Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About craigomatic
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About craigomatic
20Posts
2Likes
1Solution
Last Visited
User
Activity
User
Profile
Latest posts by craigomatic
| Subject | Views | Posted |
|---|---|---|
| 2761 | 08-27-2019 10:47 AM | |
| 3816 | 08-27-2019 07:58 AM | |
| 3827 | 08-27-2019 07:48 AM | |
| 3833 | 08-27-2019 07:44 AM | |
| 1821 | 08-27-2019 05:10 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 Likes | 09-20-2018 06:48 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 08-20-2018 04:00 PM |
| Date Last Visited | |
| Posts | 20 |
| Total Likes Received | 2 |
08-27-2019
10:47 AM
Update: I'm starting to get some weird behavior on my 800 series running 8.1.9, like management goes to 100% for an extended period of time, making the device unmanageable. Did I read about a memory leak? These have all been running > 30 days. I'm upgrading to 8.1.9-h4 immediately.
... View more
08-27-2019
07:58 AM
If it's sent in clear text, with verbose commands and x offsets you should be able to see the packets. I've been able to grab ldap credentials on 389 like that. Not sure about radius. You have a whole other set of troubleshooting commands with auth, like below: test authentication authentication-profile "CorpLDAP" username user password Then you have to follow the authd.log: tail follow yes mp-log authd.log
... View more
08-27-2019
07:48 AM
Definitely more readable in WireShark for sure. If you have that option of accessing an scp server ... sometimes that's not available in my experience!
... View more
08-27-2019
07:44 AM
I usually have to keep a cheat list like this: tcpdump filter "dst 10.10.20.6 or src 10.10.20.6" view-pcap mgmt-pcap mgmt.pcap view-pcap no-dns-lookup yes no-port-lookup yes mgmt-pcap mgmt.pcap
... View more
08-27-2019
05:10 AM
debug software restart process management-server Process mgmtsrvr was restarted by user [user] This did not return the management function. I ended up rebooting, then synching the config to the other HA member (configs were NOT synched previously), then upgrading both to 8.1.9-h4.
... View more
08-26-2019
02:53 PM
pan_task seems a little vague. I would like to drill down into that process to see where it's hanging ...
... View more
08-26-2019
02:43 PM
This is a new one for me. My system is showing "active" (in active/passive) but the GUI is frozen and I see the following on the dashboard: PANOS 8.1.9 From the dashboard
... View more
08-22-2019
08:02 PM
thanks luigi, i'll test in the lab. appreciate the feedback!
... View more
08-22-2019
07:58 PM
I've been on 8.1.9 on 3020s, vm-300s, 820s, 850s, 220s with no issues. I believe that is the recommended support version. Probably want to install the latest 8.0 version, reboot, download 8.1, download 8.1.9, install 8.1.9, reboot. Good luck https://live.paloaltonetworks.com/t5/Customer-Resources/Support-PAN-OS-Software-Release-Guidance/ta-p/258304
... View more
05-13-2019
09:04 AM
So do you think there is an issue with the parser? What PANOS version are you running? I still have not moved forward in implementing due to the high risk/low payoff and there seems to be a question whether this is really happening. Sorry it happened to you but I'm also glad I'm not crazy.
... View more
01-28-2019
08:42 AM
Luigi,
Just tried in 8.1.5 and was unable to reproduce error in my testing environment. I will roll out to production cautiously and will update ...
... View more
01-14-2019
09:49 AM
Luigi,
PANOS release 8.1.4.
set device-group ACME external-list edl-phishing-sites type url recurring hourly set device-group ACME external-list edl-phishing-sites type url certificate-profile minemeld_cert_profile set device-group ACME external-list edl-phishing-sites type url url https://10.X.X.X/feeds/phishing-url
Issue can be replicated by changing the last line:
set device-group ACME external-list edl-phishing-sites type url recurring hourly set device-group ACME external-list edl-phishing-sites type url certificate-profile minemeld_cert_profile set device-group ACME external-list edl-phishing-sites type url url https://10.X.X.X/feeds/phishing-url?v=panosurl
Then most/any url categories will be defined as edl-phishing-sites. I saw google.com, bing.com, yahoo.com being classified as such.
Here's the URL filtering profile, which includes the edl:
set device-group ACME profiles url-filtering ACME-PAN-URL-Policy credential-enforcement block [ abortion abused-drugs adult alcohol-and-tobacco auctions command-and-control copyright-infringement dynamic-dns extremism gambling games hacking home-and-garden hunting-and-fishing internet-communications-and-telephony malware nudity parked peer-to-peer phishing proxy-avoidance-and-anonymizers questionable weapons web-advertisements edl-phishing-sites shortened-urls ]
Here's a policy we were using specifically to block matching category:
craigomatic@PNRM01# show | match openphish-alert set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert target negate no set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert to untrust set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert from [ trust ] set device-group ACME-LOCATIONS pre-rulebase security rules openphish-alert source any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert destination any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert source-user any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert category edl-phishing-sites set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert application [ ssl web-browsing ] set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert service application-default set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert hip-profiles any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert action drop set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert log-setting lf-pnrm-siem set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert disabled no set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert tag
Let me know if you need more info. I was able to reproduce this on my lab PA-220. I can ship you that config if that would be helpful.
... View more
01-11-2019
12:56 PM
OK I sent it ... please let me know if you do NOT receive. There are four attachments but they are small txt files.
... View more
01-10-2019
01:40 PM
Hi Luigi,
Did you get everything you need to reproduce the error? Let me know and I can provide you with my config. Thanks
... View more
01-04-2019
08:19 AM
Sure it's on the way. Also included the MineMeld config.
... View more
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
