About Udupi

Hello Everyone,   I am in the middle of trying to fix an issue with Panorama unable to view traffic or threat logs. Here's the environment, 7 or 8 firewalls forwarding logs to a dedicated collector/group which is just 1 m-100 appliance running in logger mode.   We recently encountered this problem after which, restarted the log and management daemons on the collector and starting seeing the logs on collector. We also have log collector setup to forwarded to an external server which was receiving the latest logs too. However Panorama still doesnt show any recent logs and last logs seen are 2 weeks ago. Below outputs show the collector is sending config and system 'only' which are indeed visible. Source Daemon : unknown Connection Id : 00XXXXXXXXX69 Log rate: 0 Log rate: 0 config 2020/06/15 08:51:41 18 2020/06/15 08:51:40 0 system 2020/10/12 07:32:16 627390 2020/10/12 07:32:00 threat 0 traffic 0 hipmatch 0 gtp 0 userid 0 iptag 0 auth 0 sctp 0   Collector is 'in-sync'  and connected. Attempts to restart the management daemon on panorama did not help, still trying to wonder why recent traffic or threat logs dont show up. Edit: - When i go to collector configuration on Panorama GUI and hit statistics, no data is shown. ... View more

Hello Folks, I am trying to build a site to site vpn between a Palo Alto firewall running 8.1.7 and a Checkpoint firewall. Settings are configured to use IKEv2 only with certificate based authentication.   While the logs below are from lab setup, but the actual client problem are the same. PA and Checkpoint firewall certificates are signed by the same CA, so that the Root CA and present on both firewall to build the chain.   When i am trying to establish the VPN tunnel with Checkpoint being the Initiator, I see below logs on the monitor tab. 'IKEv2 certificate authentication failed. Invalid SIG.' IKEv2 IKE SA negotiation is failed as responder.   Running a debug on ike and viewing the ikemgr log, I see below errors on PA firewal. 2019-05-08 13:56:34.969 +0530 [DEBG]: building cert chain: 2019-05-08 13:56:34.969 +0530 [DEBG]: /CN=cplab.winlocal.com -> 2019-05-08 13:56:34.969 +0530 [DEBG]: /DC=local/DC=lab/CN=lab-WIN-LAB-AD-CA [root] 2019-05-08 13:56:34.969 +0530 debug: pan_ike_cert_check_chain(pan_mp_cert.c:2125): verify result: 1 [0:/CN=cplab.winlocal.com] 2019-05-08 13:56:34.970 +0530 [PERR]: RSA_verify failed: 140737127241472:error:04091064:rsa routines:INT_RSA_VERIFY:algorithm mismatch:rsa_sign.c:269: 2019-05-08 13:56:34.970 +0530 [PERR]: Invalid SIG.   When I make PA firewall as initiator, the VPN works without any issues. Tried looking around knowledge base, didn't find anything. Have anyone come across similar scenarios? ... View more