About rvandegrift

rvandegrift · ‎01-23-2015

I guess there's no other option - seems like there's no other way to get at this data. Shame its so hard to collect some simple counters!

rvandegrift · ‎01-22-2015

I was hoping to get something we could feed into our monitoring system, so that our NOC will be alerted automatically. We have the emails setup, and they are helpful when you're looking at email - but it doesn't really scale for automated monitoring.

rvandegrift · ‎01-22-2015

That looks potentially promising - we could pull those counters into our monitoring system and alert on their incrementing. Unfortunately I can't get the data from the API. If I call "<show><high-availability><control-link><statistics></statistics></control-link></high-availability></show>", the response looks like this: <response status="success"> <result> <enabled>yes</enabled> <group> <mode>Active-Active</mode> <control-stats/> </group> </result> </response> So there is some data there, but we can't get at it programmatically.

rvandegrift · ‎01-22-2015

Yes - we have HA heartbeat backup configured. It doesn't really help - or at least, it doesn't help enough.

rvandegrift · ‎01-21-2015

How have folks setup automated monitoring of HA status and session sync? We see HA instability on a 5060 A/A cluster during periods of high load. The boxes get too busy to respond to HA messages, lose heartbeat, and start to think the links have failed. Normally, they recover automatically when the load decreases. But this weekend, we had a case where HA1 heartbeat did not return, and session sync failed as a result. But I can't figure out what to poll. There's nothing about HA in SNMP. So I'm looking at the CLI/API. "show high-availability state" seems to display the configuration, not the status. And it doesn't give specific status info for the each HA link, heartbeats, or sync. "show high-availability state-synchronization" looks promising, but I can't tell if it's reporting configuration or status. Ross

rvandegrift · ‎12-17-2014

I thought this was it, but nope - I disabled the AV profile packet capture yesterday, but there are thousands of new pcaps today: admin@firewall(active-primary)> view-pcap application-pcap 20141217/ Display all 16625 possibilities? (y or n) I've exported the device config and the Panorama config to grep through. All capture options are disabled in both places. Are there conditions under which a device might capture packets anyhow? Ross

rvandegrift · ‎12-16-2014

That's it - it looks like we have an AV profile that has a capture set for some hits. Thanks! Ross

rvandegrift · ‎12-16-2014

Hello, I've noticed a boatload of application-pcaps - between 5-15k, on days where they are captured. There are captures from most days, but not every day. As far as I know, I don't have any traffic captures enabled. All of the following show that captures are disabled: 1. debug dataplane packet-diag show setting (capture and logs disabled on all dataplanes) 2. show running application setting (unknown capture and application capture are disabled) 3. debug ike pcap show (no ipsec config anyhow) What else could be triggering these captures? Maybe they are used as a part of some firewall feature? This is on PA-5060 running 6.0.5. Ross

rvandegrift · ‎12-16-2014

I'm not authorized to view the second link. Is there a public version? It looks like creating an App override requires either specifies static ports & protocol, or writing signatures. Specific ports won't work, since apps like Skype dynamically choose them - hence why there's an ALG! But it also isn't practical for me to write signatures for all of the protocols that have an ALG implemented. Ross

rvandegrift · ‎12-09-2014

Hello, We're having a few issues with predict sessions begin created erroneously and unnecessarily. The SIP ALG can be disabled, but when I tried the same process for other applications (ftp, skype, rtmpe, etc), there was no ALG option. How can these ALGs be disabled? Thanks, Ross

rvandegrift · ‎11-04-2014

What makes you think that the first comment applies to reconnaissance protection? The quote above is from the flood protection section.

rvandegrift · ‎11-04-2014

Hello, Palo Alto's documentation is inconsistent on the behavior of flood protection when it is applied by a zone protection policy. 1) "Threat Prevention Deployment Tech Note - Version 2.0 RevA", page 44 says that the zone protection based flood protection applies per source-destination-port tuple: "Configure Flood Protection settings based on the number of packets you want to allow to each service behind the firewall. Settings apply to all traffic that enters the network through any interface in the zone on which the Zone Protection Profile is active, but a separate counter is maintained for each source IP/destination IP/destination port tuple." 2) "Threat Prevention Deployment Tech Note - Version 2.0 RevA", page 45 directly contradicts this: "Flood Protection enabled under Zone Protection is applied to the aggregate traffic seen on a specific zone. It will maintain a single counter for all traffic, regardless of source IP/destination IP/destination port." Which is correct? Thanks, Ross

rvandegrift · ‎11-03-2014

Sorry to follow up to an old post, but I'm interested in understanding more about this issue. You say high packet descriptors indicates lots of dataplane traffic is being processed - can you elaborate? Is this any traffic handled in the dataplane, is it only slowpath dataplane traffic, traffic subject to DoS policy, etc? I've seen degraded performance on a PA-5060 running 6.0.3, with high packet descriptors, and I'm trying to understand the cause. There was a large spike in DNS traffic at the time, but almost all of it was dropped by a DoS policy. The permitted DNS traffic was much lower in volume and sessions than other normal traffic - approximately 4000-6000 sessions of it were active, compared to a total of 1.2 million sessions. According to the specs, a 5060 can setup 120k sessions per second. I assumed that means full session setups, and excludes packets denied by DoS protection policies. Is this understanding correct?

rvandegrift · ‎09-25-2014

PAN-OS includes bash, which means it is likely vulnerable: test-box> debug cli detail Environment variables : (LANG . en_US.UTF-8) (USER . admin) (LOGNAME . admin) (HOME . /opt/pancfg/home/admin) (PATH . /usr/local/bin:/bin:/usr/bin) (MAIL . /var/mail/admin) (SHELL . /bin/bash) (SSH_CLIENT . 192.0.2.1 57409 22) (SSH_CONNECTION . 192.0.2.1 57409 192.0.2.2 22) (SSH_TTY . /dev/pts/0) (TERM . xterm) (SSH_AUTH_SOCK . /tmp/ssh-vHZslV9235/agent.9235) (LESSCHARSET . utf-8) (PAN_BASE_DIR . /opt/pancfg/mgmt) Build Target : panos-5000-mp Build Type : RELEASE Total Heap : 7.16 M Used : 6.11 M Nursery : 0.12 M

Member Since	‎09-24-2014 01:17 PM
Date Last Visited	‎08-18-2015 09:06 AM
Posts	14

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

About rvandegrift

Re: Monitoring A/A HA status and session sync

Re: Monitoring A/A HA status and session sync

Re: Monitoring A/A HA status and session sync

Re: Monitoring A/A HA status and session sync

Monitoring A/A HA status and session sync

Re: What are these mysterious pcaps?

Re: What are these mysterious pcaps?

What are these mysterious pcaps?

Re: Disabling ALGs other than SIP?

Disabling ALGs other than SIP?

Re: Monitoring A/A HA status and session sync

Re: Monitoring A/A HA status and session sync

Re: Monitoring A/A HA status and session sync

Re: Monitoring A/A HA status and session sync

Monitoring A/A HA status and session sync

Re: What are these mysterious pcaps?

Re: What are these mysterious pcaps?

What are these mysterious pcaps?

Re: Disabling ALGs other than SIP?

Disabling ALGs other than SIP?

Re: Inconsistent documentation on zone protection

Inconsistent documentation on zone protection

Re: Packet Descriptors spike

Re: Is Palo vulnerable to the shell shock Linux bug?

Unlock your full community experience!

About rvandegrift