About emr_1

emr_1 · ‎12-02-2024

I believe sonicwall is not supported. It's not in this list: https://live.paloaltonetworks.com/t5/expedition-articles/expedition-supported-3rd-party-vendor-matrix/ta-p/336922

emr_1 · ‎11-18-2024

You can customize log format. Even there is no document for recent version, refer to 10.0 is enough to understand. FYI: https://docs.paloaltonetworks.com/resources/cef For each log field, another doc is useful. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions

emr_1 · ‎10-17-2024

Oh,okay...then you don't need this license. Just delete it from CLI First, type in question mark to list all license files on your platform delete license key ? Then type in specific file name delete license key <name> Sample: ==== > delete license key ? GlobalProtect_Gateway_2024_05_31.key 2024/08/01 01:57:21 0.3K Logging_Service_2022_08_09.key 2023/12/19 15:52:21 0.3K PAN_DB_URL_Filtering_2023_05_18.key 2023/12/19 15:52:21 0.3K > delete license key Logging_Service_2022_08_09.key ====

emr_1 · ‎10-17-2024

You mean even you are not purchasing Logging Service, your platform has Logging Service license? If you are surely you are not using Logging Service, you can ignore it. (but you will keep receiving alert everyday) If you are using Logging Service for other service, for example; you have Prisma Access, activated Logging Service license will be applied to all devices under same CSP. You need to check internally. If your devices are under control of ASC (Authorized Support Center), ask them. Possibly ASC mistakenly activate their Logging Service and applies to your devices (same logic as above)

emr_1 · ‎10-17-2024

lcaas is Logging Service. You can check your license via CLI with following command : request license info Here is sample output from my lab > request license info License entry: Feature: Logging Service Description: LAB Serial: xxxxxxxx Authcode: Issued: December 18, 2023 Expires: January 05, 2025 <<< I believe this field should be 2024/10/30 on your platform Expired?: no Log Storage TB: 1 If you already have renewed Logging Service on the cloud, please fetch the latest. CLI is "request license fetch"

emr_1 · ‎10-10-2024

https://security.paloaltonetworks.com/PAN-SA-2024-0010 This is not related to PAN-OS (FW/panorama) https://security.paloaltonetworks.com/CVE-2024-9468 This is related to PAN-OS, however, since your platform is PA-5060 and it reaches end-of-life and last supported platform is 8.1, you can not get any information/update for it. I believe nobody knows the answer. FYI https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates

emr_1 · ‎10-01-2024

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000g1umCAA KB is available here. In addition to above, there is no way to stop your pointed message by configuration. Only way is to downgrade GP agent, though you need to take care of EoL for GP v6.0 https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary

emr_1 · ‎09-10-2024

KB is available now. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000Tp7JCAS Resolution The issue will be addressed in the upcoming releases. As a workaround, use one the following options. Uninstall DLP plugin under GUI: Device > Plugin. Downgrade PAN-OS to 10.2.10 or older.

emr_1 · ‎09-10-2024

At first, this doc is helpful. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api/use-the-cli-to-find-xml-api-syntax Here is my test result 1) Check API syntax admin@PA-5410> debug cli on admin@PA-5410> request sc3 reset (container-tag: sc3 container-tag: reset pop-tag: pop-tag:) ((eol-matched: . #t) (confirmation-message: . WARNING: executing this command will reset SC3 state on this device. You will need to re-onboard the system (using an authkey). Do you want to continue?) (context-inserted-at-end-p: . #f)) WARNING: executing this command will reset SC3 state on this device. You will need to re-onboard the system (using an authkey). Do you want to continue? (y or n) <request cmd="op" cookie="8284738022950153" uid="1001"><operations><request><sc3><reset/></sc3></request></operations></request> 2024-09-11 09:56:19 <response status="success"><msg>SC3 has been reset! You need to restart mgmtsrvr to reinit SC3.</msg></response> SC3 has been reset! You need to restart mgmtsrvr to reinit SC3. admin@PA-5410> admin@PA-5410> debug software restart process management-server (container-tag: sdebuoftware container-tag: restart leaf-tag: process value: management-server pop-tag: pop-tag:) ((eol-matched: . #t) (context-inserted-at-end-p: . #f)) <request cmd="op" cookie="1502434451239817" uid="1001"><operations><debug><software><restart><process>management-server</process></restart></software></debug></operations></request> 2024-09-11 09:53:22 #f admin@PA-5410> 2) Check same command by curl. Looks this worked on my platform (PA-5410 v11.1.4) curl --insecure -X POST "https://<my firewall IP>/api/?type=op&cmd=<request><sc3><reset/></sc3></request>&key=<my api key>" curl --insecure -X POST "https://<my firewall IP>/api/?type=op&cmd=<debug><software><restart><process>management-server</process></restart></software></debug>&key=<my api key>"

emr_1 · ‎09-03-2024

Ah, you are using PA-VM, I thought it is related to hardware appliance. Even I'm not familiar with EVE-NG, seems EVE-PRO provides the feature related to link state. If this doesn't work, maybe using path monitoring is easier than link monitoring. https://www.eve-ng.net/index.php/documentation/professional-cookbook/

emr_1 · ‎09-03-2024

From reply for #1, that's the reason. Link Monitoring keeps looking for link status of specified ports. To trigger it, you need to link-down that ports. Try to unplug LAN cable on both ports, I believe it works. (icon will change to RED and fail-over should be occurred)

emr_1 · ‎09-03-2024

I need two more information to answer your question. #1 Does the status of eth1/2 and 1/3 change to linkdown after you shutdown G0/0? In another words, GREEN should be changed to RED as below. #2 What is the device status of peer device? Fail-over occurs only when peer device is ready for fail-over which means peer device have to be "passive" if you are configuring active-passive. If it is other status such as non-functional, suspended, etc., it does not fail over.

emr_1 · ‎09-03-2024

PAN device is stupid from old days, it sometimes purges necessary files (base image). Even this KB is explaining about PA-200, this works on any of my LAB units if I see the issue. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloMCAS Try one of followings. #1 Delete unnecessary images to keep enough disk space. From recent OS, display filter is working, please disable both checkboxes, then delete unnecessary images on the list. #2 install base image first, then install patch image. On your scenario, -download 11.1.0 -install 11.1.0 (no reboot is required) -download 11.1.4-h4 -install 11.1.4-h4 (reboot) If it didn't work, you might need to reboot after installation of 11.1.0.

emr_1 · ‎08-22-2024

How is the condition of each eth1/1-1/4? Are they all UP?

emr_1 · ‎08-14-2024

How did customer configured source IPs? Here is one scenario that my customer misconfigured. - create address object, let say 192.168.1.1 in 24 bit network, with 192.168.1.1/24 - select this object in security policy => this results source address in security policy is 192.168.1.0/24 internally. Is he/she configure source address with 32bit mask or no mask (= 32bit)?

Member Since	‎05-10-2010 06:49 PM
Date Last Visited	‎12-02-2024 09:35 PM
Posts	352
Total Likes Received	117

Online Status	Offline
Date Last Visited	‎12-02-2024 09:35 PM

About emr_1

Re: Sonicwall Firewall v6.5.4 migrate to PaloAlto Next Generation Firewall

Re: Minimize log size

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: CVE ID

Re: How to disable this warning message, or move it to notifications?

Re: PAN-OS 10.2.11 Device -> Setup page missing

Re: request sc3 reset API

Re: HA Link Monitor Issue

Re: The required '11.1.0' base image must be loaded before this image can be loaded

Re: request sc3 reset API

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

Re: Error: Total number of profiles (76) exceeds platform capacity (75)

Re: Where does it show which Agent Config applied to a specific users' Global Protect session

Re: TID 95187 is not on my signature list

Re: what does "SWITCH" in hardware architecture mean?

Re: any solution to keep tracking user IP mapping?

Re: any solution to keep tracking user IP mapping?

Re: [need help]can't see new incoming logs after upgrading M-100 into 8.1.12

Nominated Discussion: What does "SWITCH" in hardware architecture mean?

Nominated Discussion: How to Change Forward Decrypt Trust Certificate

Re: Sonicwall Firewall v6.5.4 migrate to PaloAlto Next Generation Firewall

Re: Minimize log size

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: License for feature lcaas will expire on 2024/10/30

Re: CVE ID

Re: How to disable this warning message, or move it to notifications?

Re: PAN-OS 10.2.11 Device -> Setup page missing

Re: request sc3 reset API

Re: HA Link Monitor Issue

Re: HA Link Monitor Issue

Re: HA Link Monitor Issue

Re: The required '11.1.0' base image must be loaded before this image can be loaded

Re: PA-445 HA Active-Passive , Primary FW shows as Non-functional (Link down)

Re: Security policy not working properly

Nebula Beta

Unlock your full community experience!

About emr_1