About tshiv

Hello cosx, Agree with you.  Life-size is the amount of data that the key can use for encryption and we do keep track of it being decremented so as to re-key once the lifesize limit is reached. But just that it is not displayed unlike Life-time. Since it appears under IPsec crypto profiles, It can monitored through the ">show vpn ipsec-sa" command that you are already aware of. I believe the only way for us to track it live would be through "encap bytes" under show vpn flow command. Thanks ... View more

Hello mr.linus, There is no way to clear the threat pcap database from the command line. Also, the threat pcap will not purge once the daily limit is reached which is 131072 packet capture files. One way to clear the the threat pcaps would be to delete the directory from the root. It has already been confirmed that once deleted, the threat pcap database directory recreates itself in the root. Hope this helps. Thanks ... View more

Hello alex.irzyk, Based on my search, i could not confirm if vmware security manager stores ip-user mappings or generate logs for user login events. Is it possible for vmware security manager to be configured to write ip-user mapping info to a file? If this is possible, then you can try pulling the mappings from the file containing the ip-user mappings through API. The API guide below gives you the format of the input file that will have the ip-user mapping: PAN-OS and Panorama 5.0 XML API Usage Guide Below is the link to the perl script that can be used to confirm if you are able to pull the ip-user mappings using API. Script to test UID XML API Hope this helps. Thanks ... View more

Hello jambulo, I have come across this issue with 5.0.14-h3 software code. It is currently being investigated. It would helpful to us if you can open a support ticket and provide the necessary data. This issue needs to be investigated to find the root cause. Thanks ... View more

markk96, Even though the users are in different locations, It could be possible that the machine (10.1.1.5) is a shared resource that can be accessed from multiple locations by many users. This could explain why the issue might be occurring with multiple users. Thanks ... View more

phild There was reported issue in early 5.0 version wherein the static routes would go missing in the routing table if the interface is selected in the static route. Can you try removing the interface from the route, commit the change and then check the routing table? Thanks ... View more

Netmin Can you try clearing the Browser cache? Also was chrome browser recently updated in your environment? We can also try restarting the l3svc process which kick starts the captive portal setup. The command to do so is shown below: > debug software restart l3-service Thanks ... View more

asabadin It seems that the Mercedes_Bundle does not have the proper chain. Can you please refer to the documents I suggested in my previous post? For you reference: How to Install a Chained Certificate Signed by a Public CA Fix For Error When Importing Chained PEM Format Certificates - Using Text Editor to Re-order Thanks ... View more

rkra Can you make sure the FQDN refresh jobs are not failing. You can check them using the command: > show jobs all thanks ... View more

asabadin, Please follow the documents below that might be of assistance to you : How to Install a Chained Certificate Signed by a Public CA Fix For Error When Importing Chained PEM Format Certificates - Using Text Editor to Re-order The bundle will be imported successfully if the certificate chain is proper. The sirst document shows you what is the proper certificate chain. The second speaks about using a text editor to create a proper certificate chain if the certificate bundle signed by a CA is does not have a proper chain to be imported into PA firewall. Hope this helps. Thanks ... View more

bdunbar Can you let us know what is the message you observe in the status window when you enter the credentials and click apply? Does the message indicate anything related to server certificate or authentication related messages? Thanks ... View more

VSU_ITSEC,, It is recommended to use the dedicated HA ports. But if you are planning on using  a dataplane fiber port, then you will have to make the dataplane port as type HA: Once you have configured it as type HA, you can reference this port under HA settings. Hope this helps. Thanks ... View more

BobW, Not sure about your intentions here. If your aim is to not allow the bit-torrent traffic in and out of your network, why throttle it when you can very much easily block the traffic. Unless I am missing something here. Just wanted to understand the reason behind throttling Bit-torrent traffic. Thanks ... View more

bdunbar Just wanted to add this document to the thread. It gives a step by step configuration assistance to set up pre-logon with self signed certificate on the PAN firewall. How To Configure GlobalProtect SSO With Pre-Logon Access Using Self-Signed Certificates Hope this is helpful to you. Thanks ... View more