Cannot retrieve contents of MineMeld Output Processor

kashanakins — Wed, 28 Jun 2017 20:04:55 GMT

Guys, I'm new to Minemeld (AutoFocus version). I've setup my first Output node. Very simple, just using the prototype that tracks Azure IPs. I'm going to use it in a Palo rule to allow specific traffic outbound to Azure IPs. Below is the scenario:

-When I CLI into the firewall and test retrieving the list, it gives me the generic message "HTTP response code said error".

-If I open a new browser (Firefox) and try to retrive it, I receive "Unauthorized".

-If I've authenticated into the webgui in one tab, I can actually retrieve the contents of the feed in another browser tab.

From what I understand, the Output node shouldn't be authentication dependant. I can't figure out where that would even be enabled. Spent a siginificant time on the support earlier today with no resulution. Any experience with this issue or feature?

Thanks!

Re: Cannot retrieve contents of MineMeld Output Processor

lmori — Thu, 29 Jun 2017 08:39:40 GMT

Hi @kashanakins,

is this on standalone MineMeld or MineMeld on AF ?

99% you have enabled authentication on the feeds (good thing to do). You have 2 options then:

1 - create a feed user under admin, add a tag and assign the same tag to the output node feed. On PAN-OS you should then use username/password of the admin for Basic Authentication for the EDL. Details here:

https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Minemeld-Feed-Password-OR-api-security/m-p/131716#M633

2 - add the "anonymous" tag to the output node

Solution #1 is waaay better for security.

topic Re: Cannot retrieve contents of MineMeld Output Processor in General Topics

Cannot retrieve contents of MineMeld Output Processor

Re: Cannot retrieve contents of MineMeld Output Processor