About reaper

reaper

The content engine queue is getting full This could be due to too many small/large packets or other issues (fragmentation,...), but you used the drop filter again so there's not enough information to make an educated guess Please try > Debug dataplane pool statistics

reaper

yes

reaper

are you triggering anything in the threat log ?

reaper

this means you enabled or changed the action on the 'palo alto networks dns security' option in DNS signatures of one or more of your spyware profiles you should set it to 'allow' with no packetcapture if you do not have a license

reaper

you can avoid asymmetric routing by not deploying in Active/Active 😉 do both datacenters need to be 'hot' or is there one warm standby? do both need active connections to the outside and will the bandwidth needed exceed the VXLAN/EVPN capability? I'd try to void A/A as that complicates your configuration tremendously with very little ROI (you'll also need to enable HA3 and make sure jumbo frames are supported over the VXLAN/EVPN etc)

reaper

Stats dump needs to be generated for each vsys, so it will take more time for every additional vsys You cant decrease the time, but you could try to generate the report at a time when the load on the device is low so it has more available resources

reaper

Please post the global counters without the drop filter

reaper

@Jafar_Hussain there are several settings that can be set to be less strict (timers, out of window/order packets,...) So network problems are allowed to happen rather than prevented. We'll need to find the global counters you do see to properly advise what to try. Please share the global counters seen

reaper

@Jafar_Hussainwhich counters did you see? It sounds like a network issue you may be able to workaround by relaxing the firewalls tolerance if you are unable to address the network latency

reaper

Global counters should help with this It sounds like there may be packets sent out of order or out of window that the firewall is discarding

reaper

The drop stage captures packets that the firewall discards This could be through policy action, threat detection, or packet malformation

reaper

Setting everything to 0 is the same as having no profile You won't get locked but why would you set it up this way?

reaper

It is a strict minimum If you need less, you will need to set up a panorama in legacy mode (pre 8.1 PAN-OS) and the upgrade

reaper

@raji_toor you need to add the serial number of the firewall after that command >show logging-status device Serial 000123456789 Your log partition is fine: /dev/sdb1 1.7T 77M 1.7T 1%

reaper

You cant scp to a windows machine You can either collect the file from the web interface, or tftp to a tinyftp on your windows machine Set up a Linux machine to access scp if you need to use scp

reaper

You can ask your sales team for a 30 day trial license

reaper

which version of GlobalProtect are you installing? 5.0.4 is the minimum but 5.1.3 may be worth a shot

reaper

it won't boot if the minimum requirements are not met

reaper

there are a bunch of built-in reports that run automatically

reaper

At 2020-05-10 04:43:52.294 your temperature warning was tripped Ensure the device is properly ventilated and there is no dust in the fans Verify the traffic going through the firewall at that time, was the load unexpectedly high? Was the datacenter room temperature unusually high during that time? Also make sure it is not sitting on top of a server that was running very hot and "cooking" the firewall

reaper

If you do not expose your management interface to an untrusted network (make it accessible inside MGMT network, set an ACL,..) you will be able to mitigate most exposure If you must make the interface available, ensure connections need to traverse the firewall so you can apply security profiles to the connection

reaper

if a vpn tunnel goes down the interface is not necessarily 'down', a monitoring profile set to 'failover' will bring it down routes on an interface will stay in the routing table as long as the interface is up, when monitoring brings down the interfaces, the route will disappear and the next lowest metric will pick up the traffic (tunnel 2 with a higher metric)

reaper

Thanks Jedi_D L L2 Linker 😉 (The L7 thing is my community rank, not my name 🙂 ) That would mean pbf is not hit and then nat is applied on the default route egress, unless the session goes through the firewall twice and is picking up NAT in a different session? Did you set a next hop IP so the session can get routed out or is the destination located on the interface subnet?

reaper

NAT is performed after PBF, as it can only be applied after the egress interface is determined (so after pbf and route lookus) how did you configure your PBF rule? did you add an application as a match condition? (as that will have an impact on how pbf is able to intercept and redirect sessions : it doesn't know what an application is by the SYN packet so it first needs to determine that)

reaper

the certificate cn should be something you can identify as yours if you need to do troubleshooting, but with selfsigned certificates it only matters that the selfsigned CA is added to your client's trusted root certificates store, else they will get a certificate error for each website

reaper

Is it possible that your firewall has been connected to a different panorama, or objects were removed from panorama and never committed somehow...

reaper

Sounds like a pa-820 would do the trick 😉

reaper

With physical interfaces you mean ethernet1/x? (Tunnel interfaces are virtual) -yes, unnumbered means no ip assigned -10.10.1.4/30 and 10.10.1.0/30 are unusable addresses (broadcast and network) The usable ips in that subnet are .1/30 and .2/30 So if the local interface has .1 then the remote should use .2 and monitor would go to .2 -the ipsec packets will happen between the physical ethernet1/x I terfaces, typically untrust to untrust. Intrazone will take care of that (but I do recommend making explicit rules and blocking untrust to untrust at the end) - the tunnel traffic will come from and will go to the virtual tunnel interfaces' zone Hope this helps

reaper

Yes

reaper

@karthikeyanB This is not possible, you can't span from the firewall to somewhere else The only thing that comes close is the decryption port mirror, but that applies only to decrypted ssl/tls Alternatively you can log export syslog which could feed a NAC user-ip mappings

Date Registered	‎11-16-2010 12:55 PM
Date Last Visited	Saturday
Total Messages Posted	4,073
Total Likes Received	1223

Online Status	Offline
Date Last Visited	Saturday

Strata

Prisma

Cortex

About reaper