About JoeAndreini

JoeAndreini · ‎10-17-2018

What version was upgraded from? are both ends running 8.1.1? Ho woften is adjacency flapping? Check the BFD configuration - The default settings changed in 8.1. I had an instance where one side was upgraded and the other was not, and OSPF would come up until the BFD timers expired, then flap with similar messages.

JoeAndreini · ‎10-05-2018

Did you try setting duplex auto on cisco or duplex full on palo alto? IIRC it must be auto or not on both sides.

JoeAndreini · ‎10-03-2018

Append "&vsys={vsys_name}" to your request to target a specific vsys This should work for any op command in a multi-vsys system in your example: https://<IP_address>/api/?type=op&cmd=<SOME_COMMAND_HERE>&key=<API_KEY>&vsys=vsys1

JoeAndreini · ‎08-31-2018

Maybe the far end does not have the hardware to support encryption? Just a guess at one possible reason. I once had a tunnel to Verizon Wireless for an M2M solution and they specified GRE, would not or could not do IPSEC.

JoeAndreini · ‎08-29-2018

That information is not written to a log file, as far as I know. As a workaround, you may be able to define custom applications that identify the different versions from header information, and report on the use of those...

JoeAndreini · ‎08-29-2018

My guess would be they wanted a logging profile on the default rules and did not know how to override them...

JoeAndreini · ‎08-28-2018

unless you traceroute or ping with the source argument, it is management traffic and will go out the management interface. traceroute source <source IP address> host 8.8.8.8 When I describe user traffic, I mean traffic from one zone (trusted likely) to another (untrusted likely)

JoeAndreini · ‎08-28-2018

I assume you mean management traffic - device updates, licensing, etc. and not user traffic. By default all management traffic exits via the management interface. If you want it to exit another route, this can be configured via Service Route Configuration (Device -> Setup -> Services) If it is what you are intending to do, I recommend against having this traffic exit directy to an untrusted network. Instead, have it exit to an internal network, then traverse back through the firewall to be scanned, just in case something nefarious is going on.

JoeAndreini · ‎08-24-2018

Have you tried rebooting or to make them functional from operational commands? In my experience, when multi-vsys is enabled on an online HA pair this hapens every time - I suspect they suspend themselves due to the mismatch after the first is set to multi-vsys and don't automatically check again after the second is set. Usually manually un-suspending them works for me.

JoeAndreini · ‎08-23-2018

There appears to be a syntax error in your request, as you have a hanging ")" after Donkey. I do not know exactly what is wrong, but my guess is it is related to that one or the prior one, maybe it should be text('Donkey') instead of text(), 'Donkey'

JoeAndreini · ‎08-23-2018

With the topology in the diagram, you would need link and path monitoring to force a failover in the event of a router failure (internal or external) Your proposed physical links could remove that requirement, given you have enough interfaces to support it. I do not know offhand why PAN suggests this topology over your proposal.

JoeAndreini · ‎08-22-2018

or use scripting-mode : set cli scripting-mode on I never remember this exact command and often just paste 20 lines at a time rather than google it..

JoeAndreini · ‎08-22-2018

I've done this two ways, depending on how many times it will need to be done. The way i've done it when tehre are many firewalls or device groups to update is via scripting and teh XML API - I pull the policies with powershell, iterate through the policies adding the profiles or profile group, then push them back to teh firewall or panorama. it's pretty quick. If there is only one or two to do: log into the CLI issue the command "set cli config-output-format set" so that when you view the configuration it give set commands enter edit mode "show vsys vsys1 rulebase security | match 'action allow'" - this should give you a "list" of your rules, copy that to a text editor, so you can repalce "action allow" with 'profile-setting group "<your profile group>"' or the appropriate command to set the profile(s) you want. paste the commands back into the firewall - be aware the buffer is relatively small, take 10-15 lines at a time

JoeAndreini · ‎08-09-2018

You should be able to append "&vsys={vsys_name}" to your request to target a specific vsys This should work for any op command in a multi-vsys system

JoeAndreini · ‎08-03-2018

your "external" aggregate interface will not work as you expect, it will need to be two separate interfaces, one to each SSG. Or there will need to eb a switch between the NGFW and the SSG(s)

JoeAndreini · ‎08-02-2018

Is there any sort of file blocking or threat/virus/spyware profile on the policy that would normally allow this connection? which log is this snippet from? what are teh headings on the columns?

JoeAndreini · ‎08-02-2018

Your switch must support it and be configured as such. An unmanaged switch would not have that capability.

JoeAndreini · ‎07-31-2018

@Philip_Wiberg wrote: What happens with the address objects during the move? What is the error? You can always extract the set commands from the cli: > set cli config-output-mode set > configure # show device-group <DG-Name> address Then replace the incorrect Device Group with the new Device Group name and just paste them in, in case you need a second way to do it. I find this the easiest method for most people. editing teh XML is powerful, but many people find it intimidating and it can be easy to make a mess of it for the inexperienced. Most network admins/engineers are familiar and comfortable with "set" commands and editing them.

JoeAndreini · ‎07-30-2018

If you know the URLS, and they are being categorized incorrectly, why not create a custom category for them and allow it?

JoeAndreini · ‎07-30-2018

Looks like you have policies that are targeted to only specific firewalls - those policies will need to be modified to remove those targets in panorama

JoeAndreini · ‎07-26-2018

Panorama is meant to be a single (or HA pair) centralized point of mangement. You would install one at a centralized location, either nearest your management personell or at a location with the best connectivity to the remote loactions

JoeAndreini · ‎07-25-2018

Some people have had firewalls more tha none year. Particuarly in the case of system logs, where there are not so many entries, the year is important. I have devices that have logs reaching back to their installation date, and it is not obvious what year a log is from.

JoeAndreini · ‎07-25-2018

I do not have an instance to test, but you can create an O365 list in minemeld: https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Safely-Enable-access-to-Office-365-using-MineMeld/ta-p/120280 In the past I have used the API and a powershell script to pull the list from Microsoft and create a dynamic address list from that, here are a few articles to point you in the right general direction: https://support.office.com/en-us/article/office-365-urls-and-ip-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2 https://gallery.technet.microsoft.com/office/Get-Office-365-IP-v4-562987d5 A smiliar strategy could be used to dump the list to an EDL if you have somewhere available to host it.

JoeAndreini · ‎07-20-2018

A few things you migh tlook into: you could adjust the quotas (Device -> Setup -> Management, click the gear for Logging and Reporting) to add space to the quota for Traffic - you would likely have to remove it from somewhere else. or investigate exactly what is creating so much traffic that you are filling that log in one day - it may be illegitimate traffic or a misconfigured system. or, log less - are there any policies that do not need to be logged? maybe somethign that allows ping, etc? (this one may not be possible due to regulatory reasons, of course)

JoeAndreini · ‎07-19-2018

Is the Certificate signed by a trusted external CA? Make sure the root/intermediate certificates are in teh trusted root store.

JoeAndreini · ‎07-19-2018

Taht should be easy enough to determine, from the CLI execute the command show system logdb-quota Thsi will show the configured quoteas, then the disk usage and number of days retained - if the traffic usage is at or above the quota and only lists 1-2 days retained, you are using all of the allowed log space.

JoeAndreini · ‎07-19-2018

Unzip the package and import the certificates just as you did the server (your GP certificate) certificate, it will show a "tree" with the root and intermediate automatically, based on the information in the server cert.

JoeAndreini · ‎07-19-2018

it can be. your CA should have a package you can download with the root and intermediate certificates you can import to complete the chain.

JoeAndreini · ‎07-19-2018

Typical would be one or two years, sometimes three. That is really a policy question for the business - in theory having a certificate out there longer is a risk, but it is more convenient, and usually less expensive per year. The number of days in your CSR is typically ignored by the CA and replaced with whatever you pay them for.

JoeAndreini · ‎07-19-2018

Under Network -> GlobalProtect -> Portals -> (Your portal) -> Authentication, take note of the SSL/TLS Service Profile You should probably do the same for your Gateway, in case it is different Under Device -> Certificate Management -> SSL/TLS Service Profile -> (Profile from above), take note of the certificate This is the certificate used by your Portal or Gateway Under Device -> Certificate Management -> Certificates, locate this certificate, and click "renew" at the bottom of the screen to generate a new CSR, export the CSR, submit it to your CA, Import the new certificate (and signing chain, if it changes) Update the SSL/TLS Service Profile(s) with the new certificate(s) you can see the expiration dates of any certificates you have on teh Certificates page, in case any more are expiring soon. It often takes a few days to renew a certificate so it pays to be pro-active here

Date Registered	‎02-13-2018 08:21 AM
Date Last Visited	‎12-06-2018 09:36 AM
Total Messages Posted	82
Total Likes Received	21

Online Status	Offline
Date Last Visited	‎12-06-2018 09:36 AM

Enterprise

Prisma

Cortex

About JoeAndreini