About laurence64

laurence64 · ‎05-18-2021

Hi, Sorry for the very late reply, that isn't actually what I meant, I was wondering if you had terminated the VPN in the same Zone as the RDP session was being created, as I said in the post the best practice would be to separate the two (separate zones, separate Subnets) but some people do not do this, so yes I quite agree that normally the two are different.

laurence64 · ‎05-05-2021

Following on from @Sec101 it is true that GP only collects the HIP data, but that data can then be used in a security policy to allow or deny the traffic based on the information contained within, so for instance in this case I would check for the certificate and put a security policy that allows the traffic for that group including the HIP check in the policy, if the device fails the HIP check the firewall will fall through to a rule underneath that could pick up the remaining users and provide that connectivity.

laurence64 · ‎05-05-2021

Hi Could you tell me where your VPN tunnel lands? does it terminate in the same zone as the RDP target ? I have always found that it is a lot easier (as well as being best practice) to terminate your GP tunnel in a separate zone and then create the rules to and from that zone to your inside or DMZ. I would say that a starting point would be to check the following Zones that the Tunnel Terminates in (which Virtual Router is it using) Rules between the GP tunnel and the Zone that is hosting your RDP Target, Then do a packet capture on the interface facing the RDP Target.

laurence64 · ‎05-05-2021

Hi There appears to be a permissions issue with docker, what do you get if you run ls -alh /var/lib/docker/overlay2/ | grep 53bc122 All the directories should be root root in that dir

laurence64 · ‎05-04-2021

Just wanted to echo @BPry comment, awesome that you are hosting this free service, and yes I do agree very much that Minemeld is a very under recognised tool and certainly something that should get more press.

laurence64 · ‎03-09-2021

It will be a dedicated Layer2 interface so shouldn't be anything else, you would be able to check for the MAC on the switch for the interfaces though

laurence64 · ‎03-09-2021

PAN-137663 Fixed a cosmetic issue where misleading App-ID and rule shadowing warnings populated after a commit. Fixed in 9.0.11 hopefully this is the one.

laurence64 · ‎03-09-2021

Just agreeing with everybody else really, it does sound like a NAT issue, I would make sure all routes and NAT's makes sense and then look further from there.

laurence64 · ‎03-09-2021

It is supported across switches as long as the switch has jumbo frames configured, which you say you have, although I would suggest that it is not really the best scenario, first packet would minimise traffic across the HA3 link which is always preferable, and in fact is the best staring point before doing any performance tuning. Remember Force VR sync and Qos sync as appropriate.

laurence64 · ‎02-05-2021

Bit late in the day but further to my previous reply I have actually just done a video on my channel about this very thing if you want to take a look it is at https://youtu.be/NvDdTz2CMi4

laurence64 · ‎02-04-2021

Hi Please accept my apologies for the delay in getting back to you, I appreciate the help just been really busy, there is no mention of anything that looks like the webserver in the logs, I have a lot of telemetry errors but that is just about it. I will generate the cert again and have a look right after as opposed to retrospectively and post the results.

laurence64 · ‎02-02-2021

Hi, I do not know of it specifically as a threat, but I have personally always been distrustful of these cheap VPN providers, there are several that are simply there to harvest user information and this could well be one of them, would be interesting to see if any further info can be found.

laurence64 · ‎02-02-2021

Hi, I am wondering if you could share a little more info, What scanner is this ? Am I correct in assuming you are scanning the mgmt of the PA ? What Version of code is your PA running ?

laurence64 · ‎02-01-2021

Apologies if this is going over old ground but I have an issue with zone protection and am stumped trying to work out what it is. I have configured and applied the zone protection profile to a layer3 sub-interface, when I test against it with crafted packets the majority of the configured protections flag using the following command show zone-protection zone xxxxx However some do not, one of the ones that I would have thought would have been fairly easy to spot would be the anti -spoofing, the packet capture from the firewall shows that the packet does indeed have a spoofed address (that is one that is not reachable from the zone) but the profile is not dropping the traffic. Any help with this would be greatly appreciated as I am pulling what hair I have left out! Thank you all in advance,

laurence64 · ‎01-14-2021

Apologies for the massive delay in getting back to you, I did follow the guide in the link and still it was overwriting the certificates on reboot, I still haven't found a way to make it work.

Member Since	‎11-28-2020 12:38 AM
Date Last Visited	‎04-24-2024 07:19 AM
Posts	155
Total Likes Received	24

Online Status	Offline
Date Last Visited	‎04-24-2024 07:19 AM

About laurence64

Re: ACC shows ipv6 addresses in source/destination IP

Re: Strata Sales training guide

Advanced Wildfire Allowing High Severity Verdicts but blocking Informational

Re: Expedition is not accessible through Web GUI

Re: Expedition is not accessible through Web GUI

Re: User ID mapping from Exchange logs behind F5 loadbalancer

Re: User ID mapping from Exchange logs behind F5 loadbalancer

Re: Export Configuration from Cloud Managed Prisma Access

Re: Trial license limitations for palo alto vm

Re: Trial license limitations for palo alto vm

Re: Export Configuration from Cloud Managed Prisma Access

Re: Default password not working admin / admin

Re: Offboard/Remove devices from AIOPS

Re: Firewalls not appearing in AIOps

Re: The Panorama IP has been changed on the firewall, but the firewall still has a session to the original IP

Tips & Tricks: Disable New Applications in Scheduled Content Updates

What's the Scoop on Cyberpedia?

Cortex XSOAR - Embrace or Tame the Chaos?

Demystifying Application Default

Thwarting the Theft of OAuth Session Tokens Using Secured Containerized Development Environments (CDEs)

Re: Client successfully connects and get's IP but is unable to communicate to remote machine

Re: How to restrict access only to certified devices for users in an AD user group but not a different group

Re: Client successfully connects and get's IP but is unable to communicate to remote machine

Re: Timeout: Palo Alto Networks WildFire v2

Re: EDL Lists - Minemeld

Re: Active Active HA3 Through EVPN/VXLAN

Re: Shadow Rule Warning after upgrade

Re: NAT question

Re: Active Active HA3 Through EVPN/VXLAN

Re: MFA for xSOAR portal

Re: XSOAR HTTPS certificate issues

Re: SkyVPN - Really a C2 threat?

Re: Vulnerability found on Firewall Need to address

Zone protection on sub interfaces

Re: XSOAR HTTPS certificate issues

Unlock your full community experience!

About laurence64