About kprakash

Did the system logs show that the VPN was down? If so, I think its then a GUI issue. What is the PANOS version that the box is running on? ... View more

Carpediem, Do you mean that the outage was for 3 hours, and yet the status lights were green during these 3 hours? We dont have any other extra configuration for the WEB GUI to reflect the correct status. In all my prior experience, I have seen the appropriate status show up whenever the tunnel went down ( even with both automatic and manual page refreshes, and on the cli ). The next time you encounter this issue, please raise a ticket with the TAC. ... View more

Hello, Were the colours of the VPN, green and red, even with multiple page refreshes? The screenshot below shows the status of the IKE and the IPSEC. The first one on the left, shows the status of IPSEC-ESP and the one on the right, shows the status of the IKE. Again that depends on how long the outage was. All though the Lifetime of IPSEC-ESP and IKE can be ( like by default ) 1 hour and 8 hours respectively, the session timeout values for IPSEC-ESP and IKE are 3600 secs and 30 secs respectively. Lifetime determines the amount of time that the parties have to wait before they rekey again. Once a VPN is up, the firewall maintains sessions for IKE and IPSEC-ESP. If the firewall doesn't receive packets within the session timeout values, it discards the session. That being the case, had there been an outage, the session for IPSEC-ESP would still remain active for a longer duration than the IKE session ( When there is an ISP outage, no ESP or IKE packets would reach either firewall). Whenever a tunnel goes down, the firewall logs these events with a high severity, and we have the ability to send these events to a syslog server. You can get faster alerts of VPNs going down, by using SNMP servers, or through syslog servers, instead of relying on the WEB GUI. Hope that helps! BR, Karthik RP ... View more

Here is an old document, but the concept and the steps still holds good while building VPNs for overlapping subnets. https://live.paloaltonetworks.com/docs/DOC-1594 You will require Static Bi directional NAT configuration in order to have a seamless flow of traffic for these over lapping subnets, via the VPN BR, Karthik ... View more

Hi Rob, I am having difficulties following you. May I know the "group" that you are particularly interested in? Do you see that "group" under the "show user group list" output? If so, when you search for users under that group, do you see any users in that group ? Can you paste the output of the commands that I had requested. Alternatively, if you type in the below command: > show user user-IDs match-user <user>   <value>  Show only the user(s) that match the string do you see the user belonging to the "group" that you are expecting to see? You can also verify if its not just a PANFW issue, by installing the softera browser ( or any other LDAP browser )on your PC, and check if you can retrieve the members of that group on your PC BR, Karthik ... View more

The Signature matching is done on a different chip or performed on a software thread depending on the platforms. The security policy check for the traffic happens prior to the signature check, and its performed on another chip ( octeon ), before the traffic is fed to the signature matching engine ( chip )  ... View more

The below command displays the list of groups that the PANFW learns from the AD. > show user group list You should see one such group in that list with "cn=user, ...." To check if the PANFW is learning about users belonging to that group, you can use the below command >show user group name <group name> You can also refer to the below document: https://live.paloaltonetworks.com/docs/DOC-4994 ... View more

The PANFW has the internal logic to determine which traffic is subjected to offloading. The rule of thumb being that any traffic that does not require signature inspection ( for both application determination and threat checks ) is offloaded to the hardware processor. Like mentioned before, sessions for SSL traffic ( which is encrypted and the firewall cannot determine the signature ), application overridden traffic ( admin creates such custom application because he/she trusts such applications ), etc are offloaded. ... View more

Do you see a red line, on the box as shown below? If you click on this red line, you can see the reason for the error. BR, Karthik ... View more

Here are a couple of options: a) If the "Adjust TCP MSS" Option, did not work, can you verify what Encryption Standards are being used? Group 5 ( Asymmetric Key Encryption ) and AES ( Symmetric key Encryption ) Standards are more CPU extensive than Group-2 or 3DES. Does the performance improve with Group 2 and 3DES? b) Slowness of Transfers across VPN tunnels are usually seen when the ESP packets are either fragmented, or when the packets themselves come out of sequence before they are being encrypted. ( the firewall performs checks for the TCP anomolies before it can encrypt these packets in the ESP headers ). Please check for any asymmetric routing issues. c) Check if there is any QoS applied for the tunnel traffic that might be rate limiting the tunneled traffic. d) Applications like SMB and FTP do not get offloaded to the Hardware offloading chip, and all the packets are subjected to signature checks in the dataplane chips ( for any application shifts). If the client and the server are trusted entities, we can disable server response inspection for the rule permitting this traffic: Select 'Options' at the far right of the  Security policy & check the option for 'Disable Server Response Inspection'. Commit & attempt your download tests. (Though you could probably give this option a test regardless & compare performance) e) If the performance is still not that great, an alternative to point 'd' is to create a custom app for the SMB and / or FTP traffic, and use it under an app override. With this setting, we bypass the signature check for this traffic, and hence can expect better results. Refer to the below doc for configuring Application override for certain traffic. https://live.paloaltonetworks.com/docs/DOC-1071 Hope that helps. BR, Karthik RP ... View more