Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- 5G
- IoT Security
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
About gfowler
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About gfowler
04-16-2020
1Post
5Likes
2Solutions
Apr 16, 2020Last Visited
User
Activity
User
Profile
Latest posts by gfowler
| Subject | Views | Posted |
|---|---|---|
| 4220 | 04-16-2020 02:52 PM | |
| 4510 | 03-19-2020 06:42 PM | |
| 1637 | 12-10-2012 10:28 AM | |
| 1661 | 12-10-2012 10:22 AM | |
| 2756 | 11-06-2012 12:02 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 03-19-2020 06:42 PM | |
| 1 Like | 09-18-2012 10:25 AM | |
| 1 Like | 12-10-2012 10:28 AM | |
| 2 Likes | 12-10-2012 10:22 AM |
User Badges
Community Statistics
| Member Since | 08-29-2012 09:55 AM |
| Date Last Visited | 04-16-2020 06:14 PM |
| Posts | 18 |
| Total Likes Received | 5 |
04-16-2020
02:52 PM
So far, I've found two solutions. 1. Disable Session Restore completely. The core problem appears to be with the previous PanGPUI sessions being restored. But every time you reboot, an additional session is added. Thus the first boot gives one PanGPUI.. the second reboot gives two and so on.. OR 2. Exclude PanGPUI from session restore. additionally, adding " X-KDE-autostart-phase=2" to the autostart file for PanGPUI appears have positive effects as well.. For me, this was installed under /etc/xdg/autostart/ Searching the apps button for 'session' yields Desktop Session app. Opening that gives me the options to "start with an empty session", as well as the "Applications to be excluded from sessions" text field (add PanGPUI)
... View more
03-19-2020
06:42 PM
1 Kudo
I'm running Ubuntu 19.10. The GUI runs.. but, depending on the day, there are between 3 and 10 copies in the tray.. one process for each.. I have to click through each one as only one actually works. All others ask to enter a portal address. Any clue how to get it to only start one ?
... View more
12-10-2012
10:28 AM
1 Kudo
I would like to see a fat client for Log review. Maybe a QT based executable. Develop it once and compile for Windows, Mac, and Linux. I would think such a feature would be exponentially faster than the Flash based log viewer I'm currently saddled with.
... View more
12-10-2012
10:22 AM
2 Kudos
TCPDUMP is one of the hugh reasons for buying one of Palo Alto's competitors. The ability to gain instant visibility into the traffic flow is priceless. Depending on the way an organization writes its change control policy, the way ASA, Palo Alto, Fortigate and a few others do packet capture could be prevented due a configuration change being involved. But since the other big competittor includes tcpdump, and it's not a piece of configuration, it can be executed anytime, without special permission. I'd like to see a tcpdump command in Palo Alto that is a single line command, and dumps to the screen/tty/console etc. without having to execute a second, third, fourth, or fifth command. Leaving behind no residual configuration. It would be best if it based on 'tcpdump'. Having worked with dozens of firewalls, I'm fatigued at having to remember each vendor's unique view on packet capturing command syntax. Even if this feature is not tcpdump under the hood, having it fake being tcpdump would be extremely beneficial. Same command, 'tcpdump', same attributes, '-nn -i eth1/1 -s0 -vv -e -p -A -X -w filename.pcap' etc., and same filter syntax, 'host 1.1.1.1 and port 22 and ! udp' etc.
... View more
11-06-2012
12:02 AM
Upgraded the 2020 to 5.0.0. All browsers now pass the test 10/10.
... View more
10-01-2012
11:55 PM
Installed Opera. Passes the test. Installed Safari. Fails consistently. I noticed the User-Agent header was longer on the failed tests. I enabled the Developer feature on Safari. Changed the User-Agent to Firefox 4 on Windows. Safari succeeds when it impersonates Firefox.
... View more
10-01-2012
10:11 PM
Updated PA-2020 to 4.1.8.. No change Updated Windows 7 32-bit to Service Pack 1; No change Updated IE8 to IE9; No change. Installed Chrome. Same effect as IE8/IE9. If I run Firefox 15.0.1, the test succeeds. If I run either IE8/IE9 or Chrome within 30 seconds, they pass the test. I've shown that ICMPv6 Packet too big messages only pass though the 2020 when Firefox is used; and for about 30 seconds thereafter. So I assume the issue is in the http decoder.
... View more
09-18-2012
03:19 PM
Jvalentine, Do you have the ability to spin up a Windows 7 VM and run the test again using IE 8?
... View more
09-18-2012
03:18 PM
Yes I did. Details are in the #3 reply of this thread. And It did not make a difference. The application 'ipv6-icmp' does not appear to apply to the ICMPv6 service alone.
... View more
09-18-2012
10:25 AM
1 Kudo
What is the device on the other side of the VPN? Do you see any errors in the system log? Monitor / Logs / System? If the remote side is a CheckPoint, then it may be joining 192.168.2.0/24 and 192.168.3.0/24 into a larger subnet, 192.168.2.0/23. --- UPDATE: I tested this in my lab. The PAN with report the proxy IDs using during phase 2, even when the negotiation fails. This makes it much easier to determine if the other side has fat fingered a encryption domain / crypto-map ACL Such a beautiful device.
... View more
09-12-2012
08:38 AM
it's 'top'. Just like on any linux box. Add the term 'follow' to the end, 'show system resources follow', and you getting a running view of the CPU. I assume it only shows CPU, memory, swap and processes for the control plane. After you've executed the command with the 'follow' attribute, you can interact with it; just like top on a linux box. press 'h' for help. 's' and then '1' to speed of the refresh. Capital 'P' to sort the process list by CPU usage. '1' to expose the multicores on the CPU(s) header. and 'q' to quit. I tell ya.. I'm likin' this box more and more everyday..
... View more
09-12-2012
08:29 AM
Updated the Applications and Threat DB to 328-1503. No change. I have noticed that if I run the test (test-ipv6.com) on firefox and allow it to complete, and then immediately run the test on IE, IE will complete 10/10. But if I wait some period of time, 30 second per se, IE will continue failing again.
... View more
09-10-2012
08:40 PM
Plot thickens.. Thus far, I've been running these tests on a Windows 7 32-bit system using IE only. Just installed Firefox 15.0.1. When IE fails the tests, firefox succeeds and continues to succeed. I conducted another packet capture and the capture clearly shows ICMPv6 Packet too big messages do not get through the 2020 when IE 8 is used. But ICMPv6 Packet too big messages do get forwarded through when FF 15.0.1 is used. The main difference seems to be in the order of the HTTP headers. Below are the HTTP request headers with the Cookies removed. These aren't necessarily from the same point in the test. Firefox: GET /ip/?callback=_jqjsp HTTP/1.1 Host: ipv6.test-ipv6.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20100101 Firefox/15.0.1 Accept: */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://test-ipv6.com/ Cache-Control: max-age=0 IE: GET /ip/?callback=_jqjsp HTTP/1.1 Accept: */* Referer: http://test-ipv6.com/ Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Accept-Encoding: gzip, deflate Host: ipv6.test-ipv6.com Connection: Keep-Alive
... View more
09-10-2012
10:41 AM
Closer examination is pointing to the 2020 not properly processing ICMP6 packet too big messages. [icmp6 sum ok] ICMP6, packet too big, length 1240, mtu 1480 These ICMP6 messages are being generated by the router that handles the Hurricane Electric tunnel. Even when I add a rule to explicitly allow "ipv6-icmp" for any/any source to any/any destination, they do not make it through the 2020. I've also add a management profile to the external interface to allow ICMPs to the external interface. The ICMP6 packets too big messages are, of course, destine to the global IPv6 address of the internal workstation, not the 2020's external IPv6 address. Oddly enough, everything works when I allow pure port 80 traffic, or the unknown-tcp application.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-16-2020
06:14 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
