About networkadmin

Hoping for some clarification on using Virtual Wire to inspect traffic to our DMZ please. Right now the external interface of our PAN has a public IP of 1.2.3.1/24. Its default gateway is another firewall in front of it, it's internal interface has a public IP of 1.2.3.2/24. Both of these interfaces are connected to a switch, and on that switch we also have a webserver/mail relay which have public IP's on the same 1.2.3.0/24 network, kind of like this: LAN | | PAN (external interface is in dumb switch) | Dumb Switch--DMZ Servers | Perimeter Firewall (internal interface is in dumb switch) | Router I know I can bring those DMZ servers in behind another interface on the PAN and assign them private IP addresses and have the PAN do the decryption/inspection/forwarding. I also believe I can setup a DMZ "virtual wire" which will let me do SSL decryption and threat/virus inspection without having to touch the configuration on any of those DMZ servers. What I'm not clear on is how I'd do this, and as I don't have a PAN I can test on I'd appreciate some clarification before I do anything. Equally if every "best practise" out there is to do this using traditional NAT tell me and I'll look at doing it this way (How do I best build up the "new" ruleset on the PAN without committing it until I'm ready, whilst being able to make changes to my running config if I need to?). Thanks. ... View more

I know this is subjective, but does anyone have any knowledge/experience of how effective the Palo Alto IPS/IDS is compared to a more dedicated product? I'm looking at ways to try and detect/block suspect traffic to our web server and obviously there are lots of IPS/IDS solutions ranging from software to hardware. ... View more

If I setup a policy using a URL filtering profile that uses override for at least one or more categories, once the user enters the override code, what are the exact rules that then apply? For example if I set "shareware and freeware" to "override" and someone goes to www.cnet.com and enters the code, at what point does that override expire? Whilst they are in "override", is it for the website, or the category i.e. if they then went to another site that's in "shareware and freeware" would they be able to access it? Is there a document with a more detailed breakdown? ... View more

I have a query regarding multiple rules to allow access to URL whitelists. Let’s say I have rule1 that allows “any” on my LAN to a URL profile that blocks everything but only allows access to url1.com. I then want to have rule2 that only allows “some servers” access to only url2.com. The problem is that the URL filtering profile on the first rule stops the request for url2.com from ever reaching the rule that allows it. Seems a simple enough thing to want to do so I must be missing a step/technique in how I'm doing it? Thanks. ... View more