About dyoung

dyoung · ‎09-16-2015

Hi Phil, Thanks for your reply. The strange thing is that the AV updates always got pushed to the peer device and installed fine. I think our situation was the opposite way around to yours in that the peer device was reported to be running more recent AV defs than our active unit. Fortunately though this issue seems to have gone away since the weekend. We haven't made any changes or rebooted the unit, it just started working again. Very odd. Thanks, Dave

dyoung · ‎09-08-2015

Hi all, I have a HA pair (A/P) of PA-500s and one of the devices seems to be giving mixed messages about the version of the AV definitions in use. This has been the case for a couple of weeks now. It is not causing problems as such, but it is not right either. If anybody can advise on how I can get our PA-500 to report correctly it would be appreciated! Please see below where the mismatch message and general window seem to contradict each other. It suggests 1637-2114 is installed here too... ...and the log seems to suggest that is was installed but then says it failed. If I change something in the policy and perform a commit then the mismatch will go away. Any help appreciated! Many thanks, Dave

dyoung · ‎08-12-2015

Thank you both for your replies! Since writing the post I have managed to test with PPTP / GRE in the lab and it worked exactly as you have confirmed. I am hoping that ESP will work in the same way but I've not got an suitable L2TP server to test with. Thanks again, Dave

dyoung · ‎08-11-2015

Hi all, I'm hoping somebody might be able to help with this unusual scenario please? I have been tasked with replacing an old linux based firewall with a PA-500 device. Initially the configuration of the PA-500 should just replicate what the current firewall is doing before we start phasing in the additional security capabilities of the Palo. The only thing I am concerned about is the way that ESP and GRE connections are NATed on the linux firewall. The protocols and ports associated with PPTP/L2TP will hit the Palo on its external interface and need to be destination NATed to a VPN server on an internal network. I cannot see any way to specifically NAT ESP or GRE on the Palo but I suspect leaving the service as "any" in my NAT rule might achieve this? An additional complication though is that other ports on the external interface of the Palo need to be destination NATed to other internal devices. If I put these port specific NAT rules above my "any" rule would the destination NAT of GRE/ESP still be performed please? Any help or guidance would be greatly appreciated! Many thanks, Dave

dyoung · ‎02-12-2015

You may have seen already, but PA are advising that we should roll back to 484. Regards, Dave

dyoung · ‎02-11-2015

Hi mrsold, no I've not seen this officially documented anywhere.

dyoung · ‎02-11-2015

Additionally for those using PAN-DB, a list of categories and examples can be found here: Palo Alto Networks URL Filtering - Category List

dyoung · ‎02-11-2015

Hi mrsold It will only relay for one subnet. The interface address used to relay the DHCP request (and therefore determine which DHCP scope will be used) is the IP address at the top of the list on your IPv4 tab. You can adjust the positioning of IP addresses on this tab using the move up/down options should you wish. Regards, Dave

dyoung · ‎02-11-2015

If you are not seeing any logs prior to the restart on the failed device then this is strange. How do you connect to your PA device to check logs please? Via MGT interfaces or one of the firewall interface IPs? If your failed device had a power issue then there should be log entries reporting the loss of heartbeat connection to peer device.

dyoung · ‎02-09-2015

Hi HDC, We have upgraded the memory in all of our PA-500 devices and this does make a noticeable difference to the management interface speed, commit times etc. We have also been trialling a VM-100. We've had a few reliability issues and I understand that the cause of these is being addressed in 6.1.3. Other than that though, we've been impressed by the general performance of the VM-100 and delighted by the boost in management interface speed / commit times. Regards, Dave

dyoung · ‎02-09-2015

The reason why the fail-over occurred *should* be in the logs of the device that was active previously. Are you still able to connect to the out-of-band MGT network interface of the failed device? If so, hopefully you will be able to see the logs up until the time of failover. Logs are not synchronised between devices. Regards, Dave

dyoung · ‎02-09-2015

Hi Predrag, Thanks for this. Hopefully I can use it to steer our support people in the right direction to try and get a bit more info. Best regards, Dave

dyoung · ‎02-09-2015

Hi sib, Do you mean how do you do this without subscribing to Palo / Brightcloud for URL filtering? If so, I believe that you can still use custom URL categories. Regards, Dave

dyoung · ‎02-09-2015

Many thanks Predrag, It is good to hear that support have now reproduced this! Did they give any indication of what was might be triggering the issue please? Chasing up my support people now as still waiting to hear back from them... Regards, Dave

dyoung · ‎02-09-2015

Hi tan.in Much of the memory being used is being shown against "cached". The system will allocate unused memory to act as a disk cache. This is returned to the free memory pool if a new or running process needs it. This often gives the impression that there is not much memory free, but in reality the memory is just being put to good use until it is needed. Regards,

dyoung · ‎02-06-2015

Hi all, Thank you for your replies. I'm sorry I haven't responded sooner - I've not logged in for a while. Our VM-100 rebooting stopped after we upgraded to 5.0.14. Back in August this was escalated all the way up to Palo Alto development and still no reason for these reboots could be found. The case was closed because the problem seemed to have gone away rather than the root cause discovered. Unfortunately on Tuesday this week our VM-100 started rebooting again. I have upgraded to 5.0.15 in the faint hope that this will help and contacted our support partner, but not heard anything back yet. Did any of you discover the cause of this issue please? We are not using GP so I don't think it can be related to that. Also, we are running on Intel Xeon E5-2650v2 and show system files shows no files - just an empty crashinfo directory. Many thanks, Dave

dyoung · ‎08-15-2014

Additionally, if you choose to use a non Active Directory CA you can use group policy to push the certificate trust out to workstations.

dyoung · ‎08-14-2014

Hi, Active / Passive or Active / Active? Regards, Dave

dyoung · ‎08-14-2014

Hi, There should be a tick box in your zone settings? Regards, Dave

dyoung · ‎08-14-2014

Hi all, We have a Palo Alto VM-100 running under ESXi 5.0 which up until this week has been rock solid. On Monday it rebooted itself. No config changes had been made for almost a month prior to this. It also rebooted itself twice yesterday and once so far today. The messages in the log are as below. Order is from bottom to top. Autocommit job failed Dataplane is now up The system is starting up. The system is shutting down. data_plane: restarts exhausted, rebooting system The dataplane is restarting. supervisor: Exited 1 times, must be manually recovered. tasks: Exited 1 times, must be manually recovered. all_task_2: Exited 4 times, must be manually recovered. PAN-DB cloud list loading failed (ERROR:Couldn't resolve host name). all_task_3: exiting because missed too many heartbeats all_task_2: exiting because missed too many heartbeats all_task_3: exiting because missed too many heartbeats all_task_2: exiting because missed too many heartbeats all_task_3: exiting because missed too many heartbeats all_task_2: exiting because missed too many heartbeats all_task_3: exiting because missed too many heartbeats all_task_2: exiting because missed too many heartbeats I logged a call over 24 hours ago with our support company but so far nobody has been able to offer any assistance at all. I'm hoping somebody on here has maybe seen this before? Any help would be very much appreciated! Many thanks, Dave Palo Alto VM-100 Software version 5.0.11 Application version 450-2330 Antivirus version 1346-1817 URL Filtering version 2014.08.13.411

dyoung · ‎07-14-2014

I would not open the case to reseat the HDD as this may invalidate your support agreement. If you have removed and reinserted the power cable and you are still not able to get a response on the serial port using 9600 8-N-1, please contact PAN for RMA.

dyoung · ‎05-29-2013

Hi Linus, The CRL-status service route may be worth a try if you have not done so already? Regards, Dave

dyoung · ‎03-05-2013

Hi Darren, There should be no need to go through all 40 pages of active sessions - you can filter on the egress interface to show the relevant sessions. If your user works fixed hours then maybe you could use PBF to route the traffic away from the tunnel interface out of hours? Or if you can find a way of remotely determining whether the Cisco router or the user's router is connected (say the external interface pings on Cisco but not on user's router) then you could use monitoring within PBF to automatically make the routing decision for you. Regards, Dave

dyoung · ‎03-04-2013

Hi Darren, How are you managing your routing please? Do you have a static route in your virtual router for a particular subnet pointing to the tunnel interface associated with the site-to-site VPN in question? If so, wouldn't any traffic to that subnet be deemed interesting enough to cause the Palo to try to initiate a VPN tunel? What traffic to/from that subnet do you see in your logs and session browser once the user has disconnected their Cisco 887? Regards, Dave

dyoung · ‎03-03-2013

We took the same approach as Hitsec when migrating from Check Point and it worked well for us. We stared off with a policy that looked very similar to a Firewall-1 policy and then gradually Palo-ized it. We always use "service: application-default" where possible when allowing applications and "service: any" when blocking them.

dyoung · ‎03-03-2013

Found the problem I've never noticed the boxes in "Dynamic Updates" to delete downloaded definitions before. My laptop has a teeny screen and they were just out of sight. Anyway, I've deleted 360-1705, redownloaded it and installed it and it works! I'm surprised that the install and push both got to 100% without any error but there you go. Many thanks, Dave

dyoung · ‎03-03-2013

Hi, thanks for your reply. Yes I did consider installing older version but oddly the only "Applications and Threats" definitions showing in "Dynamic Updates" now are 360-1705 (showing as downloaded but not installed). I could upload an older one then install from file I guess. Might try that tomorrow. Thanks, Dave

dyoung · ‎03-03-2013

Hi all, Is anybody else having problems installing Applications / Threats definitions 360-1705 please? One half of my HA pair of PA-2020s has installed this OK but the other has not. The install and push completes OK but the active version remains at 359-1703. Both devices were running OS 4.1.6 but these have both been upgraded to 4.1.9 today. I have tried to reapply 360-1705 but exactly the same thing happens. During one of my attempts to apply 360-1705 on Friday the management server crashed and restarted. This only happened once though and I must have tried installing 5 or 6 times now. The device has been rebooted twice now. Once as part of the upgrade process and once again afterwards. Does anybody have any ideas please? Many thanks, Dave

dyoung · ‎09-06-2012

Unfortunately no - I think the app must be checking the certificate when it makes a connection to the Google Drive server and failing when it sees it is signed by my substituted CA. Understandable I suppose.

dyoung · ‎09-06-2012

The SSL termination seems to break the Google Drive application on my PC, however the web interface now gets blocked correctly! I did notice that there was another question relating to getting Google Drive working using SSL termination, but as I don't want it to work I'm going to leave things as they are. The PA did not detect the traffic any differently - I don't think the app got beyond trying to validate the fake certificate it got back from my PA. Many thanks, Dave

Date Registered	‎01-21-2011 12:50 AM
Date Last Visited	‎09-11-2019 09:55 AM
Total Messages Posted	81
Total Likes Received	11

Online Status	Offline
Date Last Visited	‎09-11-2019 09:55 AM

Strata

Prisma

Cortex

About dyoung