About AbdulRahman_Safwat

AbdulRahman_Safwat · ‎08-01-2019

Hey @shp555 , I would really recommend that you directly reach out to PAN support, as running changes on the DB can cause real issues if it was done wrong, they will provide you with the steps and the queries needed, and also will follow up with you if any issues happen. Regards

AbdulRahman_Safwat · ‎07-24-2019

Thanks @efrancis for the suggestion, however there is no disk space issues, anyways if it is disk space it should atleast timeout or show as failed, it seems that the job id is stuck, so I raised it with PA TAC, and indeed, they provided an SQL query which cleared the job, and the issue is resolved. But thank you for stopping by @efrancis

AbdulRahman_Safwat · ‎07-16-2019

Hello, I have an ESM that is showing "Tech Support File: Generating", I dont think it is related to a specific version, as upgrading or downgrading does not solve it, niether single or multi deployment, as I have tested it in both scenario, and it also never times out, even after a day. I have tried changing the timeout values in dbconfig, but still the issue is there, I dont even see the techsupport file in the forensics directory. I tried restarting the server, upgrading the console, restarting ESM services, restarting BITs service, restarting IIS application pool, restarting "www publishing services", but none of them seems to make any difference, the logs from the web logs show the following: 2019-07-15T14:34:30.4548+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.TechSupportFileManager General Start collection of tech support file, job id: 06131867-5675-4e3c-8a6d-adf1e3ce723c 2019-07-15T14:34:30.4699+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.Reporting.Reporters.MailReporter Forensic Email configuration: Host: , Port: 0, From: , To: , SSL: False, Timeout(s): 60 2019-07-15T14:34:30.6887+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.Reporting.Reporters.MailReporter Forensic Email configuration: Host: , Port: 0, From: , To: , SSL: False, Timeout(s): 60 2019-07-15T14:34:31.8587+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.Database.Caching.CacheCountWatcher General """CreateSupportFile"" version changed: 16 " 2019-07-15T14:34:31.8742+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner Action Working folder of the action runner is 'C:\Program Files\Palo Alto Networks\Endpoint Security Manager\Web\bin'. 2019-07-15T14:34:32.2640+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner Action External action ServicesList terminated on time with exit code 0. 2019-07-15T14:34:32.2640+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner General ActionRunner.exe for action 'ServicesList' terminated successfully. 2019-07-15T14:34:32.6539+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner Action External action DriversList terminated on time with exit code 0. 2019-07-15T14:34:32.6539+04:00 DEBUG w3wp 7 Cyvera.Server.Facades.DataCollection.ExternalActionsRunner General ActionRunner.exe for action 'DriversList' terminated successfully. Thanks in advance

AbdulRahman_Safwat · ‎05-13-2019

Hello Community, On TMS the scheduled reports are not showing at all, and accordingly not being sent to the emails. Although the cofiguration is as simple as enabling the scheduled reports, are there any other config needed, or is anyone else facing this issue. Thanks

AbdulRahman_Safwat · ‎04-04-2019

Hello Community, I can see that the option "Block files with unkown Wildfire verdict" is grayed out in a wildfire profile under Examine Portable Executables and DLLs, is this an update in the feature, do I have a wrong configuration, or is it a bug or so. Thanks

AbdulRahman_Safwat · ‎03-30-2019

Thank you for the reply @gwesson, It is actually a local server, the user has also replaced it but the error is still there could it be something in the configuration of the server, or could it be a bug, I still need to confirm if it is happening on one PANOS or multiple. Thanks a lot

AbdulRahman_Safwat · ‎03-30-2019

Hello Community, I have posted this question before, and was told that it is a server error, I have replaced the server but with the same error, so I thought I would post it again, could it be somthing wrong with the server configuration, or could it be a bug. I am facing an issue where the External Dynamic List shows an error when tested by cli command "request system External-list show", the error is "HTTP response code said error", but whem the list is tested from any other device it is accessable and working fine, this list is a Domain list, and the PANOS is 7.1.7. Has anyone experienced this error befors, is it related to the firewall or the network, or is it from the server hosting the list. Thanks a lot

AbdulRahman_Safwat · ‎03-28-2019

Hello Community, I have came across a line in the Traps 6.0 Admin guide, but I feel that there might be a mistake, or maybe I am not aware with features introduced. As of my knowledge DLL files won't be quarantined, the release notes has this line: "Quarantine (and restore)—Limited to PEs from malware events (you cannot quarantine Microsoft Office files). Ondemand quarantine is not supported for Behavioral Threat events, however you can configure automated quarantine for Behavioral Threat Protection in your Malware Security profile." While the Admin Guide has the following line: "Quarantine—If a malicious PE or DLL is detected but Traps has not already quarantined the file, you can use this option to quarantine the malicious file and remove it from its working directory. " So am I missing something, or is it a little mistake, hope a TAC would come accross this post and confirm. Thanks and Regards

AbdulRahman_Safwat · ‎03-27-2019

Hello @Bstermer , Have got a reply from the TAC? If so, can you please share it. Thanks a lot

AbdulRahman_Safwat · ‎03-24-2019

Thank you @OtakarKlier and @MP18 for the replys, It is Active/Passive on the firewalls but LACP is Active on all components (PA HA and Switches). Passive link state is auto and the physical interfaces are up on the replica but AE interfaces are down, and on the switch that is communicating with the passive it is suspended. It seems that this is the normal behaviour, but will pre-negotiate turn it to up, or will it only show the partner's Mac address. Thanks

AbdulRahman_Safwat · ‎03-22-2019

Hello team, In an HA environment, with pre-negotiation for LCAP disabled , but passive link state set to "Auto" in the HA configuration, if all physical interfaces show as up, is the AE (Aggregated Interface) supposed to be up or down, as the partner (Cisco Switch) is showing suspended on the LCAP interface. Also from PA the CLi is showing no partner: AE group: ae1 Members: Bndl Rx state Mux state Sel state ethernet1/1 no Defaulted Detached Unselected(Link down) ethernet1/2 no Port Disabled Detached Unselected(Link down) Status: Enabled Mode: Active Rate: Slow Max-port: 8 Fast-failover: Disabled Pre-negotiation: Disabled Local: System Priority: 32768 System MAC: 00:56:4c:60:32:45 Key: 19 Partner: System Priority: 0 System MAC: 00:00:00:00:00:00 Key: 0 Port State -------------------------------------------------------------------------------- Interface Port Number Priority Mode Rate Key State -------------------------------------------------------------------------------- ethernet1/1 74 32768 Active Slow 19 0x45 Partner 0 0 Passive Slow 0 0x00 ethernet1/2 75 32768 Active Slow 19 0x45 Partner 0 0 Passive Slow 0 0x00 LCAP is configured as Active - Active between PA and Cisco switch. Is this the normal ehaviour, and a fail over will turn the interface up, or is there a misconfiguration or an issue here. Thanks

AbdulRahman_Safwat · ‎03-18-2019

Hello @m.hassan96, Active Directory is not a requirement for Traps deployment, and Traps will work fine without it. Active Directory can be integrated with Traps to authenticate ESM Administrators, and to use Active Directory objects, and also it will make it easier for big environments to push the certificates through a GPO if SSL is being used. But still it is not a requirement.

AbdulRahman_Safwat · ‎03-18-2019

Hello @sbecher11 , The compatability matrix is always up to date, so once there are changes, or new OS is added, you will find it on the same link. Or it will be announced in the release notes too.

AbdulRahman_Safwat · ‎03-18-2019

Hello @TimNie Indeed Starting from Traps 5.0, it is moved to the cloud through TMS, instead of the on-premise ESM, that is why you can't see any files for downloading on the portal, as the management is on the cloud, and the agents are downloaded from TMS too.

AbdulRahman_Safwat · ‎03-12-2019

Hello Community, I have an issue with the action rule not being pushed to the agents, as it is not either applied or delivered, at first it would show as all applied but zero is delivered, but now it is not being applied or delivered, I don't think that it is related to the version as I have tested and it happens on 4.1.5 and 4.2.3 and I believe 4.2.2 too, the common thing is that the port used to communicate with the agent is not the default port (2125), is there somthing that needs to be done when using a custom port, or is it a bug. The agents are obviously showing connected, and new policies are are being updated normally, even when the agent initiate the "Send Support File", it would be sent succsseffly, so I wanted to know the port that is being used for the action rules, also after analyzing the logs from both the agents and ESM I relaize that the action rule is associated with the URL https://ESM/EndpointSecurityManager/Update. So is this a bug, or misconfiguration. Thanks

AbdulRahman_Safwat · ‎02-27-2019

Hello Community, If you are enabling SSL communication between the agents and Palo Alto Network's Traps ESM, then once the certificate expires you will need to renew it, refer to the bellow steps to guide you through. How to renew the SSL Certificate in Traps ESM Import or generate the new certificate to the ESM Server. Open the Internet Information Services (IIS) Manager. Choose the Server and from the home page choose “Server Certificates”. Import the new certificate. Open an elevated CMD, and according to the port you set the ESM to use run the following command: netsh http show sslcert ipport=0.0.0.0:2125 Check the Hash of the certificate, it should be the expired certificat’s. Then back to IIS Manager from the left column open “Application Pool”, then “Sites”, then “Default Web Site”. In the action column choose “Bindings”. According to your configuration if you are using the default settings which is port 2125, then check if the port is listed and click on “edit”, if not then click “add” as it will be overwritten because as the CMD command showed, the certificate is used on this port. Fill as bellow: Type: “https” ip address: “All Unassigned” Port: “2125” SSL certificate: “Choose the new certificate”. Then click ok. From the CMD run the command “netsh http show sslcert ipport=0.0.0.0:2125” again and confirm that the new certificate’s hash is now showing. Check-in the agents and confirm the connectivity. It would be nice if PAN can confirm it too, and maybe make it a KB. Regards

AbdulRahman_Safwat · ‎02-26-2019

Hi @Expo-Ant , They have just release Traps 6.0, and simultaneously updated the Matrix, and it is showing that Ubuntu Server 18 is not supported at 4.2, it is only supported at 6.0, so officially it is not supported.

AbdulRahman_Safwat · ‎02-24-2019

Hi @Expo-Ant , I have tested Linux Ubuntu 18.4.1 in my environment with an agent 4.2.2, and it is showing Status: Running, so I guess it is compatible, as it did not show "Incompatible" status or errors. Hope this can help. Regards

AbdulRahman_Safwat · ‎02-22-2019

Hi @LukeBullimore , I have just faced the same error with agent 5.0.5, but the endpoint had a third party antivirus, so I tried uninstalling the third party antivirus, then uninstall traps agent and install it again and it worked fine, and on another machine I did the same but the error was still happening so I tried downloading the agent file again and install traps and it worked again, probably the file go corrupted, so you can try both workarounds if appliacable, also please provide the status from the TMS, it is most probably unauthorized or unlicensed, also confirm that you have enough licenses., also make sure the connectivity is ok. Regards

AbdulRahman_Safwat · ‎02-22-2019

The issue was resolved after upgraing the MacOS to the latest update, I guess some old versions have compatability issues.

AbdulRahman_Safwat · ‎02-08-2019

Hi, So I have an issue with some MacOS running 4.2.2, very few devices of MacOS 10.0.13 and 10.0.14 would show as incompatible on the ESM which is also running 4.2.2, So I know that these versions are compatable according to the release notes and because other machines are running the same version normally. After checking the logs from the agent I came to realize that at some point the agent was compatable and runing normally, then randomly showing incompatible, I have also tried the Action rule "Force Start incompatible Agent" (Which I believe is not documented anywhere by PA, so I hope they would include it soom ) which I had to analyze manually for the lack of documentation, but anyways it did not help and the issue is still there, I would like to know if anyone has an advise on this issue, if it is a bug or if it is some settings from the Mac that needes modification, and also if incompatible means fullly unprotected or some kind of limitation. Thanks

AbdulRahman_Safwat · ‎02-08-2019

Hi, I am facing an issue where the External Dynamic List shows an error when tested by cli command "request system External-list show", the error is "HTTP response code said error", but whem the list is tested from any other device it is accessable and working fine, this list is a Domain list, and I dont think it is a bug as the list is not working on two different releases of 7.1.X. Has anyone experienced this error befors, is it related to the firewall or the network, or is it from the server hosting the list. Thanks a lot

AbdulRahman_Safwat · ‎02-02-2019

@iweltag were you able to identify the issue from PA supprot?

AbdulRahman_Safwat · ‎01-29-2019

Hello @FaacSI, I beleive you meant to say version 4.2.2.39637. Indeed this is a bug in 4.2.2, and it is now resolved in 4.2.3 which was released today, the bug detail from 4.2.3 release notes is as follow: CYV-14380 Fixed an issue where you could not uninstall Traps despite having administrative privileges through fully enabled User Account Control (UAC). Now, the uninstaller evaluates UAC access when it performs a self-security validation step to ensure the uninstall command was initiated by an administrator with the necessary permissions.

AbdulRahman_Safwat · ‎01-08-2019

I have just tested on ESM 4.1.4 and the same behaviour is there.

AbdulRahman_Safwat · ‎01-08-2019

Hello, When a file is Quarantined in traps by a wildfire malware verdic or Hash Control policy, I realize that you can not restore the file from the Hash control policy unless you change the verdict first to benign, is this how it is supposed to work, as the admin guide does not require this step except that it will prevent Traps from keep quarantining the file, but my point is that the option to restore is greyed out and even if I try to do it from the action list it would show: "There were no candidates for Restore". However I am able to restore it using cytool, even if the verdict is still malware. So I want to confirm if "restore file" feature is enabled from ESM server only after changing the verdict to Benign. Also I dont think it is a bug as I have tested it on ESM 4.2.1 and 4.2.2, and Traps agent 4.2.2 and 4.1.4. Thanks

AbdulRahman_Safwat · ‎11-18-2018

Hi, So in Traps 4.2.1 there was a known issue: CYV-14380 This issue is now resolved. See Issues Addressed in Traps Endpoint Security Manager 4.2.2 . If you attempt to uninstall Traps but have administrative privileges only through fully enabled User Account Control (UAC), the uninstall is unsuccessful. This is because the uninstaller does not evaluate UAC access when it performs a self-security validation step to ensure the uninstall command was initiated by an administrator with the necessary permissions. Workarounds: Execute the agent uninstall process from Add/Remove Programs with admin privileges. So this issue is now fixed in 4.2.2 however I still face the same issue where the local admin is unable to uninstall the agent, are there a specific permissions needed other than admin previlages, or is the issue still not fixed, or is the issue I am facing is not related to this bug, the password is correct but the uninstallation does not proceed to the end. Thanks

AbdulRahman_Safwat · ‎11-07-2018

Hi @efrancis Thanks a lot for your reply, can you just tell me the issue's refrence number. Thanks

AbdulRahman_Safwat · ‎11-07-2018

Hi, So after upgrading ESM to 4.2.1 and while the agents are still 4.1.X the uninstall password would be working fine for uninstalling and for Cytool too, however once the agent is upgraded to 4.2.1 the uninstall password is always wrong, either for uninstalling manually or for Cytool, although the password was never changed on the ESM, I even tried alll passwords including the default one (Password1), Sometimes the set password would work for uninstalling but due to issue CYV-14380 it will not be uninstalled, however at the same time Cytool would still give error 5: Access is denied. The only work around to uninstall is by action rule, which works with the set password normally, but still Cytool would not be accessable. Is it a bug in 4.2.1 or is it like a new feature which I am misusing. Thanks

AbdulRahman_Safwat · ‎10-17-2018

Thanks for the reply, Actually the neighbor of PAN firewall is a cisco router, the connection is between the firewall and a router.

Date Registered	‎03-19-2018 05:35 AM
Date Last Visited	a month ago
Total Messages Posted	34
Total Likes Received	7

Online Status	Offline
Date Last Visited	a month ago

Strata

Prisma

Cortex

About AbdulRahman_Safwat