About davanderson

davanderson · ‎09-20-2017

Not sure on the File Name option but this article has the field labels for Syslog messages. I would think this would be similar to the API fields but don't know... https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-logging/syslog-field-descriptions.html

davanderson · ‎09-20-2017

You shouldn't need to setup a NAT rule to allow traffic from the Users to the FTP server (for Uploads or Downloads). Both the FTP Server and the Users are in RFC1918 private address space. You should only require a Security Policy and routing to allow this traffic.

davanderson · ‎09-20-2017

Use the GUI. That is why they are popular.

davanderson · ‎09-20-2017

There are a couple of companies who specialize in Company and Product comparison. This document is from the Palo Alto website and is a link to the Gartner report: Gartner Magic Quadrant Report - Next Generation Firewalls This is a test of the Anti-Virus capability (again from the PA website): AV-TEST Validated: Traps Can Replace Legacy Antivirus This is a test of the throughput by NSS Labs (again from the PA website). This is the company that PA was fighting with a couple of years ago regarding the testing being fair or not. NSS Labs 2016 NGFW Test Report

davanderson · ‎09-01-2017

This whole issue was pretty bad. We had AD authentication issues at our main site for about 12 hours. Stupid thing abou the entire issue is the notification process from PA. We had gotten the notification about 729 being an issue but had no details on what the symptoms were. It would have been so easy (and helpful) for PA to have included SOME/ANY DETAILS about the type of problems with the initial notification or a LINK TO FURTHER DETAILS. It wasn't until we found a community thread indicating Microsoft AD authentication traffic was affected that we rolled back and life was good again. Simple communication would have been so helpful.

davanderson · ‎08-01-2017

There are two issues going on right now: * Layer 2 Issue * Layer 3 Issue Your design should be fine. The networks do not overlap or coflict with each other. I'm going to throw out a ficticious subnet to talk through the issue further = = = = = = = = = = = = = = = = = = Eth1/1 IP: 10.0.0.18/28 Mask: /28 = 255.255.255.240 Subnet IP: 10.00.0.16 Broadcast IP: 10.0.0.31 = = = = = = = = = = = = = = = = = = Eth1/13 IP: 10.0.0.91/29 Mask: /28 = 255.255.255.248 Subnet IP: 10.00.0.88 Broadcast IP: 10.0.0.95 = = = = = = = = = = = = = = = = = = Layer3 Issue: These two IP ranges do not overlap as one goes from .16 to .31 and the next from .88 to .95. They cannot have an overlap of IP address. This is the Layer3 issue. I suspect your subnet mask is wrong one or both of the interfaces. That is the only way they can have an overlapping range of addresses (if you have the proper IP on each interface). The other possibility is that you don't have .91 on eth1/13 and it has an incorrect IP in the original range. Layer2 Issue: I suspect you have both interfaces Eth1/1 and Eth1/13 connected to the same switch. If you do, they should be in two different VLANs (Virutal LANs). If your switch does not have a management address (unmanaged) you won't be able to setup multiple VLANs and are "multi-netting" the setup (running two mis-matching networks on the same vlan). This "could" work but is not a good idea or best practice from any switching vendor. Separating the networks into their own VLAN or connecting the interfaces to separate swithes if VLANning is not possible will keep the interfaces from talking to each other. Traffic from Eth1/1 should never be able to communicate to Eth1/13 directly as they should be on separate networks.

davanderson · ‎07-12-2017

Can you explain more what you are trying to use the single sign on for? This sounds like you are trying to authenticate to the management interface for the Palo Alto. We were successful in setting up an LDAPs policy to talk to the Windows Domain Controller and are able to logon to Panormama and the PA FW's using our AD credentials. There is no need to specify the domain with this option. If you are trying to identify user traffic that is crossing the firewall for security rules - I would suggest a different approach. Again this was integrated to a Windows AD domain using the WMI functionality and LDAPS to hit the domain controllers. We also used the agent software on our Citrix servers to give more identification to systems that have mutliple user logged on locally. This works very well and the setup was fairly simple. No need to link into Kerberos.

davanderson · ‎07-07-2017

I would recommend setting up your rule as follows: Src zone: inside Src address: local subnet ip Dst zone: dmz Dest address: web server ip Service:. <leave empty> Application: SSL

davanderson · ‎07-06-2017

I would second the NAT option. Setup a private subnet for each group of web servers (on their own zones) and then just NAT the traffic. I would create a static by-directional NAT on the PA FW and then setup inbound Security Rules to only allow the inbound traffic to the servers on their proper protocol.

davanderson · ‎07-06-2017

You should be able to solve your problem by this method: Logon to your FW and browse to: NETWORK >>> GLOBAL PROTECT >>> GATEWAYS You can setup mutliple GlobalProtect gateways. Each gateway has an Interface, a public IP and a unique Auethentication profile. This should allow you to setup each client's GlobalProtect VPN and then write FW rules separately for each. Another way to do it is to setup multiple VSys's to host each GlobalProtect instance.

davanderson · ‎07-06-2017

You can have a single public IP that represents your systems and then have this IP address as the "local-address" crossing into multiple VPN tunnels. Each site-to-site VPN tunnel should terminate into it's own interface and it's own zone. tunnel.1 = zone VPN-PartnerName1 tunnel.2 = zone VPN-PartnerName2 This allows you to write specific security rules and NAT rules that match your traffic. This gives you full control over each tunnel and won't allow traffic to cross from tunnel to tunnel. Putting them into a single zone could allow the u-turn or hair-pin type traffic and could allow VPN to VPN flows (inadvertently). Each VPN tunnel will have a Phase2 configuration (IPSec Tunnels in the PA). On the PROXY-ID's tab, this is where you create your interesting traffic list (think crypto map for vendor VPN's). Your Local entry will be the public "local-address" (from above) and the Remote will be the unique IP address that your VPN partner is using. This is what allows you to re-use your single IP into mutiple tunnels.

davanderson · ‎07-06-2017

Location: Industrial water treatment plant. Tip: Don't expose the parts to chlorine.

davanderson · ‎06-08-2015

Chrome issue. The underscores disappear when I use Chrome, but they look fine with IE. AAAAAAAAAhhhhhhhhhhhhhhhhhhhh!!!!!!!!!!!!! Please don't tell me I have to go back to using Internet Explorer. I wouldn't wish that on my worst enemy.

davanderson · ‎06-08-2015

Interesting. I still see it on my Panorama. 6.1.2 on the Panorama and 6.1.4 on the firewall.

davanderson · ‎06-08-2015

Hi All, Looks like there is a minor GUI bug in the NAT policy section of Panorama. Do you all see the same thing? Objects: Name Address EXT_FW_192.168.0.1 192.168.0.1/24 EXT_FW_5.5.5.1 5.5.5.1/24 EXT_FW_10.0.0.1 10.0.0.1/24 NAT Rule: Translated Packet Type = Dynamic IP And Port Address Type = Translated Address Translated Address = EXT_FW_5.5.5.1 The section of the NAT ruel above is a Hide-NAT to allow users to browse the Internet and hide behind the firewall's interface. This rule was configured as a NAT Post Rule. Using the chart view to see the "Translated Packet" "Source Translation" value I see the following: dynamic-ip-and-port EXT FW 5.5.5.1 The underscore character is removed from the view. The other characters are OK, but the underscores don't show up. This isn't a major issue, just a cosmetic bug. How does PA handle these types of updates?

Member Since	‎02-05-2015 09:43 AM
Date Last Visited	‎10-04-2021 05:29 PM
Posts	35
Total Likes Received	18

Online Status	Offline
Date Last Visited	‎10-04-2021 05:29 PM

About davanderson

Re: Templates and Interface IPs

Re: How to Safely Enable access to Office 365 using MineMeld

Re: AWS stack name length limitation

Re: Migrating from sub-interface to L3 interface

Re: VPN tunnel to a firewall NOT internet facing

Re: VPN tunnel to a firewall NOT internet facing

Re: Upgrade for HA Pair

Re: Do you only need to install the latest update from Panorama, or the prior updates as well?

Re: Hardware Migration PA-500 to PA-850

Re: Global Protect and Bandwidth Considerations

Re: Anyone have a good list of Azure IP addresses?

Re: Upgrade for HA Pair

Re: Do you only need to install the latest update from Panorama, or the prior updates as well?

Re: Global Protect and Bandwidth Considerations

Re: How to export firewall config along with pushed panorama policies using SCP

Re: Re: Object Names and IP Addresses

Re: Get a list of files downloaded by User-ID

Re: create ftp &NAT

Re: using cli to enter x509 certs

Re: Comparision with other vendors

Re: AD trouble after installing content version 729

Re: Duplicate IP issue on dual WAN config

Re: SSO Kerberos setup for Admin

Re: Security policy conflicts between the Application and Services?

Re: Route Public IP range through Shared Gateway

Re: How to setup connection to multiple customers using Global Protect VPN Client

Re: Best Practices for Site-to-Site IP/Interfaces?

Re: A Summer Question: Craziest Next-Generation Firewall deployment?

Re: GUI Bug: Dynamic Source NAT

Re: GUI Bug: Dynamic Source NAT

GUI Bug: Dynamic Source NAT

Unlock your full community experience!

About davanderson