About Javith

Hi All,   Firewall is connecting to update server. it retrieves all the recent PAN-OS versions and all dynamic updates(app ver).    But when i start to download the software/dynamic updates, its connecting to update server and exchanging some packets but download stuck at 0%   device is registered, restarted managment plane, cleared job id, still stucks at 0% download. no license issue(they have only support license) tried both staticupdates.paloaltonetworks.com and updates.paloaltonetworks.com.  source-isp interface ip to all traffics are allowed. Please suggest ... View more

Hi All,   Some of the sessions are ended with Resource-unavailable reasons. Almost all traffics in these sessions are web-browsing and some updates traffics on port-80.   All https-443 are working fine. this issue happened for 4 hours on last week.  checked here for describtion: https://www.paloaltonetworks.com/documentation/61/pan-os/newfeaturesguide/networking-features/session-end-reason-logging.html   Is there any way to resolve?. Please suggest ... View more

Hi All,   I have configured everything correct. But no entry in LDAP server security logs while I try to login paloalto Web UI using LDAP profile.     Here at pan I can retrieve the all group user. I have configured the auth. Profile to 'all' entry in allow list..tried both domain\username(captive portal working fine with this format) and username alone..Pls suggest     admin@paloalto> tail follow yes mp-log authd.log   2015-11-05 12:35:02.826 +0530 debug: pan_auth_request_process(pan_auth_state_engine.c:1537): Trying to authenticate: <profile: "", vsys: "", username "cslworld\paloaltotest">   2015-11-05 12:35:02.827 +0530 debug: _get_auth_prof_detail(pan_auth_util.c:928): "cslworld\paloaltotest" is an admin user   2015-11-05 12:35:02.849 +0530 Error: pan_auth_cache_get_admin_authprof(pan_auth_cache_adminusers.c:222): No default auth profile found for username paloaltotest   2015-11-05 12:35:02.849 +0530 Error: _get_admin_authentication_profile_by_name(pan_auth_util.c:501): No admin auth prof found with the name paloaltotest   2015-11-05 12:35:02.849 +0530 Error: _get_admin_authentication_profile(pan_auth_util.c:546): No auth prof/vsys is found for admin user "paloaltotest"   2015-11-05 12:35:02.849 +0530 Error: pan_get_authprofile_n_setting(pan_auth_util.c:1029): Failed to get authentication profile for admin cslworld\paloaltotest ... View more

Hi All,   We have configured IPSec VPN between PAN and AWS.    When i iniate the tunnel, IPSec and IKE SA installed successfully as a initiator. then, IKE protocol IPSec SA delete message sent to peer. SPI:0x... After a second, IPSec key deleted. Deleted SA..... please suggest      ... View more

Hi All,   We want to view the traffics in Mbits/sec. We have configured QoS and see the traffics in realtime.    Is there any traffics reports in Mbits?..In Graph, I see the traffics in Bytes.    Please share any alternative ways.. ... View more

Hi All, We configured captive portal-redirect with local db when unknown users(who are not in AD,belongs to local db) redirected and web form is authenticated. But the problem is they can't browse internet. Browser shows" page not loaded" to those users.. Can you tell me possible cause? One more problem.. Users who are logged in via LDAP are disconnected over particular time(in a day).. After restart their PC and log in again..its(user-ip) working. Setting: server session enabled, can i put more minutes in timeout? Please temme possible cause?.. Thanking you ... View more

For particular traffic, session created and security rules hits But URL filtering profile blocks the traffic....when allow the unknown in URL filtering profile -traffics are allowed. In Logs: Packet categorized as Unknown udp... This traffic is Tally ERP 9.0 from client-server. Can i create custom app-id? with pattern or not?..so that the particular traffic internal packets will not be inspected..? Please suggest ... View more

Hi All, my req: isp 1 4mbps(untrust) ->pa 500a->(trust)cisco switch l3a-> isp 2 4mbps(untrust)->pa 500b->(trust)cisco  switch l3b->    same web servers but using  isp 1 &2 public ip's(redundancy purpose) to do static s-nat for web servers external users should use both isp to reach web servers in active/active ha mode->load share/balance.. my config doubts: trust l3 ips connected to cisco switch should be different..right? dns servers for both isp's are different..so i changed default 4.2.2.2/8.8.8.8 to isp dns servers..right? web servers should be exposed to external users-so configured s-nat static and tick bi-directional..right? Please suggest best and simple practise to this requirement and confirm me whether above steps are right? how to do ha active/active..please tell me procedure.. ... View more