View more

Looks like you might be selecting the "log-view" report. Try just selecting the summary report in your report group. Dominic ... View more

You should get a free 30day eval of URL filtering with the device. You should be able to see that online in customer portal (My Devices). Once the 30 day is applied go to device tab -> licenses and activate the URL filter, then Dynamic Updates. *Adding the URL database may require a restart. Dominic ... View more

Going back to your first statement, " OK, let me start out with I am not using the URL filtering profiles." Do you even have a URL filter lic and have you downloaded a database in the past? If not, I believe the custom URL wont work as theres no database to put the custom URL category in. Thanks, Dominic ... View more

Trevor, I suspect the application stop because the certificate which the PAN is presenting is unknown and the application has 1. stopped or 2. awaiting you to ok the unknown cert. This would be success because the decryption worked (pan cert forwarded) PAN doesn't know the difference between the phones and workstations unless you can enable userID and get the workstations as "known" users or get the mobiles "known" with captive portal. At that time you can exclude or include based on known/unknown user. You also could create a separate wifi network for these mobile devices to connect with. At that point you could ignore them by subnet. Also another option depending on how many users I believe you may be able to install a trusted root cert on the device directly. I hope this helps, Dominic ... View more

A bit of a broad question because of the various factors that may be in play. But typically the passive unit will be available very quickly it's a matter of other factors coming over. If this is a simple L3 setup no dynamic routing you can tail a log that will show you when the Gratuitous ARP is sent out. On the passive unit use this command via cli. pa> tail follow yes dp-log pan_dha.log Suspend the active- You should see this log- Jan 1 00:00:16 Send gratuitous ARP See if this differs between the two firewalls when taking over. Will be a good starting point. Dominic ... View more

Does the VPN software give you any specific errors that may lead to the problem? There is a way in the CLI to view counters for the traffic going to the destination IP and they may have some drops that would not specifically be viewed in the traffic logs. Here are some entry docs into those counters. You can use the monitor tab->packet capture to setup a filter and filter these counters by a specific IP address. >> Another quick one!  Is there anyway on the Palo Alto to see the bandwidth being used by the ethernet ports?" in the GUI, if you apply QOS you can look at the statistics in the CLI, PA> show system state browser Shift L and select Port Stats Hit y hit u There is by default a 5 second update but can be changed with "r" Dominic ... View more

Mario, My guess if you are connected to GP is a policy or routing issue. Few things to look at are the sessions from the session browser, to see if the pan is even creating a session for the ping packet and if so what interface is the packet forwarding to. Also from the session browser if you be able to see if the packet will have nat correctly applied (if it needs to). Dominic ... View more