This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About debsPal0
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About debsPal0
08-18-2015
12Posts
1Like
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by debsPal0
| Subject | Views | Posted |
|---|---|---|
| 3520 | 05-15-2014 05:48 AM | |
| 1579 | 04-10-2014 05:31 AM | |
| 1614 | 04-04-2014 02:21 AM | |
| 1823 | 09-04-2013 01:00 AM | |
| 2297 | 05-24-2013 04:12 AM | |
| 2462 | 05-24-2013 12:26 AM | |
| 1295 | 11-21-2012 02:55 AM | |
| 1613 | 06-20-2012 03:07 AM | |
| 2222 | 10-22-2011 05:25 AM | |
| 2944 | 10-16-2011 11:48 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-22-2011 05:25 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes |
User Badges
Community Statistics
| Member Since | 01-13-2011 01:48 AM |
| Date Last Visited | 08-18-2015 09:06 AM |
| Posts | 12 |
| Total Likes Received | 1 |
05-15-2014
05:48 AM
Will Palo Alto be creating a custom App-ID for the World Cup streaming media this year? I am based in the UK. Regards, James.
... View more
Labels:
- Labels:
-
App-ID
04-10-2014
05:31 AM
Can anyone help with this one?
... View more
04-04-2014
02:21 AM
It is possible to debug ESP packet's in Wireshark but to do so I will need to obtain the encryption key and the authentication key for the given VPN from my Palo Alto 5050. As an example - In Linux it's possible to get this information by running the command 'ip xfrm state': gw205:/ # ip xfrm state src 192.168.140.200 dst 192.168.140.205 proto esp spi 0x0879355b reqid 16421 mode tunnel replay-window 32 flag noecn nopmtudisc af-unspec auth hmac(sha1) 0xb8dd42a1c505bed19c2bf23cef00e5d8223c2a5b enc cbc(des3_ede) 0xae76ea430b10c72c882c4aeab2283444c54f913d87f5e109 src 192.168.140.205 dst 192.168.140.200 proto esp spi 0x1c0d7b38 reqid 16421 mode tunnel replay-window 32 flag noecn nopmtudisc af-unspec auth hmac(sha1) 0xc364660133b04a4f20e52000dbe4a6ba154c09c1 enc cbc(des3_ede) 0x39e87c9ca500616b36f2f0d3c7fb688621d7bbf31414abbd Does anyone know how can I obtain this information from my Palo Alto 5050? I have tried all of the show vpn / ike-sa / ipsec-sa commands but none of them show me what I need. For reference, here is a link to the Wireshark guide that I have been using: How can I decrypt IKEv1 and/or ESP packets ? - Wireshark Q&A Regards, James.
... View more
09-04-2013
01:00 AM
Can the PA's perform an address translation (assuming an appropriate NAT rule is configured) for an IP address that's presented as an answer in a DNS response message? I.E as highlighted in red below. I have tested it and it doesn't work, if the functionality doesn't currently exist is it on any road-map to be added? ==================================================== Domain Name System (response) [Request In: 74] [Time: 0.000245000 seconds] Transaction ID: 0x5d79 Flags: 0x8580 Standard query response, No error Questions: 1 Answer RRs: 2 Authority RRs: 6 Additional RRs: 6 Queries Answers test.test.com: type A, class IN, addr 1.1.1.1 Name: test.test.com Type: A (Host address) Class: IN (0x0001) Time to live: 1 hour Data length: 4 Addr: 1.1.1.1 (1.1.1.1) ============================================= Regards, James.
... View more
05-24-2013
04:12 AM
Many thanks, I can see all of my Debug output now. Are minor changes such as this documented? I don't remember reading about this change in the release notes, although I would need to check again to be sure. Regards, James.
... View more
05-24-2013
12:26 AM
I have been having problems with running Debug Flow Basic since upgrading from PAN-OS version 4.1.6 to 5.0.4. I am using the following commands to setup my debug: debug dataplane packet-diag set log feature flow basic debug dataplane packet-diag set capture on (I have not applied a capture filter as this is our test PA so very little traffic being passed) The problem is that nothing is being to the output file ('less dp-log pan_packet_diag.log' shows as empty file). I have rebooted the PA but still getting the same problem, this was working prior to me upgrading to 5.0.4. Has anyone else experienced similar problems? Regards, James. ========================================================== admin@PA2050> debug dataplane packet-diag show setting -------------------------------------------------------------------------------- Packet diagnosis setting: -------------------------------------------------------------------------------- Packet filter Enabled: no Match pre-parsed packet: no -------------------------------------------------------------------------------- Logging Enabled: no Log-throttle: no Sync-log-by-ticks: yes Features: flow : basic Counters: -------------------------------------------------------------------------------- Packet capture Enabled: no Snaplen: 0 -------------------------------------------------------------------------------- admin@PA2050> debug dataplane packet-diag set log on Packet log is enabled admin@PA2050> less dp-log pan_packet_diag.log 0% ==========================================================
... View more
Labels:
- Labels:
-
Troubleshooting
11-21-2012
02:55 AM
I understand that VLAN tag translation is not available on virtual-wire interfaces, can someone tell me whether this is on any road map and likely to be included in a future release of PANOS? It's something that I require for a proposed PAN deployment in my organisation. Thanks, James.
... View more
Labels:
- Labels:
-
Configuration
-
Networking
06-20-2012
03:07 AM
Do I still need to purchase a license for Panorama if I only want to make use of the log forwarding functionality. It would be useful if I could forward logs from my PA-4020 to a Panorama installation so that I can store more than a couple of days worth of traffic / threat logs etc. I only have a pair of HA active/passive PA's so I don't need and will not use the centralised management function that Panorama provides, but log forwarding would be very useful. Thanks in advance. Regards, James.
... View more
10-22-2011
05:25 AM
1 Kudo
I am having a problem with VOIP communications passing through my PA-4020's. The PA is recognising the H.225 application, however it would appear that the content inspection is not translating the IP addresses within the application payload, I do have a NAT rule setup for the IP address in question. Specifically I am talking about H.225 registration confirm, which is a response from the gatekeeper to my endpoint indicating the transport IP address, this is the IP address that fails to be translated. Does the PA have ALG support for H.225 to convert the network layer address information found inside the application payload? Regards, James.
... View more
10-16-2011
11:48 PM
I'll contact my sales SE this morning. One final question - is there a command that I could run via CLI that would tell me the total number of NAT rules currently configured? Regards, James.
... View more
10-15-2011
03:28 AM
I am getting very close to the 1000 max NAT rule limit on my PA-4020's, are there any plans to increase this limit in future releases of PANOS or is my only option to upgrade to a PA-4050?
... View more
- Tags:
- nat
06-14-2011
07:52 AM
Hi, I have packets that arrive on interface eth1/10 that I need to be forwarded back out of eth1/10 with a next hop address of another router on that subnet. I have created a pbf rule that I hope would achieve this however it is currently not working. It looks like the following : ========================================================== Interface eth1/10 IP : 3.3.3.1 Interface eth1/10 Zone : dummy-zone1 Source Zone : dummy-zone1 Source Address : any User : any Destination Address : [*NEGATE* : 1.1.1.1] (so I would like the pbr rule to apply to all traffic that does not match the configured address i.e.2.2.2.2) Application : any Service : any Action : forward Forwarding Egress I/F : eth1/10 Next Hop : 3.3.3.2 No Monitoring ========================================================== Unfortuanly I am not currently familiar enough with PA to run any extensive debugging. Also, is it possible to apply a pbr policy with an egress interface being the same as the source interface? I have substituted the real IP addressing with dummy addressing in the example above. Any comments or suggestions would be appreciated, this is my first post so be gentle 🙂 Regards, James.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2015
09:06 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks