About Shuttermed

Shuttermed · ‎03-29-2019

I noticed that in some of our SOHO sites, the tunnel interface for VPN to the data center has an IP address and in other cases it does not. Can someone explain the value of having an IP address on the tunnel interface versus not? I'm working through an arp cache issue that arises on a SOHO site which does not specify an IP address but the site with the IP defined does not run into the same issue. It's long so I won't get into it here. A further oddity is that the PAN in the data center - it's route to the SOHO has a destination of the tunnel interface (tunnel.1) but no next hop IP address is defined, although the tunnel interface does have an IP address assigned to it. Then on the SOHO side, the route to the corporate network has the tunnel interface specified *and* a next hop value of the IP address of that same tunnel. Insight appreciated.

Shuttermed · ‎03-18-2019

An intriguing feature of PAN OS 8.0.9 is the ability to commit your own changes as opposed to all candidate config. This would be great because it's often that two or more engineers will have changes that overlap pending the approval chain. But if I click on Commit Changes Made By (my user ID) - and then try to Preview Changes, I get an error like: Preview-Chg Status Completed Result Failed Details This operation is blocked because of following changes by other administrators: WorkAway-17 modified by babadoo in vsys vsys1 rulebase security rules To proceed with the operation, please select all of these administrators Because the preview doesn't work for the individual user, I haven't pressed ahead to actually commit my changes. Is it the case that Commit works but not the Preview Changes? Or is the whole thing just not ready for prime time? Or could I be misunderstanding the purpose and value of the Commit Changes Made By: widget? Thank you.

Shuttermed · ‎03-08-2019

I have a long open issue with PAN TAC where the PAN 5060 is sending traps when detecting an issue with HA secondary availability. The HA is fine so these messages are just spam for practical purposes. Is there a means to disable these specific traps?

Shuttermed · ‎03-07-2019

Interesting. It appears to be intermittent as today I can see the user is logged in and their Source User domain and username are being picked up. Thanks much.

Shuttermed · ‎03-06-2019

I have a user with Windows 7 and Global Protect who couldn't get to an internal web site. When I went to look in Monitor/Logs/Traffic I could see that the Source User field was blank and therefore not hitting the anticipated allow policies. He says it's a corporate laptop. Any other common issue that would prevent the domain/user ID from being recognized? Thank you.

Shuttermed · ‎02-26-2019

I'm working with a business partner and we've verified phase 1, phase 2 parameters. But this is what I'm seeing in logging after running test vpn ike-sa gateway: 2019-02-26 09:57:21.638 -0800 [PERR]: { 43: }: 77.77.236.54[500] - 207.99.97.218[500]:(nil) invalid ID payload. 2019-02-26 09:57:23.588 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. 2019-02-26 09:57:25.587 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. 2019-02-26 09:57:28.588 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. 2019-02-26 09:57:33.372 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. 2019-02-26 09:57:41.587 -0800 [INFO]: the packet is retransmitted from 207.99.97.218[500] to 77.77.236.54[500]. ====> Failed SA: 77.77.236.54[500]-207.99.97.218[500] cookie:be99ab966426dfa8:5f94b48191d27d6d <==== Due to timeout. ====> Deleted SA: 77.77.236.54[500]-207.99.97.218[500] cookie:be99ab966426dfa8:5f94b48191d27d6d <==== ====> Initiated SA: 77.77.236.54[500]-207.99.97.218[500] cookie:025d4c7c02ae26be:0000000000000000 <==== I've googled the "invalid ID payload" message but I'm not seeing much. Anyone have a thought as to what that's indicating?

Shuttermed · ‎11-24-2018

In some of our firewalls I note a secondary IP address is assigned to a single HA group ID. What is the value of having this second IP? The problem it's introducing is that SNMP Traps are getting gerated once or twice a day noting that the secondary IP address couldn't be reached. But there is never a problem with HA failing over - the primary is always reachable. So what is the value of this secondary IP address (to me it just seems like noise potential.) Anyone run into this situation? Enable HA x Group ID 1 Description Mode active-passive Enable Config Sync Peer HA1 IP Address 172.19.6.1 Backup Peer HA1 IP Address 172.19.7.1

Shuttermed · ‎11-20-2018

What feature on the PAN 5060 lets you see which address pairs are consuming the most bandwidth?

Shuttermed · ‎07-25-2018

The bpartner just told us SFTP. But maybe that's the issue.

Shuttermed · ‎07-24-2018

I have an egress rule that permits port 22 which should include sftp. And for the most part it works. But I had a user go to a particular sftp site useing filezilla and the PAN 5060 identified the traffic as "Enhanced File Transfer" and the traffic didn't hit the egress rule and was blocked. Why would filezilla/winscp work fine - seen as plain ssh traffic - to most sites. But for one particular site it fails with the PAN seeing it as "enhanced file transfer"? Is there any work-around the client can do? It's an easy fix on my PAN but change control takes time and I'm lazy. THX

Shuttermed · ‎06-08-2018

We had a bunch of users loose connectivity from VPN at the same time. But our BGP connections and all network connections were fine. What steps can be taken after-the-fact to verifify if the PAN 5060 in fact caused the issue?

Shuttermed · ‎04-13-2018

I see there is an FQDN option for Destination Address when I create a security policy. I want to permit port 993 to any host in office365.com. Will it work if I just put office.com in the FQDN destination? Trying to put the * wildcard causes the widget to gray out the OK button. Thanks!

Shuttermed · ‎02-21-2018

And after all that - we tested at another time with another machine and got smooth live video via the PAN. So it's looking like it could be an issue of non-guaranteed interwebs or local machine or who knows what. But our infrastructure is way over built so it's not saturation and now not likely the PAN. So no need for the costly NAT router. Woot.

Shuttermed · ‎02-20-2018

Hey - don't rub it in. 🙂 Thanks.

Shuttermed · ‎02-20-2018

I mean to allow the traffic to be NATted but don't inspect the traffic at layer 4 say for proper sequencing and other typical layer 4 inspection. It's something I was requested to do and will likely not do. But I want to know if you even wanted to do it could you make a specific traffic like pass through like a router with NAT?

Member Since	‎09-29-2017 09:54 PM
Date Last Visited	‎04-01-2019 02:57 PM
Posts	27
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎04-01-2019 02:57 PM

About Shuttermed

What is the role of an IP address on a tunnel interface?

Pan Commit Changes By User

Is there a way to disable specific traps in PAN?

Re: Global Protect and no Source User Identified

Global Protect and no Source User Identified

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Re: Global Protect and no Source User Identified

Re: Global Protect and no Source User Identified

Re: What is the value of a Backup Peer HA1 IP Address?

Re: Finding the large bandwidth user

Re: Finding the large bandwidth user

What is the role of an IP address on a tunnel interface?

Pan Commit Changes By User

Is there a way to disable specific traps in PAN?

Re: Global Protect and no Source User Identified

Global Protect and no Source User Identified

Trouble establishing IPSec to Cisco ASR 1001X

What is the value of a Backup Peer HA1 IP Address?

Finding the large bandwidth user

Re: SFTP sometimes just hitting SSH app and sometimes Enhanced File Transfer

SFTP sometimes just hitting SSH app and sometimes Enhanced File Transfer

Debug steps for multiple users dropped from Global protect VPN at same time

Security policy that permits traffic to any *.office365.com ?

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Network Security

Cloud Security

Security Operations

About Shuttermed