About Alex_Samad

Lol i'm having issues with  https://microsoft.com/   sigh !   is there a bug id or a work around ? ... View more

Wow, hate to say this, but its a lot like some of the technical issue i have had with PA support.   I have to admit I get better responses here on the forum -from PA employees then I do from the support line.   The best response I have gotten from previous times is when you get to a L3 engineer, make your way past 1 & 2 ...   And my SE's...   So at least for me the license isn't worth the $$$. subnet split routing is working. although there is a limit to the number of routes. Have actually started to look at 4rd party VPN solutions.  And my firewalling guys is started grumbling about maybe its time to think about moving off PA .. purely around the support   ... View more

@yannogrodowicz  thanks for the input.   We were using the trial license, but they way they charge, we will not being buying. As for the  %userprofile\ AppData\Local\Microsoft\Teams\current\Teams.exe   our issue was some users could connect and some couldn't always the same when i remove that it works as expect.   So I have gone back to downloading the ip's and creating rules for GP.   ... View more

@CoreyKinder which method the one with variables ?   I tried it and ran into similiar problems earlier people had. some staff would work and some wouldn't     ... View more

 Wow support don't know ! I find it strange you have to remove the client.    when i make changes to the split tunnel withe routes they seems to show up after a disconnect reconnect.   if they don't support  %Variables%, then you can't really do teams can you ?  Wow  ... View more

Moved to trying  %userprofile%\ AppData\Local\Microsoft\Teams\current\Teams.exe   turned it on and MS Teams stop working for some and still working for others 😞   ... View more

I get that thanks.    What I am looking for is the gp exclusion list I want to keep it to just video stream - no virus in that yet ? if i include base that means I think i get all the other pages as well. If there a definition of how it works it out     ... View more

Seem like the nice people at PA have opened up trial license for 3-6 months for GP.  which will allow me to use all these nice features. So instead of having to do it by ip address I should be able to do it by app / process .. ... View more

I have gone the cheaper or route the license for GP is $$$ so i use split tunnel routes   https://docs.microsoft.com/en-us/office365/enterprise/office-365-ip-web-service offical ip ranges used by MS for services - pick the skype ones it covers MS teams from my under standing    i run this script to produce something I can cut and paste into panorama   #!/bin/bash # # guid # https://www.guidgenerator.com/online-guid-generator.aspx # guid=<generate one> tp="/tmp/$guid" # # https://docs.microsoft.com/en-us/office365/enterprise/office-365-ip-web-service # wget -O "$tp" -q 'https://endpoints.office.com/endpoints/WorldWide?ClientRequestId=<getyourown>&AllVersions=false&Format=CSV&NoIPv6=true&TenantName=yieldbroker&ServiceAreas=Skype' # theips="prefix other ips" for x in $( cat "$tp" | sed -e 's/^[^,]*,[^,]*,"[^"]*",//;s/"[^"]*",//;s/^,.*$//;/^id,.*$/d;/^$/d;s/^"\([^"]*\)".*$/\1/;s/,/ /g') do #echo $x theips="$theips $x" done echo "# this is for the <agent name1> people on the gateway" echo "set template Active_Passive config vsys vsys1 global-protect global-protect-gateway alcpa-vpn-gateway remote-user-tunnel-configs <agent name1> split-tunneling exclude-access-route [ $theips ]" echo "# this is for the non singapore people on the gateway" echo "set template Active_Passive config vsys vsys1 global-protect global-protect-gateway alcpa-vpn-gateway remote-user-tunnel-configs <agent name2> split-tunneling exclude-access-route [ $theips ]" echo "# this is for all on the gateway" echo "set template ybopa config vsys vsys1 global-protect global-protect-gateway ybopa-vpn-gateway-external remote-user-tunnel-configs <agent name3> split-tunneling exclude-access-route [ $theips ]" echo ... View more

Okay worked out the issue !   asym routing        client -> external address   client -> fw -> syslog server via internal address -> loopback (external address !).   return packet was directly back to the client. the FW wasn't seeing all of the packets !' ... View more

So the word i got from support you can't use app override to a preconfigure app and override the port number...    sigh ... tried that and its still not working 😞 ... View more

Hi   Very true, but I had tcpdump on both side - client and server.   syn tick syn ack tick syn ack ack tick   then I see the client trying to push and then flush the tcp connection they don't actually make it to the syslog server.     ... View more

Hi   @OtakarKlier   Not sure why I have to change my setup to make he firewall work :).   So the reason I am using TCP over 514 is that the reliabe transfer setup for syslog. I can guarantee messages being sent from one server to the central logging server.   The issue seems to be that the PA doesn't allow traffic to flow from client to server and back. because it can't id (my guess why the packets aren't flowing).    initially I have it as  any int ip to syslog server allow applicaiton syslog on port 514 udp and tcp.   UDP works fine. but when i tried my tcp connections. no go.   So did some investigating and found that PA application syslog doesn't recognise tcp/514 as syslog ..  So I thought this is simple ! I do an applicaiton override for any int ip to syslog on tcp 514 say its syslog application.   that didn't seem to work !  when i look at current session they still show up as undecide .. so it just gets stuck and ages out.   So what next !   I have raised this with support ..    but why do I have to change my setup to make the firewall work properly           ... View more

tried allowing any app id but to that ip and only port 514..    no luck 😞 ... View more

@TerjeLundbo Oh ... could they id what caused the excessive CPU usage ... and its it planned on being fixed.   Trying to get this info from Support or my SE is very very painful - so I am eager to get as much info as I can      ... View more

@TerjeLundbo was that a recommendation from PA support to go back ???   Thinking thats a pretty big step to make that much difference  ... View more

Hi   Thats very interesting. So ... forgive me I might use the wrong words.  But I believe the CPU was at 100% across all the cpu - left no head room to process any packets for other things like OSPF heartbeats or BFD . etc etc.   I believe support said this was a 9.0.x thing.   So we had 4k emails ... some some text and a PDF . that would send out at the end of day.  not a problem with 8.1.x or 8.0.x    But 9.0.x shat itself.  so I took emails of the threat protection path .. I think thats silly. but I have no way to mitigate the problem with out rate limiting down to almost 0..     ... View more

Hi   my only problem with all of these protections is are they are based upon number of connections or number of byte or flow rate.   Thinks that don't corrolate to threat detection.   I still think the best thing is to say threat protection can only use 80% of cpu ....   from what I read about PBP " When packet buffer consumption reaches the configured  Activate  percentage "   works on the amount of traffic coming in - which might not relate to the amount of work threat protection has to do !   ... View more

So ran into this problem again . but on my PA850 - much smaller PA.   So users connecting to file server.   Normally the PA's id's traffic as ms-ds-smbv3 no problem it doesn't get checked so no issue. But the last one that went through was ID'ed as rss. not sure how that worked and it ifs under my catch all.   It was 27G session   so it tanked my CPU - stoped OSPF deamon replying to hello's.    basically killed the Firewall and brought down the network in the office   To me this is a Bug - rather big one ... not being able to limit the amount of cpu time that is allocated to threat protection     ... View more

Hi   I am not sure if its a bug.   Why the move to 9.0  . thats the PA recommendation Why 9.0.5 Thats the recomemnded release    I would hope that PA wouldn't recommend things that don't work !   The protection should be, in my opinion, that you can apply caps to CPU limits for type or process on the PA.   Threat prevention shouldn't take up 100% over and above packet routing .. which is what happened.   Yes you can try and limit traffic / data to / through the PA but that is fraught with danger - again don't fix the symptoms fix the issue.     Any way I am happy - sort of - with my change - I have remove content checking ... I would like it on but I can live with out it for now       ... View more

apologies 5220 ... View more

Hi   Yes, some thing that probably needs to be addressed some how. TAC - yep waiting on them ... 3 days so far.   " You can limit both tcp-syn and set a session max-concurrent-limit and rate-limit connections to a very appropriate level. I think you're thinking too much of what someone  could  do to bypass your limits and what the vast majority of attacks  will  do. If I knew your host I could overflow your systems if I wanted to, end of story no way you can defend against it.  " I have to disagree, because you don't know the characteristic of what is going to set off the 100% cpu usage.  You can't cound SYN / Connections / Session as SMTP allow for multiple message to be sent over 1 TCP session.   Size .. how can you tell if it 4k of 1k mailes or 1k of 4k emails with attachments .. so if you do it by size then you are going to kill valild connections. So let me correct / expand on this. I could set it to say limit to 5 connections (concurrent) and 1.2 * max attachment size. This would / should make sure I don't run into CPU issues. But then I am not getting the most out of my system.   Thanks   ... View more