About jkim2

use the ACC (delayed and not real time as it needs to index) , try custom reports , setting up and enabling Qos (will show apps, security rules but not specific source ips)  on the interface also shows live stats. ... View more

probably not but if you want the traffic logs will show bytes sent  / recv sizes. more than likely a nat misconfiguration. ... View more

Nessus has a very basic configuration check as well. http://www.tenable.com/solutions/configuration-auditing best practice is to use publically available hardening guides for other platforms. NIST, DISA, NSA has several for other platforms that can be applied / referenced. ... View more

6.1 has URL inspection in WF so smtp messages with malicous URL links should be identified. WildFire Email Link Analysis In addition block outbound to URL category Malware if you haven't done so already enable fwding of 'email-link'. Not all but most of the domains that WF picks up gets added to the malware category. Another brute force approach would be to limit downloads of PE's with a captive portal. Also think defense in depth so don't rely 100% on the peremieter fw's and yes TRAPS may help you here as well. ... View more

Can you configure another ipsec profile on the cisco side without the lifesize/traffic volume ? is the lifesize a mandatory security setting ? How are the PFS set on the cisco ? can you try to disable on both ? ... View more

Be deafult Perfect Forward Secrecy (PFS) is enabled on the Palo. If the tunnel is coming up initially then p1 & p2 probably matches up but its an issue during rekey. Either disable PFS both sides or enable on both sides. Also paste the sanitized cisco config as well as debug if you can. ... View more

if a user changes the user agent which isnt' rocket science then this won't work. this will also only work for web traffic. Look into global protect HIPS or Forescout which is a technology partner with Palo Alto Networks or a NAC solution if you want them off the network. ... View more

Under policies at the bottom there is a "highlight unused rule" checkbox that is also helpful . as mentioned you can also use the cli command "show running rule-use rule-base security type unused vsys vsys1" and do diff's ... View more

use the dns sinkhole feature in 6.0 this is what its meant for. user makes dns request , dns server performs look up, palo alto picks this up via dns signature then returns sink hole ip . User then tries to connect to the sinkhole ip and its will get recorded in the traffic logs as such. How to Configure DNS Sinkholing on PAN-OS 6.0 ... View more

Use at your own risk but below are some sites to test the dynamic block, its not a long list but its a simple txt Make sure you create a service route for the DNS , then select the dynamic block object as destination and test with ping before & after. http://www.ciarmy.com/list/ci-badguys.txt http://www.malwaredomainlist.com/hostslist/ip.txt ... View more

thank you i've upgraded to 5.0.1 and have not yet seen this issue happen again ... View more

So after troubleshooting for close to 4 hours the problem just fixed itself... :smileyshocked: Logs below show no dhcp from 2012/12/09 16:34:21 to 2012/12/10 00:07:54 min@PA-200> show log system subtype equal dhcp start-time equal 2012/12/09@15:00:00 Time                Severity Subtype Object EventID ID Description =============================================================================== 2012/12/09 15:03:12 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.15 --> mac 98:4b:4a :67:ac:04, interface ethernet1/4 2012/12/09 15:04:18 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.19 --> mac 00:24:e8 :9d:08:3a, interface ethernet1/4 2012/12/09 15:38:08 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.15 --> mac 98:4b:4a :67:ac:04, interface ethernet1/4 2012/12/09 15:38:12 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.10 --> mac 74:f0:6d :42:e6:82, interface ethernet1/4 2012/12/09 16:30:30 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.15 --> mac 98:4b:4a :67:ac:04, interface ethernet1/4 2012/12/09 16:34:21 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.19 --> mac 00:24:e8 :9d:08:3a, interface ethernet1/4 2012/12/09 23:58:37 info     dhcp           server- 0  DHCP server on. interface ethernet1/4 2012/12/10 00:07:54 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.15 --> mac 98:4b:4a :67:ac:04, interface ethernet1/4 2012/12/10 00:08:21 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.23 --> mac e8:99:c4 :0a:1d:cf, interface ethernet1/4 2012/12/10 00:09:39 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.16 --> mac 00:24:d7 :94:39:80, interface ethernet1/4 2012/12/10 00:10:07 medium   dhcp           server- 0  DHCP server runs out of ip pool interface ethern et1/4 2012/12/10 00:14:03 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.15 --> mac 98:4b:4a :67:ac:04, interface ethernet1/4 2012/12/10 00:17:02 info     dhcp           lease-s 0  DHCP lease started ip 10.1.1.16 --> mac 00:24:d7 :94:39:80, interface ethernet1/4 admin@PA-200> at 23:58:37 it just enabled dhcp on its own. 2012/12/09 23:58:37 info     dhcp           server- 0  DHCP server on. interface ethernet1/4 admin@PA-200> show log config start-time equal 2012/12/09@15:00:00 Time                Host            Command   Admin      Client Result =============================================================================== 2012/12/09 16:47:48 10.1.1.19       edit      admin      Web    Succeeded  (Data filtering changes to wildfire) 2012/12/09 16:48:04 10.1.1.19       commit    admin      Web    Submitted 2012/12/09 22:59:31 10.1.1.19       edit      admin      Web    Succeeded 2012/12/09 23:15:15 10.1.1.19       commit    admin      Web    Submitted 2012/12/09 23:25:22 10.1.1.19       edit      admin      Web    Succeeded (DHCP ethernet1/4 set to disable) 2012/12/09 23:25:36 10.1.1.19       commit    admin      Web    Submitted 2012/12/09 23:27:02 10.1.1.19       edit      admin      Web    Succeeded (DHCP ethernet1/4 set to enable) 2012/12/09 23:27:31 10.1.1.19       commit    admin      Web    Submitted atleast it fixed it self but still concerning ... View more