About kattaullah

Satish Could you please let us know as to what are the application you are having difficulty after upgrading to 492. Did you check the release notes of 492 to check if there were any changes in this content version? Regards Khan     ... View more

Hello Mandar Below is the link to very helpful document to troubleshoot VPN connectivity issues. How to Troubleshoot VPN Connectivity Issues Hope that helps. Regards Khan Note: Please mark any correct or helpful answers ... View more

Hello Amir The syslog severity is based on the log type and contents. Below are the details Log Type Severity                                                 Syslog Severity TRAFFIC                                                                   INFO CONFIG                                                                    INFO THREAT/SYSTEM –Informational                       INFO THREAT/SYSTEM – Low                                      NOTICE THREAT/SYSTEM – Medium                              WARNING THREAT/SYSTEM – High                                    ERROR THREAT/SYSTEM – Critical                                CRITICAL Hope that helps. Regards Khan Note: Please mark any helpful or correct answers. ... View more

Hello Paul I have a few questions What is the software version. Type the command > show system info and paste the output When the GP download is initiated, did you do a packet capture with source and destination filter set? If yes, could you please paste a screen shot of the packet capture. Below are the steps to do a packet capture Need to setup the filters for the traffic we are interested in. To do this, execute the following steps: Navigate to Monitor--Packet Capture Click 'Manage Filters' Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank ) Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field) 2. Setup up the captures Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop) 3. Enable filters and captures debug dataplane packet-diag set filter on debug dataplane packet-diag set capture on 4. open 2 CLI windows on 1 run the following command to look at the counter ( make sure it run this command once before running the traffic) show counter global filter packet-filter yes delta yes on the 2nd window run the following command to look at he sessions show session all filter source <ip address> destination <ip address> 5.  Now download the client while it is failing to look at the counters and captures and sessions to determine what is causing the issue. 6.  Once you have finished testing and capturing. Make sure to turn off the debugs. I have seen Global protect client download freeze issues in the virtual firewalls and one Shot in the dark is to bypass tcp asymmetric path. For testing purpose please run the following command and try a test to download the global protect client from the portal. admin# set deviceconfig setting tcp asymmetric-path bypass Note: Please mark any helpful or Correct answers! Regards Khan ... View more

On the management profile, could you please check the entries under "Permitted IP address" ... View more

Se il vous plaît appelez l'assistance et ils seront en mesure de résoudre ce problème en effaçant l'espace disque. Également à ne pas courir dans cette question à nouveau, se il vous plaît passer à la version 6.0.7 du logiciel ou plus. ... View more

Pourriez-vous se il vous plaît exécuter cette commande depuis SSH et voir si sda3 montre 100% d'utilisation de l'espace disque. Si oui, se il vous plaît appelez l'assistance et ils devraient être en mesure de dégager cet espace disque de la racine. PA-200> show system disk-space Filesystem Size  Used Avail Use% Mounted on /dev/sda3 1.9G  1.5G  358M 81% / /dev/sda5 6.6G  4.6G  1.8G 73% /opt/pancfg /dev/sda6 1.9G  1.3G  507M 73% /opt/panrepo tmpfs 1.3G   67M  1.2G 6% /dev/shm /dev/sda8 2.4G  1.7G  580M 75% /opt/panlogs ... View more

bonjour Voulez-vous dire de dire que vous êtes en mesure d'accéder à l'appareil en utilisant CLI, mais incapable d'y accéder via l'interface web. Si oui, quelle est la plate-forme que vous êtes sur? Nous également savoir la version du logiciel qui se trouve sur l'appareil. Cordialement Khan ... View more

Hello Isaac I would go with Panos's suggestion. if this does not work, I would suggest that you contact support. They will be able to look into techsupport file and suggest next steps I suspect that the device is not able to  initialize the Dataplane start up script. Regards Khan ... View more

Hello Isaac Could you please restart the Dataplane communication process from the CLI and test? Below is the command PA-500> debug software restart pan-comm Regards Khan ... View more

That will not work Satish. May I know the reason as to why you do not want to use Dynamic IP and port. Is it for a specific requirment? Regards Khan ... View more

Hello Satish As you want to do a source static NAT, its not possible. If you want to use static NAT only, then you will have to have 1 public IP for every source static NAT that you want to do. Regards Khan ... View more

Hello Mandar This capture was taken on the Satellite device. Satellite : 10.66.24.84 Gateway: 10.66.24.93 The capture in question was taken on the Palo alto device using the filters given in the screen shot below. You should be able to see the exchange on the firewall stage packet capture. Hope that helps. Regards Khan ... View more

Hello Renan Could you please run the below command and check for the "Wildfire logs written" >  debug log-receiver statistics Now try to download an exe file . You can use the link " http://wildfire.paloaltonetworks.com/publicapi/test/pe " Check if the counter increases. This will let us know if the counter will indicate if the wildfire logs are written. Restart var-data receiver, management server and device server one at a time to see if it fixes the issue > debug software restart vardata-receiver >debug software restart management-server > debug software restart device-server If this does not resolve the issue please turn ON the debug for the the following daemon > debug vardata-receiver on debug > debug device-server on debug >debug log-receiver on debug Run the test again and turn off the above debugs. Then download a tech support file and contact TAC for further assistance. Regards Khan ... View more

I would also request you to check if you have the latest version of Application and Threat detection signatures. You can check this from Device->Content updates-> Check now. Make sure that you download and install the new latest one available. ... View more

Here are some detection/prevention best practices Cryptowall:  Palo Alto Networks firewall detect over 242 Crypto variants and 2686 Ransom variants as of today. CryproWall could very well be known by another name in the Cryptolock/CryptoDefense ransom ware virus family; and detected by Palo Alto. But unfortunately it's not possible to say weather Palo Alto is currently detecting all the CryptoWall Ransom signature unless we have that signature variant. Once we have the signature we can investigate further and see if we are mitigating or not. Implementing Wildfire (non-license version) can help with capturing new signatures.  You can also effectively reduce the risks of this or any other malware within your organization by following the guidelines from our product management team for our Threat features:  Use a layered approach: IPS signatures, AV, URL filtering and Wildfire for best protection  1. IPS: consider using inline blocking with a strict policy  2. AV: enable AV. To see our cryptolocker signatures search "LOCK" on our Threat DB portal. Keep in mind that we have added many of these samples under the names: Virus/Win32.generic.jnxyz" type name. Trojan-Ransom, Ransom/Win32.crilock.cl, Trojan/Win32.lockscreen.ajq  3. Spyware/CnC detection to find infected systems that may try to pull down variants: ensure DNS detection is enabled; Look for ID # 13433 "CryptoLocker Command and Control Traffic"  4. URL filtering with PANDB: prevent access to malicious/malware domains  5: Wildfire: free version allows uploads of files for scanning; subscription version provides hourly updates 24 hours a day with latest malware coverage from all Wildfire samples seen in the past hour  6. File blocking: no executables should be allowed to enter an enterprise without inspection.  7. Decryption: leverage SSL decryption to inspect all of your user's webmail sessions (doesn't let you read their mail, but it does allow you to block malware downloads).  8. Reporting: regularly look at your device's botnet report to spot any infections that came in via sneaker net  9. Sinkhole: PAN-OS 6.0 feature to prevent infected systems from contacting command-and-control servers  Hope that helped. Regards Khan ... View more

Hello Dat Tran I think you are referring to google web cache in the above comment. I tested the same in the lab and was able to block gambling.com successfully. Regards Khan ... View more

Hello Dat Tran Below is an excerpt from the 6.0 New feature guide. Please refer to page # 25 and you will find the below information in detail. New Features Guide 6.0 (English) URL Filtering Search Engine Cached Site Enhancement: Search engine caching enhances the URL filtering engine such that URL filtering policies will also be applied when end-users attempt to view the Google and Internet Archive cached copies of websites. There are no configuration changes required for these features. When performing a Google search, most search results will show a green arrow to the right of the URL to access a cached version of the site as follows: You can also put the prefix cache: before a URL in the Google search field to bring up the cached page. When the cached site comes up, note that the URL is prefixed by the Google cache URL as follows: http://webcache.googleusercontent.com/ . If a URL filtering policy for Computer and Internet Info was set to block, which is the category for the Palo Alto Networks domain, the action would not occur because the URL filtering engine would only look at the webcache.googleusercontent.com URL, which is in the Search Engine category. With this new feature, the entire URL is analyzed, so in this example, paloaltonetworks.com would be blocked. Hope this helps. Regards Khan ... View more