About nayubi

The below are the steps to renew GP certificate for Prisma Access on Strata Cloud Manager   *Note in this example we are using Azure as the IDP   Make sure to delete the old certificate on the Azure SAML IdP side Then export the new SAML metadata XML file (which has only the new certificate) from Azure IdP In Strata Cloud Manager(SCM), navigate to Manage > Configurations > NGFW & Prisma Access > Identity Services > Authentication > Server Profiles > SAML, open the existing SAML profile which you use and click on "Import"  under Identity Provider Certificate, to import the new metadata XML file to the SCM console. Now save the SAML profile. After that, navigate to Objects > Certificate Management to verify and confirm that the Azure SAML IdP certificate is automatically renewed. Now do an 'all-admin' push to the Mobile Users template to ensure the update is propagated to the Prisma Access backend nodes (Note: All-admin push is needed, as it will show the changes done by 'System' since the new SAML certificate is extracted from the recently imported XML file) ... View more

How to identify local configuration changes on NGFW’s managed by SCM   First log into SCM and then navigate to the “Manage>Configuration>NGFW and Prisma Access” tabs. Now click on the “Configuration Scope” and find the folders for the firewalls or firewall you want to look at. Now that you are in the configuration scope of “All Firewalls”, make sure you are on the overview tab.  You will now see any conflicts under “Variables”.  Any firewalls with a conflict will show with a link “View Conflicts”.  Click on the link. This will bring you to all the firewalls with a conflict.  You can also see how many conflicts and their locations. Click on a firewall to view the conflicts. On this firewall I can see there are conflicts in the objects in the general and services configurations. When you click on the link to the conflict it will bring you to that part of the configuration.   In this example it takes me to the Device Setup tab.  I can see the configuration on the General Settings tab and Services tab show a conflict with the local device configs. By clicking on the “Show Config Diff” I can see what is configured on the local device versus SCM. This allows you to identify what has been changed and whether or not it needs to be done from SCM.   On the next firewall it shows a conflict with an ethernet port and that it has been overwritten on the local configuration.  By clicking on the link it will take you into the configuration. On the top of the configuration you will see an option to “Show local device configs”.  By sliding the option over you can see what is configured locally.  You can also use the “Show Config Diff” like before to see the difference in the local versus SCM pushed configuration.   ... View more

When looking through Strata Cloud Manager for DLP files seen in log type file, there is a file hash.  This hash is SHA256.     ... View more

Accepting Egress Allocated IP Whitelists on your Prisma Access Mobile-User infrastructure.   When upgrades happen on the backend of your Prisma Access Infrastructure there is an automation flag that requires the customer to "accept" the egress IP whitelists for the configured regions that are used for thier SaaS applications.    To make sure these upgrades go smoothly follow the steps below.   First you will need to go to Strata Cloud Manager and log in.  Then navigate to Workflows -> Prisma Acces Setup -> GlobalProtect.     There should be a box called "Confirmed IP Allowlist Status".  Click on the gear on the top right side to go into the config. If you can not find the above, follow this link in your browser once you have logged into your tenant. https://stratacloudmanager.paloaltonetworks.com/workflows/mobile-users-gp/setup/pa-location-config   Next click on the “Enable Egress IP Allowlist” button. Choose the Enable button and save.   Now go into each region and click on the “Confirm adding to my IP Allowlist” and save the configs.     Next save the config on Prisma Access and push.     ... View more

This doc will walk through how to filter log fields directly from the Strata Logging Service to limit the amount of data being sent out Log Forwarding Profiles via Syslog, HTTPS or Email.   First log into your hub instance at apps.paloaltonetworks.com and click on the tile for Strata Logging Service.   Next click on Log Forwarding to setup your Log forwarding Profiles and any formats or filters.     Once you have setup the Forwarding Profiles, click on test to validate connectivity and then the 'Next" button.   Now you will add which log types you want to send out from Strata Logging Service.   If you want to send all log types, then create a filter with each log type by pulling down the drop down and saving with the default fields for each.     If you also want to filter which fields are sent via those log types, then you will need to click on the hamburger Icon in a field type, then chose the vertical hamburger. In this drop down you can choose which fields you want to forward based on what fields you use.  It will also filter the view as you add or remove fields. Next Save the changes and the Strata Logging Services will make the changes to start forwarding only these fields.                       ... View more

After a DNS failure on Panorama, Cortex Data Lake Status failed with  "failed to validate server certificate for endpoint api.paloaltonetworks.com", in the cloudservices plugin for prisma access. Resolution:  Run the follow commands in Panorama CLI   request plugins cloud_services logging-service status  -  this is to view status of certificate   debug plugins cloud_services reset-endpoint  -  this is to reset endpoint certificate   request plugins cloud_services logging-service status  -  run again to validate success   ... View more