LIVEcommunity - About AbdulRahman_Safwat

AbdulRahman_Safwat · ‎08-01-2019

Hey @shp555 , I would really recommend that you directly reach out to PAN support, as running changes on the DB can cause real issues if it was done wrong, they will provide you with the steps and the queries needed, and also will follow up with you if any issues happen. Regards

AbdulRahman_Safwat · ‎07-24-2019

Thanks @efrancis for the suggestion, however there is no disk space issues, anyways if it is disk space it should atleast timeout or show as failed, it seems that the job id is stuck, so I raised it with PA TAC, and indeed, they provided an SQL query which cleared the job, and the issue is resolved. But thank you for stopping by @efrancis

AbdulRahman_Safwat · ‎07-16-2019

Hello, I have an ESM that is showing "Tech Support File: Generating", I dont think it is related to a specific version, as upgrading or downgrading does not solve it, niether single or multi deployment, as I have tested it in both scenario, and it also never times out, even after a day. I have tried changing the timeout values in dbconfig, but still the issue is there, I dont even see the techsupport file in the forensics directory. I tried restarting the server, upgrading the console, restarting ESM services, restarting BITs service, restarting IIS application pool, restarting "www publishing services", but none of them seems to make any difference, the logs from the web logs show the following: 2019-07-15T14:34:30.4548+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.TechSupportFileManager General Start collection of tech support file, job id: 06131867-5675-4e3c-8a6d-adf1e3ce723c 2019-07-15T14:34:30.4699+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.Reporting.Reporters.MailReporter Forensic Email configuration: Host: , Port: 0, From: , To: , SSL: False, Timeout(s): 60 2019-07-15T14:34:30.6887+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.Reporting.Reporters.MailReporter Forensic Email configuration: Host: , Port: 0, From: , To: , SSL: False, Timeout(s): 60 2019-07-15T14:34:31.8587+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.Database.Caching.CacheCountWatcher General """CreateSupportFile"" version changed: 16 " 2019-07-15T14:34:31.8742+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner Action Working folder of the action runner is 'C:\Program Files\Palo Alto Networks\Endpoint Security Manager\Web\bin'. 2019-07-15T14:34:32.2640+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner Action External action ServicesList terminated on time with exit code 0. 2019-07-15T14:34:32.2640+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner General ActionRunner.exe for action 'ServicesList' terminated successfully. 2019-07-15T14:34:32.6539+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner Action External action DriversList terminated on time with exit code 0. 2019-07-15T14:34:32.6539+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner General ActionRunner.exe for action 'DriversList' terminated successfully. Thanks in advance

AbdulRahman_Safwat · ‎05-13-2019

Hello Community, On TMS the scheduled reports are not showing at all, and accordingly not being sent to the emails. Although the cofiguration is as simple as enabling the scheduled reports, are there any other config needed, or is anyone else facing this issue. Thanks

AbdulRahman_Safwat · ‎04-04-2019

Hello Community, I can see that the option "Block files with unkown Wildfire verdict" is grayed out in a wildfire profile under Examine Portable Executables and DLLs, is this an update in the feature, do I have a wrong configuration, or is it a bug or so. Thanks

AbdulRahman_Safwat · ‎03-30-2019

Thank you for the reply @gwesson, It is actually a local server, the user has also replaced it but the error is still there could it be something in the configuration of the server, or could it be a bug, I still need to confirm if it is happening on one PANOS or multiple. Thanks a lot

AbdulRahman_Safwat · ‎03-30-2019

Hello Community, I have posted this question before, and was told that it is a server error, I have replaced the server but with the same error, so I thought I would post it again, could it be somthing wrong with the server configuration, or could it be a bug. I am facing an issue where the External Dynamic List shows an error when tested by cli command "request system External-list show", the error is "HTTP response code said error", but whem the list is tested from any other device it is accessable and working fine, this list is a Domain list, and the PANOS is 7.1.7. Has anyone experienced this error befors, is it related to the firewall or the network, or is it from the server hosting the list. Thanks a lot

AbdulRahman_Safwat · ‎03-28-2019

Hello Community, I have came across a line in the Traps 6.0 Admin guide, but I feel that there might be a mistake, or maybe I am not aware with features introduced. As of my knowledge DLL files won't be quarantined, the release notes has this line: "Quarantine (and restore)—Limited to PEs from malware events (you cannot quarantine Microsoft Office files). Ondemand quarantine is not supported for Behavioral Threat events, however you can configure automated quarantine for Behavioral Threat Protection in your Malware Security profile." While the Admin Guide has the following line: "Quarantine—If a malicious PE or DLL is detected but Traps has not already quarantined the file, you can use this option to quarantine the malicious file and remove it from its working directory. " So am I missing something, or is it a little mistake, hope a TAC would come accross this post and confirm. Thanks and Regards

AbdulRahman_Safwat · ‎03-27-2019

Hello @Bstermer , Have got a reply from the TAC? If so, can you please share it. Thanks a lot

AbdulRahman_Safwat · ‎03-24-2019

Thank you @OtakarKlier and @MP18 for the replys, It is Active/Passive on the firewalls but LACP is Active on all components (PA HA and Switches). Passive link state is auto and the physical interfaces are up on the replica but AE interfaces are down, and on the switch that is communicating with the passive it is suspended. It seems that this is the normal behaviour, but will pre-negotiate turn it to up, or will it only show the partner's Mac address. Thanks

AbdulRahman_Safwat · ‎03-22-2019

Hello team, In an HA environment, with pre-negotiation for LCAP disabled , but passive link state set to "Auto" in the HA configuration, if all physical interfaces show as up, is the AE (Aggregated Interface) supposed to be up or down, as the partner (Cisco Switch) is showing suspended on the LCAP interface. Also from PA the CLi is showing no partner: AE group: ae1 Members: Bndl Rx state Mux state Sel state ethernet1/1 no Defaulted Detached Unselected(Link down) ethernet1/2 no Port Disabled Detached Unselected(Link down) Status: Enabled Mode: Active Rate: Slow Max-port: 8 Fast-failover: Disabled Pre-negotiation: Disabled Local: System Priority: 32768 System MAC: 00:56:4c:60:32:45 Key: 19 Partner: System Priority: 0 System MAC: 00:00:00:00:00:00 Key: 0 Port State -------------------------------------------------------------------------------- Interface Port Number Priority Mode Rate Key State -------------------------------------------------------------------------------- ethernet1/1 74 32768 Active Slow 19 0x45 Partner 0 0 Passive Slow 0 0x00 ethernet1/2 75 32768 Active Slow 19 0x45 Partner 0 0 Passive Slow 0 0x00 LCAP is configured as Active - Active between PA and Cisco switch. Is this the normal ehaviour, and a fail over will turn the interface up, or is there a misconfiguration or an issue here. Thanks

AbdulRahman_Safwat · ‎03-18-2019

Hello @m.hassan96, Active Directory is not a requirement for Traps deployment, and Traps will work fine without it. Active Directory can be integrated with Traps to authenticate ESM Administrators, and to use Active Directory objects, and also it will make it easier for big environments to push the certificates through a GPO if SSL is being used. But still it is not a requirement.

AbdulRahman_Safwat · ‎03-18-2019

Hello @sbecher11 , The compatability matrix is always up to date, so once there are changes, or new OS is added, you will find it on the same link. Or it will be announced in the release notes too.

AbdulRahman_Safwat · ‎03-18-2019

Hello @TimNie Indeed Starting from Traps 5.0, it is moved to the cloud through TMS, instead of the on-premise ESM, that is why you can't see any files for downloading on the portal, as the management is on the cloud, and the agents are downloaded from TMS too.

AbdulRahman_Safwat · ‎03-12-2019

Hello Community, I have an issue with the action rule not being pushed to the agents, as it is not either applied or delivered, at first it would show as all applied but zero is delivered, but now it is not being applied or delivered, I don't think that it is related to the version as I have tested and it happens on 4.1.5 and 4.2.3 and I believe 4.2.2 too, the common thing is that the port used to communicate with the agent is not the default port (2125), is there somthing that needs to be done when using a custom port, or is it a bug. The agents are obviously showing connected, and new policies are are being updated normally, even when the agent initiate the "Send Support File", it would be sent succsseffly, so I wanted to know the port that is being used for the action rules, also after analyzing the logs from both the agents and ESM I relaize that the action rule is associated with the URL https://ESM/EndpointSecurityManager/Update. So is this a bug, or misconfiguration. Thanks

Member Since	‎03-19-2018 05:35 AM
Date Last Visited	‎04-12-2020 06:21 AM
Posts	34
Total Likes Received	8

Online Status	Offline
Date Last Visited	‎04-12-2020 06:21 AM

Re: Traps ESM Tech Support file stuck at Generating

Re: Traps ESM Tech Support file stuck at Generating

Traps ESM Tech Support file stuck at Generating

TMS Scheduled report not running

Block unknown verdict grayed out in TMS

Re: Data Retrieval Download error

Traps ESM SSL Certificate Renewal

Re: Traps Endpoint Installation

Re: Traps Agent > 4 and ESM

Re: Impossible to uninstall by using the unistall password, version 4.2.39637

Re: Restore Quarantined file in Traps

Re: Traps ESM Tech Support file stuck at Generating

Re: Traps ESM Tech Support file stuck at Generating

Traps ESM Tech Support file stuck at Generating

TMS Scheduled report not running

Block unknown verdict grayed out in TMS

Re: EDL HTTP response code said error

EDL HTTP response code said error

Quarantine DLL - Documentation

Re: Traps 5.0 Scan - Why does it not quarantine dll and Office files?

Re: LCAP down on Passive Firewal

LCAP down on Passive Firewal

Re: Traps Endpoint Installation

Re: Windows Server 2019 Support

Re: Traps Agent > 4 and ESM

Traps Action rule not working

Network Security

Cloud Security

Security Operations