About BSadozai

Hello, I had issue with URL dynamic filter, in fact dynamic URL filtring stopped to work, and after some searching I found your suggestion to delete URL filtering cache by this process, but I was unable to restart the process (device-server) Job fail. so finaly I reboot the box and the dynamic URL filtering worked again, my question is there any other way to restart this process without rebooting the device ? Thanks ... View more

Hello, Thanks for the link, but I followed the process described on this doc till point 4. And I had the status of the HA (no fonctional “peer version mismatch or not the same”)  and at this point my understanding is that the HA is not functional and if I went to point 6  to suspend the second device I have had a loss of connectivity and didn’t know if the upgraded device will take the active role and if yes after how many time, as I didn’t plan on this evening any downtime of our internet line I did a rollback First suspend the active unit from the CLI run the command: > request high-availability state suspend or From the GUI go to Device > High Availability > Operations > Suspend local device. Note: This will cause an HA failover. It is recommended to do this first to verify the HA functionality is working before initiating the upgrade. Verify network stability on the new active device with the previously active device suspended. Install the new PAN-OS on the suspended device, then reboot the device to complete the install. When the upgraded device is rebooted, the CLI prompt should show passive (or non-operational, if on a different major release ie 4.0 to 4.1) and the PAN-OS version should reflect the new version. On current passive device, verify auto commit completes successfully (FIN OK) by running command: show jobs all before proceeding to the next step. Suspend second device (should be current active device). Upgrade the second device, then reboot it. When second device restarts, the first device that was already upgraded takes over as active. As HA functionality was verified (step 1) and the config was successfully pushed to the dataplane on the new PAN-OS (step 5), the failover should be seamless. When the second unit reboots it will come up as the passive unit. Validate the auto commit completes on this device by running command: show jobs all on this device (as done in step 5) to complete the upgrade. The original active device before the upgrade will be the active device now. Thanks for your comment BES ... View more

Thanks for your quick answer, but in fact I already did that, i mean I downloaded on both my devices active and passive first v5.0.0 (without installing as was specified by the device, just download) and after that I downloaded the v5.0.1 and installed on passive unit, but after the reboot of the passive unit I had the status non fonctional and on the active I saw the HA status ( something like peer non fonctional (peer version nocompatible or mismatch) so I did the downgrade. Could be very helpfull from Palo to have a official process or doc for that, I really dont understand way there is no doc for that. thanks alot BES ... View more

Hello everyone, I wanted to upgrade our PAN 2050 yesterday evening from 4.1.8 to 5.0.1 directly and had issue with error message on my active unit seeing that (peer non functional and peer version no compatible or not the same as local, something like that). After searching and didn't find any doc that explain the process upgrade from 4.1.x to 5.0.X I did a downgrade, and today I saw this discussion that is very helpful. do you thing that I have follow the same process described here to upgrade to 5.0.1 and do you thing that is really mandatory to pass first by 5.0.0 before going to 5.0.1.? Thanks for your help BES ... View more

It work, many thanks for your help. BES ... View more

Hi, I have just a small question about the DoS profile, for a test I configured the profile with the value below for Syn flood: Alarm Rate (packets/sec) 50 Activate Rate (packets/sec) 50 Maximal Rate (packets/sec) 800 Block Duration (seconds) 300 After flooding with 100pps I can see on the threat log that syn flood was detected and randomly was dropped, but how about the first value (Alarm Rate) where I should receive the Alarm ? as above I should receive an alarm after 50pps ? Thanks for your help Regards ... View more

Hi, Thanks for your quick answer. This is greate. Regards ... View more

Hello, Thanks for your comment, in fact I know all those settings, but my question is about the purpose of this alarm, if I cannot configure the log rotation I mean if I cannot setup (without asking to the Sales engineer about a customized feature) the system to purge certain volume of logs when it reach for example 90% of quota, I don’t see the purpose of this alarm. And what happen on the device if I disable the alarm and the quota is full every time ? its impact the performance of the devices ? I know as explained above that the new logs will continue to write. Thanks ... View more

Hello, Thanks for your replay, so if I understand your explanations, till the quota that I configured for the traffic logs (traffic: 40.00%, 47.654 GB) is not reached by the logs  without index the device will not purge logs ? as you can see below the traffic log on my device was reached at (traffic: Logs: 22G, Index: 27G “total 49G” but logs only 22G) so what you mean is that only when the logs part (in my case 22G) is reached to 47.654GB the device will start purging ? If this why there is alarm indicating that the current size (49GB) of traffic log database exceeds alarm threshold value (90%) of total allowed size (47.654 GB) ? and what I can do to not have this alarm ? Thanks ... View more

Hi, Thanks for your answer but our device doesn’t purge logs when quota size for traffic log is exhausted: **********5.10.2012 - 16:00 Quotas:              traffic: 40.00%, 47.654 GB traffic: Logs: 12G, Index: 14G **********08.10.2012 - 10:00 Quotas:              traffic: 40.00%, 47.654 GB               threat: 8.00%, 9.531 GB               system: 4.00%, 4.765 GB               config: 4.00%, 4.765 GB                alarm: 3.00%, 3.574 GB                trsum: 7.00%, 8.339 GB          hourlytrsum: 3.00%, 3.574 GB           dailytrsum: 1.00%, 1.191 GB          weeklytrsum: 1.00%, 1.191 GB                thsum: 2.00%, 2.383 GB          hourlythsum: 1.00%, 1.191 GB           dailythsum: 1.00%, 1.191 GB          weeklythsum: 1.00%, 1.191 GB              appstat: 12.00%, 14.296 GB               userid: 1.00%, 1.191 GB             hipmatch: 3.00%, 3.574 GB    application-pcaps: 1.00%, 1.191 GB         threat-pcaps: 1.00%, 1.191 GB   debug-filter-pcaps: 1.00%, 1.191 GB          hip-reports: 1.00%, 1.191 GB             dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 14G, Index: 17G threat: Logs: 524M, Index: 452M system: Logs: 5.3M, Index: 3.2M config: Logs: 167M, Index: 1.4M alarm: Logs: 116K, Index: 68K trsum: Logs: 1.9G, Index: 1.9G hourlytrsum: Logs: 2.9G, Index: 420M dailytrsum: Logs: 1.1G, Index: 160M weeklytrsum: Logs: 170M, Index: 26M thsum: Logs: 199M, Index: 43M hourlythsum: Logs: 112M, Index: 21M dailythsum: Logs: 36M, Index: 8.9M weeklythsum: Logs: 24M, Index: 4.6M appstatdb: Logs: 28M, Index: 12M userid: Logs: 655M, Index: 316K hipmatch: Logs: 16K, Index: 16K application-pcaps: 149M threat-pcaps: 4.0K debug-filter-pcaps: 8.0K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K **********09.10.2012 - 10:00 Quotas:              traffic: 40.00%, 47.654 GB               threat: 8.00%, 9.531 GB               system: 4.00%, 4.765 GB               config: 4.00%, 4.765 GB                alarm: 3.00%, 3.574 GB                trsum: 7.00%, 8.339 GB          hourlytrsum: 3.00%, 3.574 GB           dailytrsum: 1.00%, 1.191 GB          weeklytrsum: 1.00%, 1.191 GB                thsum: 2.00%, 2.383 GB          hourlythsum: 1.00%, 1.191 GB           dailythsum: 1.00%, 1.191 GB          weeklythsum: 1.00%, 1.191 GB              appstat: 12.00%, 14.296 GB               userid: 1.00%, 1.191 GB             hipmatch: 3.00%, 3.574 GB    application-pcaps: 1.00%, 1.191 GB         threat-pcaps: 1.00%, 1.191 GB   debug-filter-pcaps: 1.00%, 1.191 GB          hip-reports: 1.00%, 1.191 GB             dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 15G, Index: 19G threat: Logs: 543M, Index: 470M system: Logs: 5.4M, Index: 3.2M config: Logs: 175M, Index: 1.4M alarm: Logs: 116K, Index: 68K trsum: Logs: 1.9G, Index: 2.0G hourlytrsum: Logs: 2.9G, Index: 423M dailytrsum: Logs: 1.1G, Index: 160M weeklytrsum: Logs: 170M, Index: 26M thsum: Logs: 204M, Index: 44M hourlythsum: Logs: 117M, Index: 22M dailythsum: Logs: 38M, Index: 9.3M weeklythsum: Logs: 24M, Index: 4.6M appstatdb: Logs: 29M, Index: 13M userid: Logs: 675M, Index: 320K hipmatch: Logs: 16K, Index: 16K application-pcaps: 151M threat-pcaps: 4.0K debug-filter-pcaps: 8.0K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K **********10.10.2012 - 16:00 Quotas:              traffic: 40.00%, 47.654 GB               threat: 8.00%, 9.531 GB               system: 4.00%, 4.765 GB               config: 4.00%, 4.765 GB                alarm: 3.00%, 3.574 GB                trsum: 7.00%, 8.339 GB          hourlytrsum: 3.00%, 3.574 GB           dailytrsum: 1.00%, 1.191 GB          weeklytrsum: 1.00%, 1.191 GB                thsum: 2.00%, 2.383 GB          hourlythsum: 1.00%, 1.191 GB           dailythsum: 1.00%, 1.191 GB          weeklythsum: 1.00%, 1.191 GB              appstat: 12.00%, 14.296 GB               userid: 1.00%, 1.191 GB             hipmatch: 3.00%, 3.574 GB    application-pcaps: 1.00%, 1.191 GB         threat-pcaps: 1.00%, 1.191 GB   debug-filter-pcaps: 1.00%, 1.191 GB          hip-reports: 1.00%, 1.191 GB             dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 17G, Index: 21G threat: Logs: 565M, Index: 498M system: Logs: 5.5M, Index: 3.3M config: Logs: 179M, Index: 1.5M alarm: Logs: 116K, Index: 68K trsum: Logs: 2.0G, Index: 2.0G hourlytrsum: Logs: 3.1G, Index: 417M dailytrsum: Logs: 1.1G, Index: 160M weeklytrsum: Logs: 170M, Index: 26M thsum: Logs: 209M, Index: 46M hourlythsum: Logs: 124M, Index: 23M dailythsum: Logs: 40M, Index: 9.6M weeklythsum: Logs: 24M, Index: 4.6M appstatdb: Logs: 30M, Index: 13M userid: Logs: 696M, Index: 324K hipmatch: Logs: 16K, Index: 16K application-pcaps: 158M threat-pcaps: 4.0K debug-filter-pcaps: 8.0K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K **********11.10.2012 - 09:00 Quotas:              traffic: 40.00%, 47.654 GB               threat: 8.00%, 9.531 GB               system: 4.00%, 4.765 GB               config: 4.00%, 4.765 GB                alarm: 3.00%, 3.574 GB                trsum: 7.00%, 8.339 GB          hourlytrsum: 3.00%, 3.574 GB           dailytrsum: 1.00%, 1.191 GB          weeklytrsum: 1.00%, 1.191 GB                thsum: 2.00%, 2.383 GB          hourlythsum: 1.00%, 1.191 GB           dailythsum: 1.00%, 1.191 GB          weeklythsum: 1.00%, 1.191 GB              appstat: 12.00%, 14.296 GB               userid: 1.00%, 1.191 GB             hipmatch: 3.00%, 3.574 GB    application-pcaps: 1.00%, 1.191 GB         threat-pcaps: 1.00%, 1.191 GB   debug-filter-pcaps: 1.00%, 1.191 GB          hip-reports: 1.00%, 1.191 GB             dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 18G, Index: 22G threat: Logs: 577M, Index: 509M system: Logs: 5.5M, Index: 3.3M config: Logs: 179M, Index: 1.5M alarm: Logs: 132K, Index: 76K trsum: Logs: 2.1G, Index: 2.1G hourlytrsum: Logs: 2.9G, Index: 419M dailytrsum: Logs: 1.1G, Index: 160M weeklytrsum: Logs: 170M, Index: 26M thsum: Logs: 214M, Index: 47M hourlythsum: Logs: 126M, Index: 23M dailythsum: Logs: 41M, Index: 10M weeklythsum: Logs: 24M, Index: 4.6M appstatdb: Logs: 31M, Index: 14M userid: Logs: 706M, Index: 328K hipmatch: Logs: 16K, Index: 16K application-pcaps: 163M threat-pcaps: 4.0K debug-filter-pcaps: 8.0K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K **********12.10.2012 - 10:00 Quotas:              traffic: 40.00%, 47.654 GB               threat: 8.00%, 9.531 GB               system: 4.00%, 4.765 GB               config: 4.00%, 4.765 GB                alarm: 3.00%, 3.574 GB                trsum: 7.00%, 8.339 GB          hourlytrsum: 3.00%, 3.574 GB           dailytrsum: 1.00%, 1.191 GB          weeklytrsum: 1.00%, 1.191 GB                thsum: 2.00%, 2.383 GB          hourlythsum: 1.00%, 1.191 GB           dailythsum: 1.00%, 1.191 GB          weeklythsum: 1.00%, 1.191 GB              appstat: 12.00%, 14.296 GB               userid: 1.00%, 1.191 GB             hipmatch: 3.00%, 3.574 GB    application-pcaps: 1.00%, 1.191 GB         threat-pcaps: 1.00%, 1.191 GB   debug-filter-pcaps: 1.00%, 1.191 GB          hip-reports: 1.00%, 1.191 GB             dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 20G, Index: 24G threat: Logs: 595M, Index: 527M system: Logs: 5.6M, Index: 3.4M config: Logs: 183M, Index: 1.5M alarm: Logs: 168K, Index: 104K trsum: Logs: 2.2G, Index: 2.1G hourlytrsum: Logs: 2.8G, Index: 415M dailytrsum: Logs: 1.1G, Index: 159M weeklytrsum: Logs: 170M, Index: 26M thsum: Logs: 219M, Index: 49M hourlythsum: Logs: 131M, Index: 24M dailythsum: Logs: 43M, Index: 11M weeklythsum: Logs: 24M, Index: 4.6M appstatdb: Logs: 32M, Index: 14M userid: Logs: 723M, Index: 332K hipmatch: Logs: 16K, Index: 16K application-pcaps: 169M threat-pcaps: 4.0K debug-filter-pcaps: 8.0K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K **********12.10.2012 - 17:00 Quotas:              traffic: 40.00%, 47.654 GB               threat: 8.00%, 9.531 GB               system: 4.00%, 4.765 GB               config: 4.00%, 4.765 GB                alarm: 3.00%, 3.574 GB                trsum: 7.00%, 8.339 GB          hourlytrsum: 3.00%, 3.574 GB           dailytrsum: 1.00%, 1.191 GB          weeklytrsum: 1.00%, 1.191 GB                thsum: 2.00%, 2.383 GB          hourlythsum: 1.00%, 1.191 GB           dailythsum: 1.00%, 1.191 GB          weeklythsum: 1.00%, 1.191 GB              appstat: 12.00%, 14.296 GB               userid: 1.00%, 1.191 GB             hipmatch: 3.00%, 3.574 GB    application-pcaps: 1.00%, 1.191 GB         threat-pcaps: 1.00%, 1.191 GB   debug-filter-pcaps: 1.00%, 1.191 GB          hip-reports: 1.00%, 1.191 GB             dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 20G, Index: 25G threat: Logs: 600M, Index: 536M system: Logs: 5.6M, Index: 3.4M config: Logs: 187M, Index: 1.5M alarm: Logs: 172K, Index: 104K trsum: Logs: 2.2G, Index: 2.2G hourlytrsum: Logs: 3.0G, Index: 436M dailytrsum: Logs: 1.1G, Index: 159M weeklytrsum: Logs: 170M, Index: 26M thsum: Logs: 219M, Index: 50M hourlythsum: Logs: 133M, Index: 24M dailythsum: Logs: 43M, Index: 11M weeklythsum: Logs: 24M, Index: 4.6M appstatdb: Logs: 32M, Index: 14M userid: Logs: 730M, Index: 332K hipmatch: Logs: 16K, Index: 16K application-pcaps: 170M threat-pcaps: 4.0K debug-filter-pcaps: 8.0K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K **********15.10.2012 - 9:00 Quotas:              traffic: 40.00%, 47.654 GB               threat: 8.00%, 9.531 GB               system: 4.00%, 4.765 GB               config: 4.00%, 4.765 GB                alarm: 3.00%, 3.574 GB                trsum: 7.00%, 8.339 GB          hourlytrsum: 3.00%, 3.574 GB           dailytrsum: 1.00%, 1.191 GB          weeklytrsum: 1.00%, 1.191 GB                thsum: 2.00%, 2.383 GB          hourlythsum: 1.00%, 1.191 GB           dailythsum: 1.00%, 1.191 GB          weeklythsum: 1.00%, 1.191 GB              appstat: 12.00%, 14.296 GB               userid: 1.00%, 1.191 GB             hipmatch: 3.00%, 3.574 GB    application-pcaps: 1.00%, 1.191 GB         threat-pcaps: 1.00%, 1.191 GB   debug-filter-pcaps: 1.00%, 1.191 GB          hip-reports: 1.00%, 1.191 GB             dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 22G, Index: 27G threat: Logs: 639M, Index: 570M system: Logs: 5.7M, Index: 3.5M config: Logs: 187M, Index: 1.5M alarm: Logs: 208K, Index: 116K trsum: Logs: 2.3G, Index: 2.3G hourlytrsum: Logs: 3.1G, Index: 439M dailytrsum: Logs: 1.1G, Index: 159M weeklytrsum: Logs: 212M, Index: 32M thsum: Logs: 233M, Index: 52M hourlythsum: Logs: 141M, Index: 26M dailythsum: Logs: 46M, Index: 11M weeklythsum: Logs: 30M, Index: 5.8M appstatdb: Logs: 34M, Index: 15M userid: Logs: 762M, Index: 344K hipmatch: Logs: 16K, Index: 16K application-pcaps: 183M threat-pcaps: 4.0K debug-filter-pcaps: 8.0K dlp-logs: 4.0K hip-reports: 1.1M wildfire: 4.0K So my question is how can I configure the box to clean for example 20% of traffic logs when it reach 90 or 100%, it should be configurable this is a basic configuration that have to be available? Thanks ... View more

Hello, This is not very clear on Palo box, since months we have issue that every week we have alarm indicating that the log was exceeded 80 of the quota, in fact we want to log all traffics and don’t want to disable logging on some rules, I monitored during the week the logdb-quota and Palo don’t clear/purge or delete older log at 80%, we opened a case on Palo support from three weeks and the only response we get is that we have to disable some logging on our rules. So will be grate that Palo clarify this issue and response the question below: Is Palo box purge/clear or delete older logs or it overwrite older logs ? If it  purge/clear or delete, how many volume or % ? Is there a specific time that Palo box do this or it do it as soon as 80% was reached ? Is there a way to configure Palo box to clear or deleted older logs from specific time ? if not way ( this is basic configuration of system that have to be available) How can we sort out this issue? Without disabling logging on some rules? Thanks for your answer and help ... View more