About Jack_Howells

Jack_Howells · ‎07-04-2016

We've had suspicions that there have been logins from an unknown source via the console. "User admin logged in via CLI from Console" None of the team have stated they logged in around 1am to the box, and the room is locked with a pin. Is there anyway, apart from comparing configurations, and seeing what admins have logged on (I only have one admin user account), that I could potentially see what the activity was of the user that logged in? I.e what commands they ran in the CLI? I don't believe there is a way, but would like to know people's thoughts. Cheers Jack

Jack_Howells · ‎07-01-2016

This was a couple of months ago now, but I just wanted to let someone know we resolved this by upgrading to the latest apps and threats version - 550. This exact content version won't resolve future issues now, but it may be a good step to take if the same issue re-appears.

Jack_Howells · ‎06-30-2016

Hi Brandon, Thanks for your reply. Adding the download.citrix URL to the category alone didn't resolve the issue, however I believe I have fixed it. In the traffic logs, when accessing the GoToMeeting link I saw an IP address which then after an nslookup resolved to apiglobal.gotomeeting.com. I added this as well to the custom URL category which allowed me to use GoToMeeting and still block EXE files. Thanks for your help Jack

Jack_Howells · ‎06-29-2016

Hi Pankaj, That is what was done intially to get the error message.

Jack_Howells · ‎06-29-2016

Could you decipher that please..

Jack_Howells · ‎06-29-2016

Yeah so essentially, the match conditions are the same, so the traffic will hit the first rule that it applies to regardless of what file blocking profile you have. Is there any workaround for this at all? Would it be possible to setup an Untrust to Trust policy from the web server of where you're downloading from, which then has an alternate file blocking profile to allow this specific traffic I'm trying to download an EXE of?

Jack_Howells · ‎06-29-2016

Hi guys, I have a certificate that I need renewing as it's expired, but I am seeing "failed to determine issuer" when attempting to do this. The certificate is a self-signed certificate, but it wasn't generated on the Palo, but rather an external CA. Do I need to remove this certifiate and renew it on the server I generated it from, or should I be able to renew it on the Palo? I believe that the CA must revoke the certificate, but this means they have to renew it as well, or can you renew it on the Palo using OCSP? Cheers Jack

Jack_Howells · ‎06-29-2016

Hi, I can go to the website and download the launcher fine, it’s other websites that I can’t access anymore (because I set all other categories to Block). In my mind I’m expecting to hit the top policy for downloads only (hence blocking everything else) then hit the regular policy below for all other traffic.

Jack_Howells · ‎06-29-2016

Solved*** Address prefix was entered incorrectly. The below value was needed to be in place: 1.3.6.1.4.1.9.9.599.1.3.1.1.10.0=

Jack_Howells · ‎06-29-2016

Hi guys, Has anyone managed to successfully have their VM-100/Palo recognise the SNMP authentication requests from the Cisco LAN Controller to use for User-ID? I have followed the below document but to no avail. https://live.paloaltonetworks.com/t5/Integration-Articles/Use-Syslog-Receiver-to-Integrate-with-Cisco-Wireless-Controller/ta-p/52824 This is an example of a syslog message that I'm using to put in the "Syslog Parse Profile", as described in the document. 2016-06-27 08:45:09 User.Debug wlc.vallsnet.local community=ajvrw, enterprise=1.3.6.1.4.1.9.9.599.0.4, uptime=715326600, agent_ip=10.65.100.5, version=Ver2, 1.3.6.1.4.1.9.9.599.1.3.1.1.1.0=T@'3—, 1.3.6.1.4.1.9.9.513.1.1.1.1.5.0=AP7_c067.afe4.0ae7, 1.3.6.1.4.1.9.9.599.1.3.1.1.8.0=4Ûý¬[`, 1.3.6.1.4.1.9.9.513.1.2.1.1.1.0=0, 1.3.6.1.4.1.9.9.599.1.3.1.1.10.0=10.40.99.29, 1.3.6.1.4.1.9.9.599.1.3.1.1.27.0=jespejo, 1.3.6.1.4.1.9.9.599.1.3.1.1.28.0=DADAAJV In this case user id is = jespejo and ip address is =10.40.99.29, this ip address is assigned by dhcp. Has anyone tried setting this up? Kind regards Jack

Jack_Howells · ‎06-28-2016

Hi Raido, Hmm, thanks for your response but this didn't work. I have created the custom category and set it to Alert for the policy that applies to me but when I tri the download again this is still being blocked. It doesn’t seem to override the file block policy. Is there a different way of doing this? Cheers Jack

Jack_Howells · ‎06-27-2016

Hi guys, I'm trying to block .exe files, but allow file names for some users. For example, I would like to allow the GoToMeetingLauncher.exe for GoToMeeting webinars, but the links look like the below which means it can't be done. https://download.citrixonline.com/launcher2/helper?token=e0-qZ0xbknQkdODLP_tA0HpRDCszfG5OkCLe4-4_8LabqVRaLatg9Q4O519wF6GlqPnLvKAVHZz9kXX346UVgmp5gTJaxWPhQZgKI-VAp8hlZX6-AQjQkiwjOQMFgW9z0-9JRcDHvBx31IUAD3a5RPg4vZWzqgmTyt4wN3Q-noL5JMG0ROJk--2QVj_ACF044_X8yv9lbRd8kPJC58Gq0jWtCzE-DLtGHU1xZioBDd6IWLyOm3FbllUjg9Aw4v93px8maTbbN5Y2DuYkSoXE0Mshf85BwSxvxNMP8Pdu5Kq0jzU01CKvkzBs69l8Ux53V9MWLFa7fqWrbyRwh7fjTHl7TXTi4gKqaPZmlL8AM9OD6QA0e18jX1tqH1Ycl2kRVHLIM2GCrTTSRmr60i3cY34dXx82DTk3FHB5NIx4dobWpvepQLFOWbdeO6v_CTeXBtYB1VNiVY1mwT9UhzCt-DE0nSOYGJA7M75AMlIstRfTxmpB-xR&downloadTrigger=restart&renameFile=1 https://live.paloaltonetworks.com/t5/Management-Articles/Can-Files-be-Blocked-by-Name/ta-p/54157 Anyone have an insight as to what they have done before, or what could be done? Kind regards Jack

Jack_Howells · ‎06-23-2016

Hi there Are these custom reports? You are hitting a bug which is fixed in 7.0.6. 82756 Fixed an issue where custom reports were not sent out by the Email Scheduler. Do you have these scheduled for any other services? Cheers Jack

Jack_Howells · ‎06-23-2016

Hi Scottsander, As CHAP has only just been implemented, I'm sure MS-CHAP v2 is around the corner. I'm sure you could also speak to your account manager to raise this as a Feature request to add in future releases. Thanks Jack

Jack_Howells · ‎06-22-2016

So I have an update for this post that has resolved my issue. Running the following command showed a successful connection to the Brightcloud server: debug device-server test url-update-server Tailing the pan_bc_download.log saw successful connections also as the Brightcloud was able to update to the latest version. However, running the command below showed a connection error and a lot of unknown requests to the Brightcloud. debug device-server bc-url-db show-stats I found a document that's related which solved the issue, which is below, however it asked me to carry out a reboot which may have resolved it also. The issue originated from switching the roles of the active/passive cluster. The ex-passive is the now active and that's when the issue started. Either way, the document below helped me find that there was a connection issue even though other commands suggested otherwise. https://live.paloaltonetworks.com/t5/Management-Articles/Large-Amounts-of-Unknown-URL-Categories-in-Logs-with-BrightCloud/ta-p/53034 Cheers Jack

Member Since	‎05-15-2015 06:53 AM
Date Last Visited	‎05-05-2017 03:54 PM
Posts	63
Total Likes Received	10

Online Status	Offline
Date Last Visited	‎05-05-2017 03:54 PM

About Jack_Howells

Maximum Access Domains Per Admin Panorama

Re: Link-change Events

Link-change Events

Re: www.myhomeenergy.org.uk

Re: Lync (Skype for Business) Across Organisations

Re: Lync (Skype for Business) Across Organisations

Bluecoat GlobalProtect

Re: www.myhomeenergy.org.uk

Re: www.myhomeenergy.org.uk

www.myhomeenergy.org.uk

Re: Link-change Events

Re: Cloud is not ready, there was no update from the cloud

Re: Lync (Skype for Business) Across Organisations

Lync (Skype for Business) Across Organisations

Re: Failed Install dynamic update

Re: Apps and Threats 578-3263 URGENT SOLVED

Re: Apps and Threats 578-3263 URGENT SOLVED

Logs from the CLI

Re: Cloud is not ready, there was no update from the cloud

Re: Blocking EXE files but allowing file names

Re: Failed to determine issuer

Re: Blocking EXE files but allowing file names

Re: Blocking EXE files but allowing file names

Failed to determine issuer

Re: Blocking EXE files but allowing file names

Re: VM-100 Not recognizing users from Cisco Wireless Lan Controller

VM-100 Not recognizing users from Cisco Wireless Lan Controller

Re: Blocking EXE files but allowing file names

Blocking EXE files but allowing file names

Re: Error with PDF Reports

Re: RADIUS authentication: MS-CHAP v2?

Re: Brightcloud connection error

Unlock your full community experience!

About Jack_Howells