About Gregoux

Gregoux · ‎02-02-2016

a source nat was implementing between the palo and the hsm and there is a verification of the palo ip with ntls ipcheck fonction enable by default LUNA doc and to resolve just disable it with this command on the luna HSM ntls ipcheck disable

Gregoux · ‎02-02-2016

Hello all I'm new in HSM configuration I configured the setup hardware security module. with a PANOS version 7 the result was success and in the admin guide is wrote that you have to configured the Setup HSM Partition but this does exist in the Hardware Security Operations area. any idee

Gregoux · ‎10-23-2015

Hello could you verify this counter show counter global filter | match url_request_pkt_drop you obtain something like this url_request_pkt_drop 334056 10 drop url pktproc and if you have some drop packet it's du to the waiting time for url categorisation request to resolve this modify this parameter set deviceconfig setting ctd url-wait-timeout and define a value greater than 5 and less than 60 by default panos use a value of 5 s and the PA-500 is to light to process the categorisation and takeover the limit of 5s you and increase the capacity of the PA-500 but increase the acceptable time to resolve the query regard's you can find more info https://live.paloaltonetworks.com/t5/Management-Articles/What-is-the-Cause-of-Packets-Dropped-Due-to-URL-Look-Up-Failure/ta-p/59703

Gregoux · ‎07-31-2015

hello your security policy is configured may be with service application default. may be when you decrypted the the session the flow stop to match you policy because you tried to catch the application name on the 443 port and now the traffic is not seen as SSL. be sure that you create asecurity policy which match the good app on the good tcp port like 443, and apply on it the security profile which handle the file blocking action. regard's

Gregoux · ‎05-11-2015

yes you right thank you very much I'm going to sleep now

Gregoux · ‎05-11-2015

thank's you but I used a version as 6.1.3 and I don't find the encrypted zip in the data filtering profile. any idea ?

Gregoux · ‎05-11-2015

hello I would like to block zipped file with password protection or if the zipped is more than twice zipped. a solution for that? thanks

Gregoux · ‎05-11-2015

Hello I would like to know if a setting like auto cost reference bandwith for ospf exist on the palo alto. as you can found in cisco. if yes how could I implemented it thank's

Gregoux · ‎03-20-2015

Hello shutdown the Firewall Clone the Device -> and boot up the cloned Device this way your Eval License will get invalid and you are able to register it with your Auth code you need to affect the new cpuid and the uuid of the vm to the retail license to realise the migration. see PAN-VM license upgrade from eval to full with HA setup regard's

Gregoux · ‎03-19-2015

exactly you need to create an xml file base on a script wich parse the two log file from juniper and infoblox and upload this file with the REST API the xml file looks like this <uid-message> <payload> <login> <entry name="acme\jjaso" ip="10.1.1.23"> <entry name="acme\jparker" ip="10.1.1.24"> <entry name="acme\ccrisp" ip="10.1.1.25"> </login> </payload> <type>update</type> <version>1.0</version> </uid-message> to do that have a look to PAN-OS and Panorama XML API Reference Guide 6.1

Gregoux · ‎03-17-2015

same as this two case https://live.paloaltonetworks.com/thread/12785 https://live.paloaltonetworks.com/thread/11366 do you open a support case?

Gregoux · ‎03-17-2015

you could have more info here https://live.paloaltonetworks.com/message/50335#50335

Gregoux · ‎03-17-2015

do you open support case ?

Gregoux · ‎03-17-2015

do you open a support case? if not I advice you to do it.

Gregoux · ‎03-17-2015

Best way to see how the gateway choice is made is to look in the PanGPS log on the client (in the GlobalProtect directory - enable debug mode in advanced settings in the client) more info here GP and Multiple Gateways

Gregoux · ‎03-17-2015

Hello Gp Gateway selection process is mentioned in page 30,39 and Page 48 of the following doc:- https://live.paloaltonetworks.com/docs/DOC-2020 is base on the average of the time response from all the gateway and if a gateway answer is under this limit it could be used it depend of the priority affected

Gregoux · ‎12-17-2014

Yes I make this mistake, but how could we explain why it's work after a downgrade of version of the GP agent. Re: GP Error "Server certificate verification failed" thank's

Gregoux · ‎12-16-2014

Hello I encountered a strange situation I tried numerous time to connect a global protect agent in version 2.1.x on windows 8 and with a mac too and I obtain a message can't verified the server certificat I tried to connect with the FQDN specified in the certificate server, and I installed manually the root CA and the intermediate ca in the correct certificate store and I failed each time to be connected. that I done is to uninstall the version 2.1.x and I install the version of global protect agent in version 2.0.4. and immediatly the connection succed after that. My question is there is a problem with version 2.1.x of the agent ? or the new installation of a old version force the panagent to reread the certificat store? and now if I upgrade this version to the 2.1.x it is possible to work again? thank's

Gregoux · ‎11-05-2014

Heatbeat Interval(1s mini on PA 5000 4000 3000 and 2s minimum on the other) is different as hello interval (8s mini) and a failover base on hello intervall is rare and you need to wait 3x heartbeat intervalle to triggred a failover. plus you need to considered the promote hold time with a minimum of 500ms. brief as minimum if you triggered a failover you need to wait 3,5s before retrived something working any comment?

Gregoux · ‎10-27-2014

I downgrade the PANOS in 6.0.2 and it works just after. think if I just resart the management plane it could be works. typicaly it looks like a delay to enumerate the user and group when i tried to add a user or group in a security policy. the command show user group -list work's, in panOS 6.0.3 and no specific entry in the release note about this. thank you very much for all and sorry for delay to answer.

Gregoux · ‎10-27-2014

The check box option administrator only is not involve in this case but interresting to know.

Gregoux · ‎10-27-2014

yes I did it work's I could list all the group but the sintax is cn=bla bla bla but it's not enough to do it work's

Gregoux · ‎10-22-2014

Hello I've an issue on the PANOS 6.0.3 about enumaration of user or group in a security policy I have to use the complete ldap syntax to found the user in the user source column like this and when i tried to browse directly with the select menue I obtain this loading but nothing appear anybody have this issue?

Gregoux · ‎10-07-2014

Hello I have 2 exchange server in a DMZ, and I would like apply an inbound NAT with a load balancing like a simple round robin. we need to used a tier load balancer to do that. My question is some of you are interresting in a feature request, to implement a simple feature of load balancing in PANOS?

Gregoux · ‎08-06-2014

hello I found this SSL-Decrypt certificate cache commands

Gregoux · ‎08-06-2014

Hello I used ssl forward proxy, and it's work. I woud like to see all the server certificate create by my CA thank's

Gregoux · ‎05-13-2014

Hi all for me it's look like a routing issue or something avoid the return of ping echo. if you you want to deny incomplete flow, you need to let pass the first packet icmp in your case and wait for an response that cross again the firewall to be define as ping application however if the response is not seen then the flow will be categorize as incomplete. in fact you cannot block incomplete flaw in your case unless you deny ping application or if you resolve your routing issue.

Gregoux · ‎05-06-2014

Hello you could open the global protect agent go click on help and select about global protect agent like this

Gregoux · ‎04-25-2014

Hello I was a little surprise when I configured a user-id with active directory monitoring I defined a specific user with all the right needed on the active directory like user is part of the Distributed COM Users, Server Operators and Event Log Readers groups the windows active directory is base on WIN2008 R2 only Event Log Readers groups is needed but the result was the paloalto was not connected to the AD controler and I looking for a while until I try to activave the WMI probing I execute Run wmimgmt.msc (on the domain controller server) on the command prompt to open the console and modify the properties Select the Security tab of the WMI Control Properties and drill down to the CIMV2 folder. Select this folder and click the Security button. Add the service account and check off both Enable Account and Remote Enable. as describe their: PANOS 5.0 User-ID Installation and configuration including integration guide with Microsoft NPS In fact I have used this fonctionnality for a while with admin account. and everything works now I can used another kind of user but with wmi right access.

Gregoux · ‎03-25-2014

Hi we meet an issue with an upgrade from version 5.0.11 to version 6.0.1 with the version 5.0.11 we could list the user associate in the group with the command show user group name "cn=groupe1,ou=groups,dc=mydom,dc=com " but after upgrade no user is list with this command is it normal?

Date Registered	‎09-28-2010 03:06 AM
Date Last Visited	‎06-09-2016 08:45 AM
Total Messages Posted	172
Total Likes Received	40

Online Status	Offline
Date Last Visited	‎06-09-2016 08:45 AM

Strata

Prisma

Cortex

About Gregoux