topic Re: Autofocus MineMeld - how to access output node that requires authorisation in General Topics

Autofocus MineMeld - how to access output node that requires authorisation

Nikolay-Matveev — Wed, 13 Sep 2017 16:22:34 GMT

I need to create O365 IP/URL EDLs but when I try to access the output nodes I get "Unauthorised" message unless I sign into AutoFocus in the browser. Needless to say I cannot do the same on a firewall. How do I allow anonymous connections to a feed in Autofocus MineMeld or use authentication when configuring EDL on a firewall?

Re: Autofocus MineMeld - how to access output node that requires authorisation

xhoms — Fri, 03 Nov 2017 05:38:44 GMT

You have to create a "feeduser" and attach it as a TAG to the output node

In the PANOS device:

If running PANOS 8.0, enable client authentication and populate user and password fields.
If running PANOS 7.1 use the basic auth URL syntax (https://<user>:<password>@domain.com/url)

Re: Autofocus MineMeld - how to access output node that requires authorisation

jonnynux — Wed, 27 Sep 2017 15:17:56 GMT

Hi, I'm new working on Minemeld. I have an issue, I want to enable authentication for an output node, but above the
FEEDS USERS manager i had the following message: Warning! authentication for output feeds is disabled
How to enable it?

Thank you

Re: Autofocus MineMeld - how to access output node that requires authorisation

xhoms — Thu, 28 Sep 2017 09:20:35 GMT

@jonnynux : are you using MineMeld hosted in AutoFocus? AFAIK MM in AutoFocus has Authentication for Output feeds enabled by default.

Re: Autofocus MineMeld - how to access output node that requires authorisation

jonnynux — Thu, 28 Sep 2017 09:33:25 GMT

Solved, found this https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Minemeld-Feed-Password-OR-api-security/td-p/131716

Re: Autofocus MineMeld - how to access output node that requires authorisation

msemaniuk — Tue, 31 Oct 2017 22:07:14 GMT

I'm trying to do this, but I must be missing something. I have created a feed user and I have added a tag to the user. I've associated that tab with my feed and that looks good so far. My questions pertains to the modification of the URL.

In the PANOS device use the basic auth URL syntax (https://<user>:<password>@domain.com/url)

My firewall is running 7.1, and I cannot figure out the right syntax to use here. https://user:password@example.com/rest-of-url-copied-from-autofocus generates an unauthorized errror. I can't test the URL now with a browser because the browser believes I am connecting to a site in example.com.

Could you show an actual URL that I could mimick in my configuration? That would be a huge help.

-Mike

Re: Autofocus MineMeld - how to access output node that requires authorisation

xhoms — Tue, 31 Oct 2017 23:02:54 GMT

@msemaniuk : I just tested the syntax in a 7.1 PANOS NGFW and it works in my case.

https://sxxxxxpp:sxxxxx6@dxxxxxff.paloaltonetworksapp.com/feeds/office365_IPv4s

Are you using MineMeld in AutoFocus?

Re: Autofocus MineMeld - how to access output node that requires authorisation

msemaniuk — Wed, 01 Nov 2017 02:18:54 GMT

Yes, it's in autofocus. I believe I see my syntax problem. I will give it a try in the morning!

-Mike

Re: Autofocus MineMeld - how to access output node that requires authorisation

msemaniuk — Wed, 01 Nov 2017 19:43:43 GMT

I have fixed my formatting issue, but I'm not sure that it is resolving things. I can test the URL with an 8.1 firewall. My customer however, cannot get this to work with a 7.1 firewall. I am going to rebuild my PA-200 as 7.1 so that I can try it personally.

This is my format I am using.

https://user:pass@f******.paloaltonetworks-app.com/feeds/the-rest-of-the-url

I've also checked it in a browser and I receive an unauthorized notification.

-Mike

Re: Autofocus MineMeld - how to access output node that requires authorisation

msemaniuk — Thu, 02 Nov 2017 00:31:44 GMT

Turns out my customer was testing in a browser, and not with the firewall. He's good to go with the correct formatting of the URL. Thanks for the help!

-Mike

Re: Autofocus MineMeld - how to access output node that requires authorisation

rschunk — Tue, 28 Nov 2017 18:03:16 GMT

We are trying to get our firewalls to work with Minemeld using Autofocus to load into the firewall via EDLs both URLs and IP lists. All is configured corretly on the AutoFocus Mimemeld including the username and password and tag for the feeder and this tag is also configured in the output processor. We do not have an Admin user configured (just the Feed username and password).

The problem is the firewall in my opinion:

We have the Godaddy cert installed and imported as a 'CA' per the AutoFocus Minemeld techncial documentation (https://www.paloaltonetworks.com/documentation/autofocus/autofocus/autofocus_admin_guide/autofocus-apps/minemeld/use-autofocus-miners-with-the-palo-alto-networks-firewall). We have the username and password corectedly installed with the cert in the EDL object. However we get URL errors when hit the "test" button and cannot pull down the Minemeld list. We tried re-configuring multipe times to make sure we did not mistype the username and password. We do not see any errors in the firewall system log. Software is PAN-OS 8.0.5.

Any ideas?

Thank you, Rich (rschunk@paloaltonetworks.com)

Re: Autofocus MineMeld - how to access output node that requires authorisation

rschunk — Wed, 29 Nov 2017 14:56:41 GMT

After a bit of testing this is what I have found:

- setting the Minemeld output processor tag to anonymous allows any access whether the EDL is configured with or w/o client authentication.

- setting the Minemeld output processor tag to any results in firewall EDL failure with a URL access error. Client authentication in EDL profile is correct (there is not much to confgure...), wget shows Minemeld rejecting the request with a 401.

- setting the Minemeld output processor to a specic tag mapped to a spefifc Feed user also fails. Ciient authentication is corectly configured in the EDL object, wget shows Minemeld rejecting the request with a 401.

My testing is with a standalone Minemeld (since I can not make edits to the SE demo system) but the customer Minemeld is integrated into AutoFocus per my previous message. I am having the customer change to anonymous for now but this is not what they want to do for production.

Rich

Re: Autofocus MineMeld - how to access output node that requires authorisation

xhoms — Wed, 29 Nov 2017 16:55:20 GMT

@rschunk : Are you using the EDL object anywhere in the PANOS configuration? The device will fail to fetch the feed if you're not using it. Even the "test" button reports failure which is confusing.

Re: Autofocus MineMeld - how to access output node that requires authorisation

rschunk — Wed, 29 Nov 2017 17:04:34 GMT

Yes, the EDL is assigned to a security rule and committed in the firewall.

Re: Autofocus MineMeld - how to access output node that requires authorisation

xhoms — Wed, 29 Nov 2017 17:22:03 GMT

@rschunk, could you, please, dig into the ms.log file in the PANOS device (tail follow yes mp-log ms.log while clicking on the "test" button) and into the MM's web server ( minemeld-web.log ) ?

Re: Autofocus MineMeld - how to access output node that requires authorisation

rschunk — Wed, 29 Nov 2017 19:03:47 GMT

At the moment I can do a test URL and everything works with anoynomous as the setting in Minemeld. What is not working is populating the EDLs. I do not see any errors in the tail log, just no update to the firewall.

All EDLs are in a security rule and committed.

Prefer to see everything working with no anoynomous before trying true authentication again.

If you want to jump on a conference bridge we can look at this. Just let me now. Thanks, Rich

Re: Autofocus MineMeld - how to access output node that requires authorisation

lmori — Tue, 26 Dec 2017 07:39:29 GMT

Hi @rschunk,

do you still have this issue?

could you check the article here ? https://live.paloaltonetworks.com/t5/MineMeld-Articles/Connecting-PAN-OS-to-MineMeld-using-External-Dynamic-Lists/ta-p/190414

Thanks,

luigi

Re: Autofocus MineMeld - how to access output node that requires authorisation

Retired Member — Wed, 05 Dec 2018 21:16:28 GMT

I ran into this issue with all the correct parameters set and also had a security rule defined to reference the EDL. Though the 'Test Source URL' link returned an error, clicking on the 'List Entries And Exceptions' Tab, all the entries were there, so might be worth checking that as well. I am running 8.0.12.

In addition you can also run 'show running security-policy <policy_name>' to validate if the entries have populated.

Re: Autofocus MineMeld - how to access output node that requires authorisation

lmori — Thu, 06 Dec 2018 10:09:14 GMT

@Retired Member is correct, the "Test Source URL" button should not be trusted.

Re: Autofocus MineMeld - how to access output node that requires authorisation

Dananjaya — Thu, 05 Sep 2019 16:20:42 GMT

Add below & restart minemeld servcie.

$ sudo -u minemeld sh -c 'echo "FEEDS_AUTH_ENABLED: True" > /opt/minemeld/local/config/api/30-feeds-auth.yml'