Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About Shuttermed
About Shuttermed
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
04-01-2019
27Posts
2Likes
0Solutions
Apr 01, 2019Last Visited
User
Activity
User
Profile
Latest posts by Shuttermed
| Subject | Views | Posted |
|---|---|---|
| 389 | 03-29-2019 03:54 PM | |
| 954 | 03-18-2019 01:41 PM | |
| 957 | 03-08-2019 01:22 PM | |
| 859 | 03-07-2019 08:37 AM | |
| 878 | 03-06-2019 05:33 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 02-21-2018 05:02 PM | |
| 1 | 02-20-2018 12:22 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 2 | |||
| 1 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 09-29-2017 09:54 PM |
| Date Last Visited | 04-01-2019 02:57 PM |
| Total Messages Posted | 27 |
| Total Likes Received | 2 |
03-29-2019
03:54 PM
I noticed that in some of our SOHO sites, the tunnel interface for VPN to the data center has an IP address and in other cases it does not. Can someone explain the value of having an IP address on the tunnel interface versus not? I'm working through an arp cache issue that arises on a SOHO site which does not specify an IP address but the site with the IP defined does not run into the same issue. It's long so I won't get into it here. A further oddity is that the PAN in the data center - it's route to the SOHO has a destination of the tunnel interface (tunnel.1) but no next hop IP address is defined, although the tunnel interface does have an IP address assigned to it. Then on the SOHO side, the route to the corporate network has the tunnel interface specified *and* a next hop value of the IP address of that same tunnel. Insight appreciated.
... View more
03-18-2019
01:41 PM
An intriguing feature of PAN OS 8.0.9 is the ability to commit your own changes as opposed to all candidate config. This would be great because it's often that two or more engineers will have changes that overlap pending the approval chain. But if I click on Commit Changes Made By (my user ID) - and then try to Preview Changes, I get an error like: Preview-Chg Status Completed Result Failed Details This operation is blocked because of following changes by other administrators: WorkAway-17 modified by babadoo in vsys vsys1 rulebase security rules To proceed with the operation, please select all of these administrators Because the preview doesn't work for the individual user, I haven't pressed ahead to actually commit my changes. Is it the case that Commit works but not the Preview Changes? Or is the whole thing just not ready for prime time? Or could I be misunderstanding the purpose and value of the Commit Changes Made By: widget? Thank you.
... View more
- Tags:
- 8.0.9
- commit changes
03-08-2019
01:22 PM
I have a long open issue with PAN TAC where the PAN 5060 is sending traps when detecting an issue with HA secondary availability. The HA is fine so these messages are just spam for practical purposes. Is there a means to disable these specific traps?
... View more
- Tags:
- 5060
- disable Traps
- ha
03-07-2019
08:37 AM
Interesting. It appears to be intermittent as today I can see the user is logged in and their Source User domain and username are being picked up. Thanks much.
... View more
03-06-2019
05:33 PM
I have a user with Windows 7 and Global Protect who couldn't get to an internal web site. When I went to look in Monitor/Logs/Traffic I could see that the Source User field was blank and therefore not hitting the anticipated allow policies. He says it's a corporate laptop. Any other common issue that would prevent the domain/user ID from being recognized? Thank you.
... View more
02-26-2019
10:20 AM
I'm working with a business partner and we've verified phase 1, phase 2 parameters. But this is what I'm seeing in logging after running test vpn ike-sa gateway: 2019-02-26 09:57:21.638 -0800 [PERR]: { 43: }: 77.77.236.54[500] - 207.99.97.218[500]:(nil) invalid ID payload. 2019-02-26 09:57:23.588 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. 2019-02-26 09:57:25.587 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. 2019-02-26 09:57:28.588 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. 2019-02-26 09:57:33.372 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. 2019-02-26 09:57:41.587 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. ====> Failed SA: 77.77.236.54[500]-207.99.97.218[500] cookie:be99ab966426dfa8:5f94b48191d27d6d <==== Due to timeout. ====> Deleted SA: 77.77.236.54[500]-207.99.97.218[500] cookie:be99ab966426dfa8:5f94b48191d27d6d <==== ====> Initiated SA: 77.77.236.54[500]-207.99.97.218[500] cookie:025d4c7c02ae26be:0000000000000000 <==== I've googled the "invalid ID payload" message but I'm not seeing much. Anyone have a thought as to what that's indicating?
... View more
- Tags:
- Cisco ASR 1001x
- ipsec
11-24-2018
04:03 PM
In some of our firewalls I note a secondary IP address is assigned to a single HA group ID. What is the value of having this second IP? The problem it's introducing is that SNMP Traps are getting gerated once or twice a day noting that the secondary IP address couldn't be reached. But there is never a problem with HA failing over - the primary is always reachable. So what is the value of this secondary IP address (to me it just seems like noise potential.) Anyone run into this situation? Enable HA x Group ID 1 Description Mode active-passive Enable Config Sync Peer HA1 IP Address 172.19.6.1 Backup Peer HA1 IP Address 172.19.7.1
... View more
11-20-2018
01:02 PM
What feature on the PAN 5060 lets you see which address pairs are consuming the most bandwidth?
... View more
07-25-2018
10:36 AM
The bpartner just told us SFTP. But maybe that's the issue.
... View more
07-24-2018
12:04 PM
I have an egress rule that permits port 22 which should include sftp. And for the most part it works. But I had a user go to a particular sftp site useing filezilla and the PAN 5060 identified the traffic as "Enhanced File Transfer" and the traffic didn't hit the egress rule and was blocked. Why would filezilla/winscp work fine - seen as plain ssh traffic - to most sites. But for one particular site it fails with the PAN seeing it as "enhanced file transfer"? Is there any work-around the client can do? It's an easy fix on my PAN but change control takes time and I'm lazy. THX
... View more
06-08-2018
12:11 PM
We had a bunch of users loose connectivity from VPN at the same time. But our BGP connections and all network connections were fine. What steps can be taken after-the-fact to verifify if the PAN 5060 in fact caused the issue?
... View more
04-13-2018
01:34 PM
I see there is an FQDN option for Destination Address when I create a security policy. I want to permit port 993 to any host in office365.com. Will it work if I just put office.com in the FQDN destination? Trying to put the * wildcard causes the widget to gray out the OK button. Thanks!
... View more
02-21-2018
05:02 PM
1 Kudo
And after all that - we tested at another time with another machine and got smooth live video via the PAN. So it's looking like it could be an issue of non-guaranteed interwebs or local machine or who knows what. But our infrastructure is way over built so it's not saturation and now not likely the PAN. So no need for the costly NAT router. Woot.
... View more
02-20-2018
12:22 PM
1 Kudo
Hey - don't rub it in. 🙂 Thanks.
... View more
02-20-2018
09:26 AM
I mean to allow the traffic to be NATted but don't inspect the traffic at layer 4 say for proper sequencing and other typical layer 4 inspection. It's something I was requested to do and will likely not do. But I want to know if you even wanted to do it could you make a specific traffic like pass through like a router with NAT?
... View more
02-20-2018
09:13 AM
I had a request to turn off not only layer 7 inspection (which I understand can be done with an application override) but to turn off all inspection such that the flow only NATs?
... View more
02-16-2018
04:17 PM
The utilization on the PAN 5060 is low - peaks at 600Mbps on a 10Gbps interface. QoS is not currently setup. I don't see anything blocked in the traffic flow. The traffic is identified as ms-lync-online at port 443.
... View more
02-16-2018
01:27 PM
The application is Skype for Business Online video conferencing. When egressing the PAN the video his herky jerky and hard to watch. In contrast over the highlatency and lossy MiFi the playback was nice and smooth. Testing this without the PAN is difficult for logisitcal reasons and security reasons. So my goal is to make the PAN as much of a passive factor as possible. But if you have an ideal on making the Skype video better - yes please!
... View more
02-16-2018
12:22 PM
The deal is that our IT group is experiencing choppy video when that traffic goes out the PAN but if they run a video conference out of MiFi there's no chop despite even worse latency and max packet loss. I'm trying to rule in or rule out the PAN as a possible culprit and thus trying to let the traffic move through the device with as little processing as possible. I was going to use Application Over-ride when one of our internal people suggested this was doable with just a security policy. If that's mistaken or if you have any other approach to minimizing the impact of real time packet flow through the PAN I'm all ears.
... View more
02-16-2018
11:54 AM
If I wanted no layer 7 inspection for a particular IP at a certain port - how can I do that without Application override? Thank you.
... View more
02-13-2018
09:38 AM
Skype video calls are often described as choppy. The sysadmins who admin skype for business online are point the finger at the PAN 5060. It is not configured for QoS but it's only processing 600Mbps tops and typically around 400Mbps. What might be some means to rule-in, rule-out the PAN? Thank you.
... View more
02-13-2018
09:37 AM
Skype video calls are often described as choppy. The sysadmins who admin skype for business online are point the finger at the PAN 5060. It is not configured for QoS but it's only processing 600Mbps tops and typically around 400Mbps. What might be some means to rule-in, rule-out the PAN? Thank you.
... View more
01-23-2018
12:16 PM
With PAN - if I have a client who wants to his a public IP address when their traffic passes through the inside/private interface - what would the NAT look like? E.g. say outside/untrusted IP address is 67.1.1.1 and NATs 1:1 to 10.10.4.5 which is reached via the inside/private interface for any port. Now a user at 10.10.40.47 wants to hit 67.1.1.1 and their path takes them to the inside/private interface of the PAN. What NAT configuration would allow this to work? Some kind of hairpin? Any insight appreciated.
... View more
10-28-2017
12:16 AM
On the PAN 5020 I can see in logging that user successfully authenticates with MFA and radius but within a second it says the user has logged off. I know that in fact the user did not log off. I hope to grab some logs at the client next week. But I figured I'd ask the hive mind if anyone has ever seen this symptom and what they found. Thanks.
... View more
10-25-2017
06:40 PM
How can I look up when all a Global Protect user connected and disconnected from a PAN firewall? Thank you.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
