About jesuscano

Hi,   we have to add SNMP profile traps config to cluster PA. This cluster is managed by panorama and have the most of the config done in panorama. So we are thinking to add this snmp traps new config directly in the FW, so it would any issue is we apply a commit in the fws for not using panorama? . we are afraid to overwrite panorama config ... View more

- Being in different versions of Panorama (9.0.4) and PaloAlto (8.1.13), is it possible to deploy GlobalProtect clients? It does not work and I wanted to confirm this information - Is it possible to publish the linux version in the global protect portal? In the panorama these versions appear but not in the nodes? ... View more

Hi,   We are SNMP monitoring the number of users connected by GlobalProtect Gateway. Sometimes we see how the graph goes to 0 and recover the value some minutes later. No issues were reported by users connected by SSL-VPN.  So we are investigating if this is a issue about SNMP, GP service, etc... Going to snmp.log we dont see anything about problems with snmp daemon.   At 10:30am aprox the issue happened       Going to system logs the only thing we see is about "ras initializating". So i dont know if this issue with the graph was caused about this event.     Why this rasmgr daemon is initializating? what this daemon does? is this a bug?  ... View more

Hi,   Is there any way to take a pcap in plain text about a VPN-SSL connection?     ... View more

Hi,   We have two GP gateways configured in our PA. We realised that the passive PA unit, we can see "remote users" connected. Why is this? It shouldnt be asumme all GP user sessions in the active unit?   On the another hand, what is the OID (SNMP) to get tha value total users connected per GW? is that possible? ... View more

Hi,   We were checking the GP users in PA and we realise that the "Private IP Address" for some users is 0.0.0.0. Another users have the correct private range (10.90.x.x). VPN is working fine but i would like to know why PA assigns 0.0.0.0 ... View more

Hi,   We have a VPN between PA and cisco router. THE VPN is UP but we are having a strange behaviour with Phase1 lifetime. WHen the lifetime phase1 expired (24hour), the phase1 goes down in CISCO side, and we need to renegotiate pahse1 in order to get up again. These are the events:   2020-03-02 12:05:13 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 1.1.1.1[500]-2.2.2.2[500] cookie:92d6267d5c224c97:fead51a58acac9ee <==== 2020-03-02 12:05:13 [INFO]: ====> PHASE-1 SA DELETED <==== ====> Deleted SA: 1.1.1.1[500]-2.2.2.2[500] cookie:92d6267d5c224c97:fead51a58acac9ee <==== 2020-03-02 12:05:13 [PROTO_ERR]: Informational exchange received from unknown peer. 2020-03-02 12:05:13 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:17 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:23 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:27 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:33 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:37 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:43 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:47 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:52 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=d0c0ffc7ac0c9b69 af758d9ad410ecec (size=16). 2020-03-02 12:05:57 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=f13db2278e1b896c e2a85802cec1c124 (size=16). 2020-03-02 12:05:58 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS RESPONDER, MAIN MODE <====   WE have DPD enabled with defaulte paramethers, Do you have any idea about this issue in phase1 ... View more

HI,   We have a alarm about ocuppation in root partition. I tried to delete any files to release memory but there is not any "big files", no cores, no pcaps, just some logs.   So how can i release memory for this partition? whats is a alarm value for this root?   Filesystem Size Used Avail Use% Mounted on /dev/md3 3.8G 3.3G 314M 92% / /dev/md5 7.6G 4.6G 2.6G 64% /opt/pancfg /dev/md6 3.8G 2.3G 1.4G 63% /opt/panrepo tmpfs 2.0G 210M 1.8G 11% /dev/shm ... View more

Hi,   Im having an issue upgrading PA. Im starting to think this is a config deployment issue. We have a cluster Active/passive. This FWs are connected to CISCO nexus. Both FWs are in differents datacenter. The FWs are in 8.0.13 and we are trying to upgrade to 8.1.10. The issue is that when we upgrade the passive node to 8.1.10 the VirtualWires (ae interfaces) are not getting up in nexus, we can see the VW OK in FW. And if we failover to the passive node upgraded we lost the service. This is the interface/Vw config:     ethernet1/5 68 1000/full/up  ethernet1/6 69 1000/full/up  ethernet1/7 70 10000/full/up  ethernet1/8 71 10000/full/up  ethernet1/9 72 1000/full/up  ethernet1/10 73 1000/full/up    ae1 16 1 vr:default 0 N/A ae1.110 128 1 untrust vr:default 110 1.1.1.1/24 ae1.111 129 1 untrust vr:default 111 2.2.2.2/24 ae1.112 142 1 untrust vr:default 112 3.3.3.3/24 ae1.170 133 1 trust vr:default 113 4.4.4.4/24 ae2 17 1 vw-in vwire:ae3 0 N/A ae3 18 1 vw-out vwire:ae2 0 N/A   aggregation groups: 3 ae1 members: ethernet1/7 ethernet1/8 ae2 members: ethernet1/9 ethernet1/10 ae3 members: ethernet1/5 ethernet1/6 Is there any limitation with ae interfaces in Virtualwire Palo Alto?. We can see the interfaces OK in Palo ALto, but in nexus the interfaces are down.    any idea?    ... View more

Hi,   I wanted to comment an upgrade issue that its making me crazy. We have a cluster A/P in 8.0.8, these devices are in diferents datacenter. We have tried to upgrade this cluster 2 times with no success. We upgrade the passive unit to 8.1.10 and everything is ok, but when we do the failover in order to put the upgrade node as active, all the VirtualWires interfaces are not working. We have 2 LACPs in VW in this PAlo Alto. So when the node is active in 8.1.10 the 4 VirtualWires interface stio working. Interfaces look UP. But we dont see any traffic.   Any known issue with 8.1.x and VirtualWire issue? any advice or action plan. We opened a TAC case but not a great help 😞 ... View more

Hi,   We just realised that our ESM shows "agnet service status changes": Disconnected->Unlicensed". But we have a current licenses. How can tshoot this issue?     ... View more

Hi,   I have a question related to Wildfire: We need wildfire statistics during the year 2019, inspected files, files with malware, files with grayware and files with pishing. Is there any way to collect this info? from PA or wildfire web? I can not find it 😞 ... View more

HI,   We have a VPN from PA to Oracle cloud. We realised that this VPN goes down each 8 hours and it takes so long to renegotiate. From Oracle side tells this: "  early November, OCI implemented enhancements to IKE, including support for additional DH groups and support for IKEv2. Consequently, the IKE proposal payload from OCI can exceed 1500 bytes. Due to this implementation, it is possible that the proposals become fragmented and some CPEs may reject them. Consequently, you will want to check your CPE's WAN interface and assess whether or not fragmented packets are accepted. If they are not, we encourage you to allow fragmented packets on that interface and let us know whether or not that resolves the problem. We will now await your reply regarding this matter."   So its there any action that we can perform in PA? ... View more

We have a legitime application which is running a script. This script and the chain is detected by traps as threat. So we would like to configure an exception for this     cmd.exe --> cscript //E:JScript //nologo "C:\ProgramData\signature\sign.bat"   So its possible to add this exception? where it can be configured? We want to do the exception in this script. ... View more

Hi,   We have a legitime application which is running a script. This script and the chain is detected by traps as threat. So we would like to configure an exception for this     cmd.exe --> cscript //E:JScript //nologo "C:\ProgramData\signature\sign.bat"   So its possible to add this exception? where it can be configured? ... View more

Hi, we are trying to generate a new elf-signed certificate in Panorama and we receive this error: Failed to insert certificate into configuration. Failed to find beginning of certificate. Make sure certificate starts with BEGIN CERTIFICATE tag.   This is the certificate and the error:       Why are we receiving this error?   ... View more