About mgusta

mgusta · ‎02-08-2019

Not sure. We don´t use Sharefile anymore, sorry.

mgusta · ‎04-18-2018

I deployed the https://cloud-images.ubuntu.com/trusty/current/trusty-server-cloudimg-amd64.ova on one esxi host and then installed the MineMeld cloud-init ISO. Then I imported the config: https://paloaltonetworks.app.box.com/s/4ubmkgrq72a8mdd24j733ddqdgbkyvv4 //Mikael

mgusta · ‎04-18-2018

Ok, so is that a file I download once availiable and append (or replace?) in minemeld? Thanks

mgusta · ‎04-18-2018

Hi, When trying to use Minemeld to enable access to Office365 MS Teams brakes. This is because url api.teams.skype.com is not in the url list minemeld pulls. Instelad this url is being categorized as 'internet-communications-and-telephony' by panos and that category is blocked in the url filter. Also, we have other url categories we´ve manually created to disable ssl decryptions for some sites. This also becomes a problem as Panos then identifies these sites as belonging not to minemelds EDL but the other list. In which order is the different URL category list processed? Nayway, what is the best way to manage this? Can I manually add an url to minemeld? Thanks, Mikael

mgusta · ‎04-17-2018

Hi, Following this instructions blocks traffic to office365 in my environement. It looks like many of the url:s are being categorized as not 365 url:s (the Url filter I created from minemeld) but others. Here you can see that traffic for application ms teams url is catgegorized as internet-communications-and-telephony. And since the url filters is set to block all categories but the EDL from minemeld traffic is denied. What am I doing wrong? Thanks, Mikael

mgusta · ‎05-19-2017

Ok, thanks for the tip. That does have it´s use cases. My most recent scenario was when I wanted to try out the credential url filtering. With my suggestion all I would have had to do was add a sec. profile policy with the test user as source and apply to traffic from trust to untrust. Instead I had to create a clone of the current url filtering profile, add that to multiple (cloned, and added test user as source) security policies for traffic from trust to untrust.

mgusta · ‎05-19-2017

Hi, One thing about configuring security profiles is that when I like to change a security profile, there are so many security rules to update with the correct profile. I know I can change the profile itself and all policies using that profile will be affected but that is not always what I want. In my view it would be much better to place security profiles in their own policies - like decryption, authentication etc. Then we can add the the profile to exactly the type of traffic we want without needing to bother with what security rule that traffic hits. What do you think?

mgusta · ‎06-28-2016

I actually had a case with Palo on this and they didn´t think it would allow unknown tcp but the support said he´d need to verify with a senior techinician which I´ve yet to hear anything from. And I actually don´t have that policy enabled right now. I´ll just manually filter to get rid of what I don´t need to see. I will add layered filtering as a feature request.

mgusta · ‎06-28-2016

I created a custom app with no signature and added port 80 & 443 to a policy with the custom app. And yes that worked fine. I think they should add a layered approach to filtering where you can set exclusions for incomplete apps (or what you´d like) at the top. Thanks for your input. //Mikael

mgusta · ‎06-28-2016

Hi, I think you misunderstood what I´m looking to do. I don´t want to block incomplete, I just want to get rid of all the clutter it generates when monitoring a policy. And that can be achieved with what I suggested in the first place. But even better would be having a checkbox in the log views to view/hide incomplete apps. The same can, of course, be achieved by filtering but I´d rather not have to add that to every filter I create. //mikael

mgusta · ‎06-23-2016

Hi, Does anyone have a suggestion on how to create a rule to catch Application incomplete? Now that traffic hits the first policy that allows traffic on that service (port). And it clogs the logs when looking at that rule and what has passes through it. My idea is to create a policy for an application that doesnt exist and add port 80 andd 443 as allowed services. Has anyone done this or have another suggestion? Thanks, Mikael

mgusta · ‎04-26-2016

Hi, I was wondering if anyone have been succesful in getting the actual file names of what is being up/downloaded to ShareFile? All I get is file name 'blob'. We do decrypt the traffic but my guess is citrix encapsulates the files making the names unreadable. Anyone? Thanks, Mikael

mgusta · ‎09-22-2015

Yes, PANOS 7.01, GP Client 2.3.1-7. OS W7. Thanks, Mikael

mgusta · ‎09-22-2015

Hi, Lately I´ve been having issues with clients connecting to Global Protect. They pass the HIP match (no warning message is shown when they connect) but still the security policys with the HIP profile doesn´t apply, instead they hit a deny policy. After disconnecting and trying again for a couple of times it suddenly works and the appropriate security policy is applied. Has anyone else exprinced this? Is there any way of troubleshooting this? If I remeber correctly there are no cli commands to debug why the traffic gets rejected by a policy with a HIP profile apllied. Best Regards, Mikael

mgusta · ‎09-18-2015

Hi, Yes, I did set the zones and public IP of Exchange server. I did notice that using application default in our environment didn´t work since web-browing is only allowed on port 80 by default and we do a redirect to HTTPS. So for the test I used 'any' for service which I would restrict if I decide on implementing this. But you would say that decrypting this traffic and allowing those applications is better(=safer) than just letting it pass through as SSL? Thank you for you input on this. //Mikael

Member Since	‎12-18-2014 12:25 AM
Date Last Visited	‎11-26-2025 02:53 AM
Posts	30
Total Likes Received	3

Online Status	Offline
Date Last Visited	‎11-26-2025 02:53 AM

About mgusta

Re: ShareFile upload 'blob'

Re: Enable MS Teams through minemeld

Re: Enable MS Teams through minemeld

Enable MS Teams through minemeld

Re: How to Safely Enable access to Office 365 using MineMeld

Re: Feature Request - Security Profile policy

Feature Request - Security Profile policy

Re: Application: Incomplete

Re: Application: Incomplete

Re: Application: Incomplete

Re: Applications using non standard ports - Palo Alto best practice

Re: Applications using non standard ports - Palo Alto best practice

Re: Filter traffic from mobile devices

Re: Enable MS Teams through minemeld

Re: Feature Request - Security Profile policy

Re: ShareFile upload 'blob'

Re: Enable MS Teams through minemeld

Re: Enable MS Teams through minemeld

Enable MS Teams through minemeld

Re: How to Safely Enable access to Office 365 using MineMeld

Re: Feature Request - Security Profile policy

Feature Request - Security Profile policy

Re: Application: Incomplete

Re: Application: Incomplete

Re: Application: Incomplete

Application: Incomplete

ShareFile upload 'blob'

Re: Global protect and HIP profiles problem

Global protect and HIP profiles problem

Re: Decrypt Exchange traffic

Unlock your full community experience!

About mgusta