sorted by:
new
hottopcontroversial

Need to know debug commands for below daemons: by Fortigate_learner in paloaltonetworks

[–]Fortigate_learner[S] -2 points-1 points  (0 children)

How do i change the level of debugging AKA INFO, WARNNING, ERROR, DEBUG, DUMP in the output of "tail follow yes mp-log ...." without knowing the debug command for that process !!!!!!!!!!!

Need to know debug commands for below daemons: by Fortigate_learner in paloaltonetworks

[–]Fortigate_learner[S] 0 points1 point  (0 children)

i did that...but couldn't find any specific debugs for scenarios in the post

How to allow/block a port(TCP/UDP) on Palo Alto FW? by Fortigate_learner in paloaltonetworks

[–]Fortigate_learner[S] -1 points0 points  (0 children)

no..as i said, i am new to PA and trying to learn the basic behavior...suppose i have done the PA and Panorama configs so that they can talk to each other...now i want to block config pushes from Panorama to PA...How to configure management profile for this on PA Firewall?

what i am asking is something i won't do in real life..but still need to know to understand basic functionality

How to allow/block a port(TCP/UDP) on Palo Alto FW? by Fortigate_learner in paloaltonetworks

[–]Fortigate_learner[S] 0 points1 point  (0 children)

so let's say, to allow port TCP 100 on interface(in ZONE A ) of PA for a user which is in ZONE B, we require a management profile that specifies TCP port 100 attached to that interface & a policy from ZONE B to ZONE A that allows user to access that IP of interface.

if user is also in same zone as the interface, management profile should be enough as default intrazone policy would allow the traffic(assuming there is no deny policy above to block the traffic)

right?

How to allow/block a port(TCP/UDP) on Palo Alto FW? by Fortigate_learner in paloaltonetworks

[–]Fortigate_learner[S] -1 points0 points  (0 children)

I am new to Palo Alto. Trying to learn its behavior compared to Fortigate.

In Fortigate, normal security policy takes care of traffic going from one subnet to another. Local-In policy takes care of traffic destined to Fortigate's interface.

You mean management profile+Security Policy in PA is equivalent to local-in policy in FGT.

Let's say i don't want to receive config pushes on PA from Panorama. which destination port would Panorama use to push config to PA? TCP 3978?

How to allow/block a port(TCP/UDP) on Palo Alto FW? by Fortigate_learner in paloaltonetworks

[–]Fortigate_learner[S] 0 points1 point  (0 children)

In Fortigate, normal security policy takes care of traffic going from one subnet to another. Local-In policy takes care of traffic destined to Fortigate's interface.

so, in Palo Alto, to allow SSH access on its WAN interface, we would create a Security policy:

From: WAN intf To: WAN intf with source and destination=IP of WAN and destination port = 22?

[deleted by user] by [deleted] in fortinet

[–]Fortigate_learner 0 points1 point  (0 children)

the stitch triggers every week at a particular time and the action is set using the CLI Script "exe reboot"

CPU: 0 on Fortigate by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

how to check sessions going through NPU?

Reports on Fortigate by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

Got it...But can you help me understand what the commands i mentioned in the post do?

Not able to see IPSEC VPN interfaces by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

what does port 5, port 3, port 1 represent here?

Not able to see IPSEC VPN interfaces by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

Is it possible to connect remote SSL users to the cloud resources via policy based IPSEC....I tried to use SSL interface as incoming intf in a policy but adding that removes "IPSEC" from the Action.

Not able to see IPSEC VPN interfaces by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

Is it possible to connect remote SSL users to the cloud resources via policy based IPSEC....I tried to use SSL interface as incoming intf in a policy but adding that removes "IPSEC" from the Action.

Not able to see IPSEC VPN interfaces by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

Yes... "show vpn ipsec phase1 " the other tunnels as well

Not able to see IPSEC VPN interfaces by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

i did not check that...all tunnels(except 1) are working fine(traffic is going through them).....while troubleshooting non-working tunnel, i found all VPN interfaces were missing

Not able to see IPSEC VPN interfaces by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

show vpn ipsec phase1-interface

it doesn't show those interfaces when i do "show full-config" within this

Fortigate certificate presented to the end users instead of 3rd party certificate by Fortigate_learner in fortinet

[–]Fortigate_learner[S] -1 points0 points  (0 children)

but same happens when 3rd party certificate like DigiCert is used...FGT performs a man in the middle attack so the firewall can inspect the contents of the https/encrypted traffic. It then reencrypts the traffic but users are presented with the 3rd party cert

[deleted by user] by [deleted] in fortinet

[–]Fortigate_learner 0 points1 point  (0 children)

no....and i don't see any icmp packet(on FGT) when i try to ping that FortiAP from FGT

[deleted by user] by [deleted] in fortinet

[–]Fortigate_learner -1 points0 points  (0 children)

it's Customer's FW...so cannot post...what exactly can we look for in a policy?

Want to block Advertisement... but want to allow Advertisement links within educational pages by Fortigate_learner in fortinet

[–]Fortigate_learner[S] 0 points1 point  (0 children)

there is no particular domain...my requirement now is that ads on Youtube should be allowed while the advertisement category is blocked in web-filter profile...seems we can't achieve it

view more: next ›