About theonewhoknocks

theonewhoknocks · ‎03-11-2020

Hi @BrandonTice When you ping via the CLI, you need to specify the where the ping will source/come from. PA-220#ping source x.x.x.x host y.y.y.y If the source is unspecified, the firewall will use its default "management inteface ip" See article below for more details https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk7CAC

theonewhoknocks · ‎10-13-2019

I actually tried to upgrade the firewall to 8.1.9-h4, but I still got the same error code after the upgrade-reboot. Port's don't go UP and the auto-commit process fails. I'm still trying to reach out support from our vendor as we don't have direct support from PA. Thanks for the suggestions.

theonewhoknocks · ‎10-11-2019

We upgraded the passive firewall on our Active/Passive HA firewalls from 8.0.19 to 8.1.0. After installing the 8.1.0 image, firewall rebooted. After that, ethernet interfaces as well as HA ports didn't go UP. We also got an error, that the auto-commit failed. "Error: Max. user groups used in policy 1067 exceeds capacity (1000)" Questions: 1. Ports didn't go up. Are they affected because the auto-commit failed? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQuCAK 2. Why we didn't get this error when we roll-back to 8.0.19 O.S.? I've raised the issue to our vendor, but still waiting for a feedback. Hoping from feedback from the experts here in live community.

theonewhoknocks · ‎10-11-2019

@reaper "previous version" you mean 8.0.17? Or all 8.0.x family doesn't enforced this device limit? I've also encountered the same issue.

theonewhoknocks · ‎03-01-2019

Currently, our palo alto only detects the following O365 applications *ms-office365 *outlook-web-online *sharepoint-online *ms-office365-base *ms-teams *ms-lync-online Do we need to enable SSL decryption so that it can detect other sub-applications? (ms-downloading, ms-uploading, ms-posting, etc.)

theonewhoknocks · ‎02-13-2019

Is it possible for each vsys to use a different HA port?

theonewhoknocks · ‎12-03-2018

Hi All, We want to block skype file transfer from our users. Checking on the application-list, I can only see Skype and Skype-probe. Here are my questions: 1. Is there a future plan to add additional skype sub-applications (skype-video-call, skype-file-transfer, etc.)? 2. Is there a work-around to block skype file transfer? Thanks and regards,

theonewhoknocks · ‎09-20-2018

Hi @MikeC, We're running this setup on one of our sites. Both VR has default routes pointing to each individual ISP GW. VR1 has my internal LAN segments and ISP1 interface. VR2 has only ISP2 interface. VR1 has a backup default-route pointing to next VR (VR2)

theonewhoknocks · ‎07-26-2018

Hi @VinceM, Which PAN-OS were you using when building this custom report? I cannot find "Repeat Count". I can only find "Sessions". I'm running PAN 7.1.16

theonewhoknocks · ‎05-22-2018

Hi @Radmin_85 Here's a guide we used on our site-to-site VPN with two ISP. I just followed the guide step by step. Hope this helps you! https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774

theonewhoknocks · ‎05-09-2018

Hi @jmarchant, from the switch perspective can you see that the port is (UP/UP)? Have you tried manually adding the mac address on the switch mac table?

theonewhoknocks · ‎05-01-2018

@OtakarKlier Port 1/1 - ISP B Port 1/2 - ISP A ping 'port 1/1 IP' host 'ISP-A DNS IP' --- success ping 'port 1/2 IP' host 'ISP-A DNS IP' --- fail

theonewhoknocks · ‎05-01-2018

@OtakarKlier no worries. Port Connected to ISPA is in up state. No logs is generated as I am using the eth1/2 as the source of the ping to reach the ISP-A DNS Server. Routes in the forwarding table: Default Route is via next VR (ISPB VR) ISP-A DNS Server via ISP-A Gateway

theonewhoknocks · ‎05-01-2018

Hi @OtakarKlier, No Dynamic Routes between VR's. Adding the specific /32 static route did not resolve the problem. Path Monitoring status is stil down.

theonewhoknocks · ‎05-01-2018

Update: Stand-alone test worked fine. Can reach the internet and the DNS of ISPA (monitored IP in path monitoring of default route) So I guess the problem is on the PA? Anything that I need to double check? Checking from previous logs, firewall was able to detect path failure and was also able to recover.

theonewhoknocks · ‎05-01-2018

I just added the specific /32 route going to DNS os ISP-A via the ISP-A Gateway. ping source eth1/1 (ISP-A port) host DNS of ISPA, fails now.

theonewhoknocks · ‎05-01-2018

Hi All, Here's my setup. ISPA (eth1/1) and LAN interfaces on one VR1 ISPB (eth1/2) on another VR2 VR1 Routes: -Default route (defaul admin distance, metric 10) w/ path monitoring (Monitored IP - DNS of ISP-A, source eth1/1, other settings default) -Backup default route to next VR (default admin distance, metric 20) -Specific /32 route of DNS of ISP-A to force it via ISP-A Gateway. -Tunnel Routes VR2 Routes: -Defaul route pointing to ISPB gateway -Return routes to LAN segments (via next VR1)

theonewhoknocks · ‎04-29-2018

Update on this. Current routing table is still via ISP-B. Upon using traceroute source x.x.x.x host y.y.y.y, I saw that the DNS Server of ISP-A is being reached via ISP-B. Do I need to put a specific static route pointing to DNS Server of ISP-A via ISP-A gateway?

theonewhoknocks · ‎04-29-2018

Default route via ISP-A (primary) has not yet recovered, even though the monitored IP address (DNS server of ISP-A) is already rechable via the interface connected to ISP-A router. (tested via ping source x.x.x.x host y.y.y.y) I have seen the logs from previous months that the firewall has detected path failure and was able to recover. So I assume the setup is correct? Any other troubleshooting that I can do? Or any other things to double check on my setup?

theonewhoknocks · ‎04-17-2018

@BPry We're really planning to upgrade all to 8.0.x. It's just that we have limited window time, so upgrades will be gradual. So I'm looking for a stable release for each major version. Thank you for the quick response!

theonewhoknocks · ‎04-16-2018

Hi, We have multiple firewalls with different version of O.S. Could someone give me a summary of recommended version/release per each major OS version? Like what would be the recommended version for the ff versions: 7.0, 7.1, 8.0? Thanks!

theonewhoknocks · ‎03-05-2018

I never really used the query builder. Will try to use it more now. Thank you for this! Cheers!

theonewhoknocks · ‎03-05-2018

This article is a detailed troubleshooting on a VPN setup. It helped me solve most of my VPN issues. Check it, it may help you. https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-IPSec-VPN-connectivity-issues/ta-p/59187

theonewhoknocks · ‎03-05-2018

Hi Zebit, What's the status of the VPN tunnel? Has it passed phase1-IKE? Can you ping the public IP of the remote site from the HQ firewall? and vice versa? You can look on this article to have a basic troubleshooting on which part of your VPN setup is not working. https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-VPN-IPSec-Tunnel-Status-is-Red/ta-p/79224

theonewhoknocks · ‎03-05-2018

Hi Reaper, Do you have a list? Or is there a documentation? For the list of "event types" on system logs. I only know the basics like, ha/vpn/system-shutdown.

theonewhoknocks · ‎03-05-2018

Hi Mickball, you are correct. Thanks!

theonewhoknocks · ‎03-04-2018

Hi Mickball, thanks for replying. I get your point. I have a user policy on top of my IP policy. For example Policy #1 User policy has hq\netengr1 and hq\netengr2 as source user, any as source IP Policy #2 IP policy has 192.168.1.0/24 source IP and any source user. hq\netengr1 uses the correct policy (policy 1). However hq\netengr2 traffic falls to policy #2, even if he's logged in using the correct account. That's my problem, any tips on where to check?

theonewhoknocks · ‎03-04-2018

Hi Otakar.Klier, thanks for replying. I'm already using those settings except for the User Identification Timeout. I'm still using the default of 45 minutes.

theonewhoknocks · ‎03-01-2018

We have an agentless User-ID setup. Firewall is able to pull user accounts from the AD. User-ID based policies were created on top of IP-Based policies. However, some user traffic can be seen using the user-id based policies, some users can be seen using the IP-based policies. This happens on all of my sites. Is this a normal behavior? Or is there something wrong on my setup.

theonewhoknocks · ‎02-20-2018

Hi, I'm also experiencing this on my PA 820. Did you found out the root cause?

Date Registered	‎09-05-2017 12:19 AM
Date Last Visited	‎07-22-2020 01:55 AM
Total Messages Posted	36
Total Likes Received	3

Online Status	Offline
Date Last Visited	‎07-22-2020 01:55 AM

Strata

Prisma

Cortex

About theonewhoknocks