General Topics

USER ID Lateral Movement reported

We have USER-ID Agent installed on 2 Domain Controllers, using a Service account to authenticate to the Domain referencing the Workstations (Laptops) We use Rapid7 InsightIDR for our SEIM solution and USER-ID on a DC to authenticate/identify Workstation details. The SEIM is flagging USER-ID traffic from a Workstation to another Workstation as ...

Windows Update feed in minemeld

I'm trying to find out if there's already a miner that someone's created for windows update URLs/IPs. I am using the O365 one with reasonable success, so I'd like to incorporate the windows updates into minemeld and take advantage of the dynamic list functionality for some of my rules. Thanks!

Resolved! VM for the Palo alto firewall

Will take a backup from the VM (NVA) for the Paloalto firewall that exists in the Azure environment, The query, is whether taking a backup will *affect/not affect* the services or interrupt the network traffic managed by the Paloalto NVA during and after the backup of the NVA?

Resolved! PaloAlto failing communication for Kali Linux

Kali, Windows and RHEL installed in a lab behind Palos on a directly connected Vlan. Windows and RHEL have no issue communicating to internet or ping firewall interface. But for Kali, Palo captures show only receive and no transmit or even drop packets. All 3 are getting IP from DHCP on Palo interface, and share common NAT/security policies, ...

Resolved! Source NAT with Pool

For example we use 110.110.110.0/24 as internet facing interface What are difference between 110.110.110.30/24 and 110.110.110.30/32 Which one is the correct, When I configured /24 it's seem conflict logs displayed

Resolve wildcard FQDN by PA

Hello! I have a PA OS 10.2. PA act as DHCP server and DNS server for local clients. I have several ststic entries wich resolve my local domains name in IP. For instance, example.local is 10.10.10.10. What should I do that PA will resolve wildcard FQDN for DHCP and DNS clients. I want to resolve *.example.local in one IP address. Is it possible?

NGINX Help port forward

Good day Has anyone worked with NGINX and PAN? I'm struggling to port forward 443.

Resolved! Using PANORAMA for an MSP

Would anyone know if its possible to use Panorama in an MSP environment to manage clients Palo Alto Firewalls? For example, setup an Azure Panorama and use that to Manage all of our clients Firewalls from that Panorama? Like clients part of different businesses/organizations. If yes, any ideas or documentation that can help?

Accessing Tags in XQL

I can see that tags are exposed on the endpoints dataset in XQL but when I inlcude them in a query they appear (vaguely) as key value pairs thus: "endpoint tags": [], "server_tags":["IAN"] The schema though reports tags as being of type string and not an array I would like to be able to extract just the server tag value(s) and present that...

Error message when clicking on details on risk details

Hi, always when I click in the alters in the risk overview I get the error page something went wrong. This is the error Id: 84221aa454904de0a219ad27e9bfa6d7 Could you please tell me what went wrong? Thanks!

URL Filtering in 10.1.4 version

Hi Team, Just wanted to understand while migrating a device which is 8.1.18 to the new device with the version 10.1.4 has issues with the syntax for URL filtering. When checked i dont see an option of overrides in the new version. Please suggest how to overcome this? Regards, Sanjay S

Virtual Routers on PA-460

Hi All, I am not able to configure more than 5 VRs in PA-460. It prompts me a message that i have configured the maximum number of VRs already. Please suggest is it a bug or license issue or any other issue? Regards, Sanjay S

how does mac based policy and high cpu clear?

Hello. It uses the PA400 model. 1. I'd like to use a Mac address policy like a Fortigate. └ macbinding, mac address-based police 2. Is there a command to kill high cpu usage?

Cisco VPN to Palo Alto VPN Conversion Questions

Hey all, Long time reader, first-time poster here! I'm slowly migrating all my Cisco ASA VPN tunnels to my PAs running 8.1.5 (planning to upgrade) and I'm using Panorama 10.0.10 to do this. Everything seems to be going okay except I have a few tunnels that have PFS disabled and no DH group assigned on my Cisco ASA. These tunnels are up and funct...

Resolved! PA-850 port usage

hi all I have a little confusion about the usage of SFP/SFP+ ports on a PA-850, with 4 x RJ45 10/100/1000 & 4 x SFP & 4 x SFP+ configuration. SFP ports are 5 to 8, SFP/SFP+ are 9 to 12, ok? If I use 10G SFP+ on ports 9 to 12, may I still use ports 5 to 8 with 1G SFPs? If yes, may I use 1 SFP ports as HA ports? Thanks in advance ...

Discussions

USER ID Lateral Movement reported