About networkadmin

networkadmin · ‎07-30-2016

@jvalentine wrote: A v-wire requires exactly two physical interfaces. What you're asking for can be accomplished using a single L2 interface on the firewall and enabling vlan tag rewrite. In essence you are bridging two vlans together. Thanks, bit confused now as you said it requires two physical interfaces then suggested it can be done with one? 🙂 If it needs 2 in order to be supported so be it, just frustrating when it's using NICs and all going into the same switch...

networkadmin · ‎07-30-2016

Right now we use a standard vwire with 2 physical interfaces. We're about to make some hardware changes that means that the vwire input and output will be from/to the same physical switch. If I have to use 2 interfaces then on that switch I'll just be using two untagged ports from/to the appropriate VLANs on the switch. But do I have to use 2 physical interfaces? Is it possible to use a single physical interface with subinterfaces (I think that's the magic word?) so the input and output are simply tagged across the one physical link? Apologies if my terminology is way off here, but hopefully I've explained it well enough, if any clarification is needed please just ask 🙂

networkadmin · ‎07-28-2016

Thanks Brandon, tbh it's a dog of a badly worded article but if 50k is the magic number that's all I need to know 🙂

networkadmin · ‎07-27-2016

Thanks, but that article doesn't make sense unless I'm totally misreading it. When running PAN-OS 7.0.x on a PA-200, it can have: A maximum of 10 External Block Lists A maximum of 50000 IPs in all external lists combined. (1 list with 50000 IPs or 10 Lists with 5000 IPs both are supported) OK so a PA200 can have 1 list with 50,000 IP's that's great but: Hardware Maximum Address Entries PA-200 PA-500 2500 PA-3020 5000 PA-3050 PA-3060 PA-5020 10000 PA-5050 40000 PA-5060 PA-7050 80000 So a PA3020 can only have 5000 entries whilst that table also states that a PA200 can only have 2500 entries. Some of the reputation feeds out there can be 20k entries and it's hard to believe that a PA200 could use that but a PA3020 could not.

networkadmin · ‎07-27-2016

I've been experimenting with MineMeld and love it - brilliant product 🙂 That said, I'm struggling to get a clear idea what the size limit is of each blocklist. https://live.paloaltonetworks.com/t5/Learning-Articles/How-are-Dynamic-Block-List-Entries-Counted-on-the-Firewall/ta-p/62068 suggests even a PA200 can handle a list with 50k entries but in the same article it suggests a PA3020 has a limit of just 5k entries. What is the limit please? For exampel the Alienvault reputation feed is approximately 16k entries. Thanks 🙂

networkadmin · ‎05-10-2016

Yes, but weird but in the logs there are several data filtering entries for the .exe that show "web-browsing" as the application, then it shows "google-update" and has downloaded. All are on port 80 which is still a little unusual.

networkadmin · ‎05-10-2016

How have people done this in practise? We would like to prompt people so they have to choose "continue" to download PE executable files. I know this only applies to "web-browsing" but when I test this, a Google Chrome update shows as "web-browsing" and isn't interactive so the user doesn't get the prompt to continue, nor does the update download. Seems a very nice feature in practise but curious how people have tuned it not to cause problems.

networkadmin · ‎04-11-2016

I'm being daft, rule 2 was "browser based" so it would include QUIC but the URL filter on that rule wouldn't apply as it's UDP traffic is my assumption?

networkadmin · ‎04-08-2016

I had two firewall rules in the following order: Any Internal > Any External > Any Application > Service TCP 80/443 Any Internal > Any External > Application filter "web browsing" > Service "App Default" With a "decrypt" profile on web based email which is allowed by the URL filtering profile on the first rule, but blocked by the second rule. If I open my browser on my PC and go to Gmail with both rules in place, I look at my Gmail in the browser, and it is not using the PAN certs, and in the PAN logs I see the traffic is not decrypted, and the app shows as QUIC and is allowed using the second rule. If I change the second rule to: Any Internal > Any External > Application filter "web browsing" > Service TCP 80/443 And repeat the Gmail test, now Gmail shows the PAN certificate and in the PAN logs the traffic is decrypted and is allowed using the first rule. In the initial scenario, why didn't the first rule apply? I'm using 7.0.6 Thanks

networkadmin · ‎03-10-2016

Thanks Luciano, so what I did was get both boxes on the same revision of all updates, then as you say simply exported and imported and then committed the config and it took it first time with no complaining or anything. So right now the new box is sitting in the rack waiting for a window to cut across - seemed remarkably easy 🙂

networkadmin · ‎03-08-2016

@reaper wrote: you should be able to simply export and import the configuration and be up and running in minutes one of the few caveats would be if FIPS mode is enabled or the master key has been changed, in which case appropriate steps need to be taken to get the PA-3020 in the same operational mode before moving config, but other than that there should be no issues Thanks, had a chat with an SE today who suggested the same, albeit Palo Alto seem very careful to use words like "should" rather than saying it will work. The rough plan as of now is to setup the new 3020 using the management interface as if it's a brand new unit, so we'll activate licenses and update PANOS to the same as the 500, and ensure we have updates, then I'll pull the config across and see what happens when I hit commit. Given the interfaces will match up I'm reasonably hopeful it'll go OK, just be nice if there was a bit firmer response from Palo Alto on what is/isn't officially recognised 🙂

networkadmin · ‎03-07-2016

We have a 500 that we're replacing with a 3020 which arrived today. Should I need to do anything to migrate the config across other than an export and import of the running config? I know some things like ports will clearly need addressing but in terms of getting the base config across is there anything I need to be particularly aware of please?

networkadmin · ‎12-04-2015

We currently use Wildfire on "PE Executable" filetypes on our PA-500. I'm interested in using it against Office documents and PDFs as those are clearly a major threat vector. Thing is, whatever model of Palo Alto I look at, they all seem to show low WildFire limits which makes me question how they cope with things like SMTP where there may be lots of emails with attachments passing through the firewall? PA-500 10 files/minute PA-3020 50 files/minute PA-7050 100 files/minute This just doesn't seem like much given how many emails might be flowing so I'm wondering if I've missed something fundamental?

networkadmin · ‎10-23-2015

I have a ton of entries in my spyware logs for DNS attempts to nsatc.net Some digging suggests this is a site run by Microsoft related to Windows Updates. False positive?

networkadmin · ‎08-10-2015

We're running 5.1 right now and plan on upgrading to 6.1 over the next couple of days. Historically we've used the Windows User Agent on two of our domain controllers, but today I switched to the on-board Integrated User-ID Agent and set it up, and other than a noticeable increase in CPU load on the domain controllers, everything is working great (so far ). What is the "best practise" around this please? Right now our Palo Alto is in the same rack as 2 of our DCs and there is another DC at a remote site but the User-ID agent traffic has to cross a WAN link for that regardless of the method we use.

Member Since	‎02-12-2010 10:34 AM
Date Last Visited	‎09-16-2017 04:35 PM
Posts	242
Total Likes Received	16

Online Status	Offline
Date Last Visited	‎09-16-2017 04:35 PM

About networkadmin

Re: Content Versions 706 & 707 - some explanation needed

Re: Forcing TLS/SSL decryption to cipher suite PAN can decrypt?

Forcing TLS/SSL decryption to cipher suite PAN can decrypt?

Re: MineMeld real-world usage to reduce threats?

MineMeld real-world usage to reduce threats?

Skype for Business using App-ID?

Re: Rule too allow access to group of URLs?

Re: Rule too allow access to group of URLs?

Re: Rule too allow access to group of URLs?

Rule too allow access to group of URLs?

Re: Import PA-500 config on PA-3020?

Re: Exclude URL

Re: How do I check how a URL is categorized and suggest changes or corrections?

Re: CVE-2015-0235 Ghost

Re: Paloalto to Firebox

Re: Forcing TLS/SSL decryption to cipher suite PAN can decrypt?

Re: vwire using a single physical interface possible?

Re: Dynamic Block List - Limit on number of entries?

Re: CVE-2015-0235 Ghost

Re: CVE-2015-0235 Ghost

Re: vwire using a single physical interface possible?

vwire using a single physical interface possible?

Re: Dynamic Block List - Limit on number of entries?

Re: Dynamic Block List - Limit on number of entries?

Dynamic Block List - Limit on number of entries?

Re: Requiring "Continue" to download PE executables?

Requiring "Continue" to download PE executables?

Re: Clarification of rule processing order?

Clarification of rule processing order?

Re: Import PA-500 config on PA-3020?

Re: Import PA-500 config on PA-3020?

Import PA-500 config on PA-3020?

WildFire & Office Documents/PDFs - Limitations?

nsatc.net shows as spyware?

Integrated User-ID Agent vs. Windows Service?

Unlock your full community experience!

About networkadmin