About Anon1

Anon1 · ‎03-20-2020

Somebody else has same issue with Wildfire EU Cloud? System Log full of "wildfire-conn-failed" events and in traffic log can see corresponding connection issues with 154.59.126.51, packets received = 0, therefore application "incomplete". Normally it should be application paloalto-wildfire-cloud.

Anon1 · ‎03-12-2020

PAN-131792

Anon1 · ‎02-21-2020

Same here with 9.0.6, TAC told me is known issue and will be fixed in 9.0.9

Anon1 · ‎01-22-2020

Thanks for all your answers. Yes, I meant the "Update Server" setting on the firewall devices. @OtakarKlier : Do you mean to create a custom URL category object with the *.paloaltonetworks.com URLs and attach it to the firewall rule with the paloalto-updates appid? Isn´t this redundant? I assume the paloalto-updates appid does exactly this (allow access only to the relevant resources for the update service.)

Anon1 · ‎01-20-2020

There is a new Customer Advisory "Content Delivery Network Infrastructure Update". https://live.paloaltonetworks.com/t5/Customer-Advisories/Content-Delivery-Network-Infrastructure-update/ta-p/307121 We use AppID " paloalto-updates " to allow download of updates. Does this need to be adapted? The firewall devices are configured to use update server " updates.paloaltonetworks.com ". Does this need to be adapted? Unfortunately the Customer Advisory does not elaborate on this.

Anon1 · ‎01-10-2020

Yes, Panorama itself has the same issue with content updates. Download and install schedules are pushed from Panorama to devices via template setting.

Anon1 · ‎01-10-2020

May I ask how you managed to update a PA 5020 to PAN-OS 9.0? We were told PAN-OS 9.0 is not supported on PA 5000 series.

Anon1 · ‎01-10-2020

We encounter the same in a global PA deployment. Automatic content updates dont work anymore, triggering it manually on the device works fine. However, automatic antivirus updates still work fine.

Anon1 · ‎01-08-2020

Signature is released in content update 8224.

Anon1 · ‎12-17-2019

Changing service route is not possible on Panorama. But I found the issue: Some of the update traffic is now classified as "ssl" and not "paloalto-updates". When you try multiple times, it eventually contacts a download server which is classified as "paloalto-updates". With "ssl" added to the rule, it works now instantly and every time. Thanks for your help.

Anon1 · ‎12-16-2019

Routing is all fine to 34.96.84.34 Any idea in which mp-log file there could be more details of this "generic" error?

Anon1 · ‎12-16-2019

Thanks for reply. When I click on "Check Now" it shows new version, but when clicking on "Download" get this "Generic..." error message. After multiple attempts, it eventually works. The mgmt interface is used for download which in the end arrives at the firewall from trust to untrust where I cannot see any dropped traffic regarding "paloalto-updates" appid.

Anon1 · ‎12-16-2019

Anybody else encountering this issue in the last days? Content and antivirus updates are failing with "Failed to download due to generic communication error. Please try again later." The internet access itself is OK. The issue seems to be on the Palo Alto Networks side.

Anon1 · ‎10-22-2019

I use the PingID authentication only for Panorama admin access, there it works with 8.1.9. I hoped the code would be the same on the firewall device side for this functionality. The actual issue is the double quote in the string returned from PingID (...To connect, type "ok".). This is not handled correctly within the Javascript and therefore rendering fails. You see also a corresponding error when you open the developer mode in the browser. Perhaps you can customize the message from PingID to not contain quotes?

Anon1 · ‎10-22-2019

Upgrade to 8.1.9. It is a bug. Look into the html source code of the page. There you see the message, it is not rendered correctly. It works with 8.1.9

Anon1 · ‎07-24-2019

Hello BPry thanks for your reply. Perhaps I better convert the Override lists to Custom Url categories before update to PAN-OS 9 ?

Anon1 · ‎07-23-2019

Does anybody has experience with migration to PAN-OS 9 regarding URL filtering changes? Today with PAN-OS 8.1 Url-Filtering Profile 1 with Override Allow list: Url 1, Url 2, Url 3 Url-Filtering Profile 2 with Override Allow list: Url 2, Url 3, Url 4 Url-Filtering Profile 3 with Override Allow list: Url 3, Url 4, Url 5 During migration to PAN-OS 9 (in which the Override Allow List was removed), I understand that for each Override Allow List, a separate Custom Url Category is created: Custom Url Category 1:Url 1, Url 2, Url 3 Custom Url Category 2:Url 2, Url 3, Url 4 Custom Url Category 3:Url 3, Url 4, Url 5 which then are assigned to the respective Url Filtering Profile Url-Filtering Profile 1: Custom Url Category 1 => Allow Url-Filtering Profile 2: Custom Url Category 2 => Allow Url-Filtering Profile 3: Custom Url Category 3 => Allow How is the behaviour of the firewall now if the same Url, e.g. Url 3, belongs to multiple Custom Url Categories? Which one will match? Here https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClzSCAS it says it can cause unpredictable results. Here https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClsmCAC it says it will result in the most severe action.

Anon1 · ‎12-07-2018

With PAN-OS 8.1 you can lower the fqdn refresh to 60 seconds on the firewall, however, apparently only on the VM-Series: FQDN Refresh Time Enhancement: In PAN-OS 8.1, VM-Series firewalls support a larger range for the FQDN Refresh Time than in prior releases. The range is now 60-14,399 seconds, which allows VM-Series firewalls to refresh the IP addresses for an FQDN at shorter intervals. A shorter refresh time is helpful for VM-Series firewalls in cloud deployments where IP addresses for FQDNs change frequently. The shorter refresh time along with the support for using the FQDN of a load balancer in Destination NAT policy (Dynamic IP Address Support for Destination NAT) makes it easier for you to deploy the Amazon ELB service and any other FQDN-based load balancer to distribute sessions evenly across more than one IP address.

Anon1 · ‎12-07-2018

On the passive there is nothing you can do manually (beside making it the active by doing failover). On the active however, when you manually click Install on content update version you can check "Sync to peer" and then the passive will also be updated.

Anon1 · ‎11-22-2018

Create a custom url category containing the needed url. Then use it in the url category section of the firewall rule. Use destination IP any. The firewall will then allow the TCP handshake to any IP address and then when the first packet with payload comes it will compare the requested url against the url in the custom url category. If it matches, the session will be allowed. If not, the session will be closed.

Anon1 · ‎06-07-2018

There is a bug that EDLs cannot be downloaded from https servers which only support TLS. Fixed in PAN-OS 8.0.7 or higher. Or change the webserver to allow SSLv3. PAN-85047: Fixed an issue where the firewall failed to retrieve a domain list from an external dynamic list (EDL) server over a TLSv1.0 connection. However your issue seems to be different. Sounds more like missing certificate in trusted store.

Anon1 · ‎05-25-2018

This is a known bug and fixed in 8.0.10 PAN-88388 Fixed an issue where you could not export certificates when you accessed the firewall web interface through a browser that ran Firefox v56 or later or ran Chrome v66 or later ( Device Certificate Management Certificates Device Certificates ). With Internet Explorer it works.

Anon1 · ‎05-07-2018

PAN-OS / Panorama 8.1 has export function: https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/management-features/configuration-table-export

Anon1 · ‎04-17-2018

Hello Remo, thank you very much for the detailed information. It is very helpful.

Anon1 · ‎04-13-2018

Hello, thanks for all your replies. Unfortunately (log-setting eq '') does not work for me either. It finds nothing, but there are definitely rules with Log Forwarding = None. Probably due to the behavior reaper mentioned.

Anon1 · ‎04-12-2018

Anybody knows a trick how to filter for rules with no log forwarding profile configured? (log-setting eq 'Profile-Name') => all rules with Profile-Name !(log-setting eq ' Profile-Name ') => does not work, shows all rules (log-setting neq 'Profile-Name') => does not work, shows no rules (log-setting eq none) => does not work, shows no rules

Anon1 · ‎03-07-2018

Use this: https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/management-features/action-oriented-log-forwarding-using-http

Anon1 · ‎12-08-2017

EDL download by firewall only works if the web server which hosts the file allows TLS1.0 connections. The firewall does not support higher TLS versions for EDL downloads.

Anon1 · ‎11-29-2017

Are you in "Panorama" context or in device level context? You cannot modify templates coming from Panorama on device level. You can only override them with the little cogwheel icon. To change template settings you have to be in Panorama context.

Anon1 · ‎11-17-2017

It is not possible to block files based on hash. You will need to get the original file, upload it to Wildfire cloud, if it is classified as malicious, a signature will be created to block it. I recently had the same request (block files based on hash value). https://live.paloaltonetworks.com/t5/Custom-Signatures/Custom-Antivirus-Signatures/m-p/178320#M204

Date Registered	‎08-21-2012 12:18 PM
Date Last Visited	Friday
Total Messages Posted	137
Total Likes Received	29

Online Status	Offline
Date Last Visited	Friday

Strata

Prisma

Cortex

About Anon1