About VincentPresogna

VincentPresogna

@BPry Thanks for your input, it did lead me down the correct path, though inadvertantly. Show all jobs didn't show anything. I checked both the masterd and paninstaller logs, but didn't find anything that stuck out to me. What I did do was make a change to the configuration and commit it. It came back with a commit failure, use 'commit force'. Something about auto-commit stuck failure. Ok, so I go into the cli and do a commit force, it came back with some validation errors due to the absence of licenses for some of my objects, "URL Filtering" to be exact. Once I removed the objects causing the validation error, I was able to commit the configuration. After that I was able to commit the panupv2-all-apps-8336-6373 update. Then after that I was able to go from 9.0.9 to 9.1.5. This command was very helpful in the debugging of the issue, 'tail follow yes mp-log ms.log'

VincentPresogna · ‎10-29-2020

It is registered, and has been since I received it. I have followed this procedure before with out issue. Don't know why you can see the link.

VincentPresogna · ‎10-29-2020

Thanks, but that doesn't answer anything. According to this, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CltxCAC, under the Maintaining the OSS device section it states, "The following steps will keep the OSS on the same PAN-OS release as the production device. Perform these steps each time the production device is upgraded." So why does step 2 fail?

VincentPresogna · ‎10-29-2020

Hi all, Figured I'd ask here before contacting support. Last weekend I upgraded my production PA's from 9.0.9 to 9.1.5. Everything went smooth. Due to company requirements we are to upgrade the software on the OSS box, yet it fails with content update. I have downloaded the latest content, panupv2-all-apps-8336-6373, and was able to upload it through the GUI. When I hit OK to apply it it first comes up with this I click Yes, and then it comes up with this I am kind of stumped here. Any input would be appreciated.

VincentPresogna · ‎10-27-2020

@raji_toor I see we are in the same boat then, so to speak. Luckily for me, my user base is relatively small and rarely come across this issue much any more since I implemented decryption. Would be nice if maybe there was an EDL that could do this. But this poses the question, how to populate the EDL FQDN's of known decryption offenders.

VincentPresogna · ‎10-27-2020

What I did was create a Custom URL Category, Lets call it "SLL work arounds". I then apply that in my decryption policy, lets call that "No-decrypt work around". Make sure you go to the Options tab for the rule and set it to "No Decrypt", and set the Custom URL in the Service/URL catagory tab. So when I come across a site that doesn't decrypt properly, I just add the url to the "SSL Work arounds" policy. So say www.badSSLplayer.com is throwing a browser warning, i'll add *.badSSLplayer.com to the list.

VincentPresogna · ‎09-01-2020

After you installed mysql/mariadb did you run mysql_secure_installation ?

VincentPresogna · ‎08-21-2020

Thanks @SutareMayur , that's what I figured, just wasn't sure. @BPry , thanks for the tip about "release notes under 'Associated Software and Content Versions' section". I knew it had to be somewhere, I guess I wasn't looking hard enough. I'll remember that for future reference.

VincentPresogna · ‎08-20-2020

Quick question, are GP client versions tied in any way to PanOS versions? I am running PanOS 9.0.9-h1, and GP 5.0.9. Will updating to GP 5.2.1 cause any issues?

VincentPresogna · ‎08-19-2020

Glad you got it all sorted out and thanks for the update.

VincentPresogna · ‎08-19-2020

There are 2 ways to get firmware updates, you either click "Check Now" , which is what I do, and it will give you a list of the firmware available. You can't then "Download" it. If you are using the "upload" method, that means you are grabbing the image from you Palo Alto portal and doing a manual update. You are running a licensed PA, correct?

VincentPresogna · ‎08-19-2020

If i would have to make a guess you downloaded the 9.1.3-h1 image before you downloaded the 9.1.0 base image. In your screen shot it states, "Once the base is loaded, re-download your target image". I would delete the 9.1.3-h1 image and re-download it, and then give it a try.

VincentPresogna · ‎03-24-2020

Sorry, I can't help with this. I have been running 9.0 versions, wasn't until 9.0.5 that it was fixed. I am also doing LDAP auth against active directory.

VincentPresogna · ‎03-24-2020

What version of PAN-OS are you running. There are some versions that had a bug when using a scoped LDAP group.

VincentPresogna · ‎03-09-2020

I edited the second line of the xml files, <entry name="ncaa2019-video"> to <entry name="ncaa2020-video"> and <entry name="ncaa2019-mml"> to <entry name="ncaa2020-mml">. Now it shows as ncaa2020. Sounds to me like they are just using the same application signature as last year, most likely nothing has changed.

VincentPresogna · ‎03-03-2020

Try using https://panwdbl.appspot.com/lists/mdl.txt

VincentPresogna · ‎02-13-2020

That should be all there is to it. Nothing additional needs to be changed.

VincentPresogna · ‎12-19-2019

Putty can save screen output to a file. Look in sessions, then logging under that.

VincentPresogna · ‎11-19-2019

This should help, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFLCA0

VincentPresogna · ‎11-19-2019

I notice 9.0.5 is out, you may want to try that.

VincentPresogna · ‎11-05-2019

Thanks Steve, That's pretty much what my conclusion was also, just wanted some verification.

VincentPresogna · ‎11-05-2019

I can't seem to find a clear answer to this, and there may not be one. I have a VPN tunnel between 2 sites, both on PA-820's. Would "disable server response inspection" on the VPN policy on both sides benefit from this? What are the potential downsides if I did do this?

VincentPresogna · ‎11-01-2019

I have my PA-820 running 9.0.4 since it was release. Haven't had any issues, and it even resolved an issue I was having with LDAP group mappings.

VincentPresogna · ‎10-15-2019

You don't need 8.1.9, just 8.1.0 & 8.1.9-h4

VincentPresogna · ‎10-03-2019

I deployed 9.0.4 a couple days ago. I have had no issues so far. It also fix an LDAP bug I was encountering in the previous versions of the 9.0.x releases.

VincentPresogna · ‎09-18-2019

Awesome. Thanks. Took me about a day to get this up and running on Ubuntu 18. The installation of Java 8 has changed, the PPA repo is no longer a viable solution, had to install it manually. The only other thing that tripped me up was the sysylog port, it was 5514 instead of the usual 514. Once I changed that on the syslog forward in the PA, everything started flowing ing in.

VincentPresogna · ‎09-18-2019

Sound like the repo isn't setup correctly First make sure you run this command wget -qO - https://minemeld-updates.panw.io/gpg.key | sudo apt-key add - That will add the trust key Second , run this sudo add-apt-repository "deb http://minemeld-updates.panw.io/ubuntu xenial-minemeld main" sudo apt update That will add the minemeld repo Third, After you add the minemeld repo and then do a sudo update, you'll get an error about i386. To over come that I added [arch=amd64] to the apt sources list in /etc/apt/sources.list eg; deb [arch=amd64] http://minemeld-updates.panw.io/ubuntu xenial-minemeld main After all that sudo apt install -o Dpkg::Options::="--force-overwrite" -y minemeld

VincentPresogna · ‎09-14-2019

Thanks BPry. It was a joke about "just me". I assume if it's affecting me, it's affecting everyone one else since it's a global policy. With that out of the way; I agree, enabling SSL decrytption shouldn't cause anything with spotify, that's the weird part. I have logging on the interzone-default policy. I'll puruse those logs on Monday when I am in the office. The interesting part is when playing spotify in a web browser with developer tab open to track what calls are being made, I see different results with SSL enable versus disabled. I haven't tried the spotify app though, just the web browser. I would assume the app behaves the same way, since all it does is make calls to thier website. From my initial looks at the logs I didn't see anything being denied. In the developer trace is do see references to Access-Control-Allow-Origin which is a part of Cross-origin resource sharing. If i find the issue, I'll report back.

VincentPresogna · ‎09-13-2019

Hi All, Today I decided to implement SLL Forward decryption. Everything is working great except for one thing, Spotify. I know what you'll say, "You allow spotify?. Yes, but just for me. With decryption disabled spotify works fine, with it enabled it just skips through all the song in my playlist. Any idea what could be causing this?

VincentPresogna · ‎09-10-2019

I would say 5.0.4. I have been running it since it's release with out issue.

Date Registered	‎08-21-2018 10:49 AM
Date Last Visited	a week ago
Total Messages Posted	43
Total Likes Received	13

Online Status	Offline
Date Last Visited	a week ago

Strata

Prisma

Cortex

About VincentPresogna