About RobinClayton

Aayush_Sibal

I'm facing the same issues on our PA-850. Did the upgrade to 8.1.14 helped you?

Ivan.Gladushko

Hi DPoppleton, A few months ago, after the Office 365 deployment was completed in my organization, the same task popped up in my list. Having searched for quite a while, I couldn't find a relatively simple solution and MindMeld was considered an overkill for the setup and requirements at the time. So, I came up with my own solution, o365-json-to-flatfile-converter It's been running successfully and feeding my PAN FW's EDLs ever since. URL: https://github.com/ivang-coder/o365-json-to-flatfile-converter.git Try it out and see whether it fits the requirements. Would appreciate your feedback. Cheers, IvanG

cenders · ‎04-17-2020

Thank you, this also solved the problem for our network as well. Moving away from an MPLS to a VPN and calls couldn't exit the remote site. Calls to the remote site worked fine. Changing to UDP worked great.

pdasari · ‎04-02-2020

@MickBall I like it how you said 4hrs or 8hrs is safer bet.We use WMI probing.The current timeout we have now set is 10hrs. The probe time is set to 20min. At our company as all of has work from home situation users are jumping on and off the VPN to avoid latency with Zoom/Webex or bypass the FW rules or whatever. Because of this, the IP addresses becomes free and the new user logging onto Pulse gets them.The firewall hasn't reached its 10hour period and the new user gets the old user's User ID and the new user happened to be an executive and gets the block page. What is the ideal way to resolve such issues when the IPs are so frequently changed, default of 45min? But what happens if something chnages in that 45min time period? Is there more real time information for firewall somehow?

feelgood · ‎02-26-2020

Hi, Thanks a lot for your help.

RobinClayton · ‎02-25-2020

The alternative is to configure your MTA to accept unauthenticated SMTP from the address of the Firewall. Rob

RobinClayton · ‎02-21-2020

I posted a Linux scripted solution a few weeks back in response to another query on he EDLs. We briefly looked at mindmeld.

BraveTiger · ‎02-20-2020

The phone got registered it's working fine. I allowed WEB BROWSING, SIP, SSL, TFTP and SERVICE: TCP 6950, TCP 8443, TCP 6970, TCP 2445, TCP/UDP 5060 Thank you for your assistance

eveares · ‎02-13-2020

I should mention that what I want to do, we are currently doing with another/2nd PA-220 that we have that handles both the 1) gateway for our public Wi-Fi what 2) also feeds our main checkpoint firewall for another connection on the Checkpoint. But in that case the Wi-Fi (using the PalAlto as the layer 3 router) and the connection to our Checkpoint Firewall (via a layer 2 to layer 3 connection on the Palo Alto) are using completely different subsets with their own distinct gateway. I was hoping I could do the same thing with the PaloAlto PA220 that handles the SIP traffic and the Layer 2 connection from the unmanged switch to the Checkpoint firewall that both use the same subnet as originally proposed in this thread. Regards: Elliott.

RobinClayton · ‎02-12-2020

"Monitor", "Mirror" or "SPAN" are the general terms your probably looking for.. All our switch traffic is mirrored out to the PA Tap interface for inspection.

BPry · ‎02-06-2020

@URAN_725, Specifically the filter that you are looking for is ( eventid eq link-change ) within the system logs; this will display any Up/Down event on a connected interface.

RobinClayton · ‎02-06-2020

If one connects and the other does not then it's not the user itself. Ensure CIMv2 is setup correctly as that's one usually missed. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0

reaper · ‎01-30-2020

as long as one device is at a higher version, it will be 'non-functional' and the lower version member will be active preemption will not interfere here the only way to change that is by suspending the passive member, so you can upgrade it while the already ugraded member takes the traffic as soon as you unsuspend the lower version member it will take on the active role

jeremy.larsen · ‎01-30-2020

Agreed! SFTP is just an FTP feature traversing over SSH. They are essentially the same protocol. You would have to have some crazy man-in-the-middle encrypt/decrypt to even attempt this. This sounds a lot like security engineer over-reach or misunderstanding of protocols.

Danitoni · ‎01-29-2020

Hi @OtakarKlier Thank your for your feedback, am I correct to assume you are allowing using service and URL category on security policy without URL filtering security profile and you also have a generic internet rule below that rule that is using URL filtering security profile?

BPry · ‎01-29-2020

@RobinClayton, Keep in mind that depending on your actual firewall configuration, you may not be recording the logs for this traffic. You'll want to ensure that you have your security rulebase and routing setup so that the firewall sees and logs this traffic. Alternatively, since you are now sourcing the traffic to from your untrust interface you can start a PCAP and look for the traffic.

RobinClayton · ‎01-29-2020

I have had 1.0.105 installed for a while .. I know it has some inconsistencies and wondered if an update may fix these. But when I go to update tab it just tells me I need a FW rule. That's there, but how do I force an update? All I see in the FW log is blocked NTP requests ( It's trying the Canonical Default ) and some Snapcraft.io SSL requests. Cheers Rob

vsys_remo · ‎01-27-2020

Probably the most secure way is to distribute a local firewallpolicy by GPO that blocks outbound access for the internet explorer process. This way you can still allow the access to internal websites or also specific websites in the internet (as long as they have static IPs).

hbakka · ‎01-27-2020

Hi, Thank you for your solution. I did read on the previous documentation you sent me about upgrading straight to 8.1. I will try that. Thanks guys,

Luke_R · ‎01-23-2020

Thanks. Next time this happens I will do the packet capture. I tried to replicate the issue on my laptop, but I haven't been able to. I haven't heard any reports of this happening to anyone else since I posted this either. It's possible that the issue was something else, not PA. I'll just have to wait for the next report I guess.

DPoppleton · ‎01-16-2020

Me too. We had 16 out of 18 firewalls not updating, but they all grabbed the last update without a problem.

Raja3000 · ‎01-15-2020

Thanks OtakarKlier

RobinClayton · ‎01-14-2020

What's Missing??? Also Try a manual backup export from DC2 Rob

Nizmytom · ‎01-10-2020

This is the url: https://papirtigris.com/ We found it. It does not show us " categorize" is no solved. But its allowed in DC as well as branch but its not working only in branch so, we re-categorize it via cli and it started working.. But not sure why it did not show in traffic logs. Thank you for all your help 🙂

OwenFuller · ‎12-04-2019

@RobinClayton wrote: The SUBNET on the V-Wire is on the same IP range as the management interface, but should that be an issue??? No, I've done several VMs where the mgmt inerface is in the same range, though w/ L3 interfaces, not v-wire. I was just assuming it was a new VM, and wanting to make sure you took that into account when adding virtual interfaces. Glad you got it sorted.

RobinClayton · ‎12-04-2019

# Retrieved: 04 Dec 2019 10:48 This is at the start of the list, that's probably causing a parsing failure.

hdaigle · ‎11-12-2019

This is not in service yet. I have it on my desk and I will try your suggestions. I guess I really should have asked if the firewall blocks everything by default in its off the shelf configuration but it looks like it does. Thanks for the help.

OtakarKlier · ‎11-07-2019

Hello, We are running 9.0.4 and no issues. However we dont have any of the items that are having issues in the release notes. Always read the release notes! Cheers!

s_quasar · ‎10-22-2019

Hi, about the logs firewall. Is there a feature to activate to view in monitor these specific activities? I see nothing in monitor -> logs -> traffic.

RobinClayton · ‎10-14-2019

Hmm... SIEM is not implemented yet although it's budgeted and we have gone through the entire selection process.. It's just queued down the project list.. Will have to have a think.

Date Registered	‎08-25-2017 12:46 AM
Date Last Visited	2 weeks ago
Total Messages Posted	260
Total Likes Received	34

Online Status	Offline
Date Last Visited	2 weeks ago

Strata

Prisma

Cortex

About RobinClayton