Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About Gareth.Doyle
About Gareth.Doyle
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
02-11-2020
21Posts
1Like
3Solutions
Feb 11, 2020Last Visited
User
Activity
User
Profile
Latest posts by Gareth.Doyle
| Subject | Views | Posted |
|---|---|---|
| 400 | 02-07-2020 10:52 AM | |
| 423 | 02-07-2020 09:55 AM | |
| 1277 | 12-13-2019 05:05 AM | |
| 1351 | 12-12-2019 11:19 AM | |
| 1356 | 12-12-2019 11:07 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 10-25-2019 11:38 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 01-05-2018 02:57 PM |
| Date Last Visited | 02-11-2020 12:50 PM |
| Total Messages Posted | 21 |
| Total Likes Received | 1 |
02-07-2020
10:52 AM
@BPry, thanks. I agree that they should and are able to. They're wanting us to restart the management server so they can capture some information and evaluate that and determine root cause, my issue is mostly that this is third time this week this has happened. We have had too many issues lately (including a useless 7080) and it is getting frustrating.
... View more
02-07-2020
09:55 AM
For the last week or so we have been having issues with download jobs pending and failing in our Panorama. The issue is that there are 2500+ jobs pending on our Panorama and this seems to pop-up at any given time. TAC, to this point, has had us restart the management process, suspend that Panorama and fail over to the other... Until this happens on that one, then they want us to restart the management process, suspend that one and go back to the original. Has anyone run into this and have any suggestions as to what to check? I think it is Wildfire related, but there isn't a way to prove, or so it seems. Thanks.
... View more
12-13-2019
05:05 AM
Thanks, @ddelcourt. I'm fine with it not being a feature, I was just wondering if it currently was. I think it would be a nice addition for customers, especially running multiple HA pair, or for those extending their layer 2/3 networks using tools like VXLAN. Thanks for all of the responses.
... View more
12-12-2019
11:19 AM
@BatD, yes, the fix is simple. I was just trying to avoid the situation completely in the future. 🙂 Several other technology platforms have introduced a feature like floating IPs for their management appliances in the past couple of years and was hoping PA was up to par with them.
... View more
12-12-2019
11:07 AM
@BatD, I wish that was the case. Unfortunately the way PA had us configure them for their troubleshooting broke the HA completely and allowed users to add/edit/delete policies in the inactive device.
... View more
12-12-2019
10:12 AM
@BatD, I disagree actually and I will give you a working example. We have two of our Panoramas in an active/passive HA pair. We are currently having issues with our primary Panorama which PA engineering is researching, but cannot pinpoint an issue. It has been several weeks worth of research at this point. Several of the administrators have links, and several help pages have links, pointing directly to the one IP address which is typically the Active appliance. Yes, it is their fault and yes, it is their oversight, causing them to put firewall policies into the wrong Panorama device. However, this would not be an issue if a floating IP would direct them to the active unit.
... View more
12-12-2019
09:58 AM
Does anyone happen to know if it is possible to create a floating IP that will direct you to the active Panorama in an HA pair? So the floating IP would be 10.10.10.1 while the actual device IPs would be 10.10.10.2 and 10.10.10.3. This way the administrator will always go to 10.10.10.1, but they will always end up on the Active firewall in an Active/Passive HA pair. Thanks.
... View more
10-25-2019
11:38 AM
1 Kudo
I worked with TAC and found the best way (for me) to do this. I have written out the process below in case someone else may find it useful. Please keep in mind I utilize Panorama, so this is written for that. I can't speak to any differences there may be in syntax between Panorama and doing it directly on a firewall. Thanks. 1. Log into the Panorama GUI and create a local security profile for the VSYS you are working on. 2. Log into the Panorama CLI. 3. Enter command: set cli config-output-format set 4. Enter command: configure 5. Now we need to identify each rule that is utilizing the old security profile (in this case we'll call it OldSecurityProfile) so we run this next command. Please keep in mind that in this example the device-group (or VSYS) we will be working on is called Firewall-123, so wherever you see that referenced will need to be changed to match your needs: show device-group Firewall-123 post-rulebase security rules | match OldSecurityProfile 6. After running the previous command we found that the policy "Security Policy Name" is set to use the OldSecurityProfile security profile and we want to change that to the new “New_Security_Profile” security profile. set device-group Firewall-123 post-rulebase security rules "Security Policy Name" profile-setting group OldSecurityProfile 7. Now we delete the previous security profile in that rule and set the new security profile with the delete and set commands: delete device-group Firewall-123 post-rulebase security rules "Security Policy Name" profile-setting group OldSecurityProfile set device-group Firewall-123 post-rulebase security rules "Security Policy Name" profile-setting group New_Security_Profile 8. Now commit and push to the firewall.
... View more
10-24-2019
05:14 AM
That's a great suggestion, but I'm not sure the business side of things here would allow that. I can already hear their concerns going on in my head, but it is worth a shot. Thanks!
... View more
10-23-2019
11:28 AM
I received a request to change the current security profile on 3,502 policies (spanning three VSYS) from a shared profile to a local profile. Is there a better way to do this than doing them individually through the GUI? I don't even want to think about how long this would take if I have to do it through the GUI, not to mention the arthritis I'll have developed in my hand by the end of that. Thanks.
... View more
- Tags:
- Security Profiles
10-22-2019
11:07 AM
Yes, what I have learned is that after a major upgrade the HA keys are no longer referenced accordingly and must be manually exported and imported to restore this connectivity.
... View more
10-14-2019
01:11 PM
I upgraded a few pair of IPS/IDS devices last night and ran into an odd issue I haven't seen when upgrading other devices before. They run, typically, in Active/Passive mode, so when I upgrade I suspend one, upgrade, reboot, unsuspend it, and then repeat the process on the other device. Last night after I walked through this process the devices came active and stayed active, despite them both being up. I have had to suspend one of these IPS/IDS devices in several locations to ensure only one is active. Does anyone know why this happened and what the resolution may be? Thanks.
... View more
09-05-2019
09:27 AM
I have about 50 VSys and I need to pull all the firewall rules for a few different sources. Is there an easy way to pull a dump of these policies or do I have to manually go through the GUI for each VSys and filter for those sources? Thanks.
... View more
- Tags:
- policy dump
- vsys
01-09-2019
06:54 AM
Thanks for that, @LukeBullimore. The only issue I see is the total shown there only displays it per VSys, that is not a cumulative total. Do you know if there is a way to show that cumulative total? Thanks.
... View more
01-09-2019
06:32 AM
Hello, all. I'm trying to determine how many address objects and object groups I have across all of my VSYS on one of my platforms. I found the command to show the maximum allowed (see below), but not one that shows how many are currently there. Is there a command like this, or does anyone know of a way to do it that doesn't involve manually counting tens of thousands of objects? Thanks!
... View more
01-22-2018
06:07 PM
I ended up using this method: set cli config-output-format set configure set device-group <device_group_name > address < address_object_name> ip-netmask <ip_address/netmask> set device-group < device_group_name> address < adsdress_object_name > tag <tag_name> Thanks!
... View more
01-22-2018
04:55 PM
Is it possible to tail live traffic in the CLI while running a grep (or match) for specific things? I would find this extremely useful.. Thanks.
... View more
01-05-2018
03:00 PM
In my network we tag certain IP addresses for various reasons on our Palo Alto's. Sometimes we will get a large batch of these that need to be done and manually creating an address object and then tagging it via the GUi can be time consuming (to say the least). I'm wondering if there is a way to add these object groups and tag them via the CLI. I'm running a Panorama with an HA pair of physical boxes if that makes a difference. Thanks.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
