About dusk2dusk

So I know you can search for individual AV profiles, URL etc. etc. but I want to search for Security Profile GROUPS in Security Policy screen.  You can search on the Security Policy screen 'profile-setting/profiles/virus/member eq My-Virus-Profile' so how do you do group?   ... View more

I have opened this with TAC a while ago but I continue having issues with Layer 3 not passing through the untrust/internet interface at random times.  I have had this happen 5 to 10 times on different PA-200's.  Some have repeated.  I was hoping a firmware upgrade to 6.1.3 would finally fix this but yesterday one of my first 6.1.3 units locked up.  Layer 2 is fine.  I look in my router and the ARP entry for the PAN is in there.  I clear ARP table and it repopulates with MAC/IP as the PAN responds correctly.  Rebooting the router doesn't do anything for the PAN to pass Layer 3 again.  The only way to get PAN to pass Layer 3 again is a reboot of the PAN itself.  We are running LSVPN on all spoke sites for VPN and the only curveball is that my hubs are on older 6.0.5h3 code.  Just throwing this out there for discussion in case others have seen it.  ... View more

I am having some issues as well with 6.1.2 and LSVPN to hub which is on 6.0.5h3.  This is vaguely referenced here by others Anyone use 6.1.2? Is it stable where everyone affected, says yeah there's this IPSEC issue and never actually describes what they are seeing.  So I'm going to detail what I am seeing.   I had two PA-200 devices overnight go offline, same ISP(Could have been coincidence) on US-EST but at different times.  My routers could see each other properly at either end but the PA-200 satellite devices would not respond on their public facing IP's at all.  I could route right up to the devices but could not get in on https via port 4443 or via ssh.  Definitely seemed like a bug that might have been caused by some blip in the ISP maybe but the only way to fix it was to reboot the devices.  As soon as they rebooted LSVPN came back up. Reading through the satellite's syslogs at the time the device went down, there's no particular indication other than 'GlobalProtect Satellite connection to gateway failed.  Satellite failed to connect to Gateway 'IP-w.x.y.z' due to "connection failed".'  This error continued until we rebooted the PA-200's at which point they immediately came back.  Devices showed in ARP on routers and everything but they wouldn't respond whatsoever to any Layer3 requests/comm.  It's like the security and interface management policies just plain failed.  *** An additional but somewhat related issue I have been having is with devices indicating active LSVPN connections but in fact they are not passing any traffic.  Tunnel monitor is set to the hub device's tunnel interface IP.  This only happens to one device at a time and all other of my 40 or so PA-200's stay active without issue.  It seems sometimes this happens when the IP changes in a failover scenario and others it seems like it just drops off after a rekey.  I know there are some fixes in indicated in 6.1.2 for this and since my hubs are not yet on 6.1.2 I did not reach out to support on this yet.  But now I don't think we can go to 6.1.2 if there is a known bug/issue.  I had to have people drive in and reboot these thigns in the middle of the night.  Needless to say they are not feeling very happy about our 'upgrade' to Palo Alto from tried and true but old Netscreen/SSGs. ... View more

I have a PA-200 with 6.1.0.  I can SSH in fine to mgmt.  When I try GUI, I get to the login page.  When I login with correct credentials it says Session Timed Out.  I think it's a disk space issue. When I show system disk-space SDA2 is at 100%.  Everything looked to still be working fine behind the scenes, ie traffic flow until I did a full restart on the box.  Now just management interface is accessible via CLI and no GUI, same error.  However, now no traffic flows on dataplane and I see no active hardware interfaces.  Yet it still looks like everything is correct in config.  Even Panorama connects fine but I am afraid to shoot out a config because it is a remote site. Feels like a disk space issue and it can't load the config fully.  ... View more