About craigomatic

Update: I'm starting to get some weird behavior on my 800 series running 8.1.9, like management goes to 100% for an extended period of time, making the device unmanageable. Did I read about a memory leak? These have all been running > 30 days. I'm upgrading to 8.1.9-h4 immediately. ... View more

thanks luigi, i'll test in the lab. appreciate the feedback! ... View more

I've been on 8.1.9 on 3020s, vm-300s, 820s, 850s, 220s with no issues. I believe that is the recommended support version.   Probably want to install the latest 8.0 version, reboot, download 8.1, download 8.1.9, install 8.1.9, reboot.   Good luck   https://live.paloaltonetworks.com/t5/Customer-Resources/Support-PAN-OS-Software-Release-Guidance/ta-p/258304 ... View more

So do you think there is an issue with the parser? What PANOS version are you running? I still have not moved forward in implementing due to the high risk/low payoff and there seems to be a question whether this is really happening. Sorry it happened to you but I'm also glad I'm not crazy. ... View more

Luigi,   Just tried in 8.1.5 and was unable to reproduce error in my testing environment.  I will roll out to production cautiously and will update ... ... View more

Luigi,     PANOS release 8.1.4.   set device-group ACME  external-list edl-phishing-sites type url recurring hourly set device-group ACME   external-list edl-phishing-sites type url certificate-profile minemeld_cert_profile set device-group ACME   external-list edl-phishing-sites type url url https://10.X.X.X/feeds/phishing-url   Issue can be replicated by changing the last line:   set device-group ACME  external-list   edl-phishing-sites type   url   recurring hourly set device-group   ACME     external-list   edl-phishing-sites type   url   certificate-profile minemeld_cert_profile set device-group   ACME     external-list   edl-phishing-sites type   url   url   https://10.X.X.X/feeds/phishing-url?v=panosurl   Then most/any url categories will be defined as edl-phishing-sites. I saw google.com, bing.com, yahoo.com being classified as such.   Here's the URL filtering profile, which includes the edl:   set device-group ACME profiles url-filtering ACME-PAN-URL-Policy credential-enforcement block [ abortion abused-drugs adult alcohol-and-tobacco auctions command-and-control copyright-infringement dynamic-dns extremism gambling games hacking home-and-garden hunting-and-fishing internet-communications-and-telephony malware nudity parked peer-to-peer phishing proxy-avoidance-and-anonymizers questionable weapons web-advertisements edl-phishing-sites shortened-urls ]   Here's a policy we were using specifically to block matching category:   craigomatic@PNRM01# show | match openphish-alert set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert target negate no set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert to untrust set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert from [  trust ] set device-group ACME-LOCATIONS pre-rulebase security rules openphish-alert source any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert destination any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert source-user any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert category edl-phishing-sites set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert application [ ssl web-browsing ] set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert service application-default set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert hip-profiles any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert action drop set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert log-setting lf-pnrm-siem set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert disabled no set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert tag Let me know if you need more info. I was able to reproduce this on my lab PA-220. I can ship you that config if that would be helpful.   ... View more

OK I sent it ... please let me know if you do NOT receive. There are four attachments but they are small txt files. ... View more

Hi Luigi,   Did you get everything you need to reproduce the error? Let me know and I can provide you with my config. Thanks ... View more

Sure it's on the way. Also included the MineMeld config. ... View more