About JRussell

JRussell · ‎11-14-2012

Yes, these are all using a standard web browser. But the only reason I know it is the PA box is because if I put a no-decyrpt rule in for those sites in question then it works. Without them and with the decrypt-all rule in place it doesn't work. The website loads but then will get to a point where it will not continue. This have only really noticed it on https sites though.

JRussell · ‎11-13-2012

Hi All, On my site we have a Decrypt-all rule in place (apart from some no-decrypt rules for specific business related sites). The problem I have is that some users are having issues accessing sites like Easyjet and Ryanair's booking pages, this I am fairly sure is due to the Palo Box decrypting the info and the websites not liking that. Now this is not work related so as such I don't want them doing it during working hours. However, I don't mind them doing so during lunch breaks. So my question is, can I do a no-decrypt rule for certain sites like this that only comes into affect during lunch hours?

JRussell · ‎11-01-2012

Yes, I have noticed that with the multi remote and when another userY logs on the currently logged on User X gets their permissions. Although I have made my own support team aware of this. But I thought having the Client Probing set to 1 minute it means that they wouldn't have those extended permissions for very log after the userY logs off.

JRussell · ‎10-31-2012

I will try increase the timeout to see if that resolves it. Is there any harm in turning off that timeout? Ie: if someone logs on with a user with extended privileges and then logs off, then someone logs onto that pc locally, if I have turned the timeout off will they get the previous users web permissions? As with Captive Portal, this was in use previously, but we are trying to move away from that in lieu of running our rules based on domain credentials. Hence my captive portal is currently disabled.

JRussell · ‎10-30-2012

Well you could manually create an Application and base it on certain signature criteria. I have had to do this for certain Sharepoint sites to allow access to the files on there for my users. For that I based the signature on the sites HTTP-req-host-Header's and the ports it uses but you can base it on other things. If you do that and then add your newly created application to your allow rule it should in theory work. But you might have to play around with how you identify the application until you find a signature that correctly identifies it for you.

JRussell · ‎10-30-2012

Thanks for the input there guys. Great tip there on adding the *.dropbox.com back to the exclude list there Andre. I think that might have sorted us. In fact I have just checked a few users pc's and the application is not only making the connection but synchronizing quite happily. In total agreement with both of you, hate it when company's include "features" on their products but then neglect to tell you where to change them or allow you to view them.

JRussell · ‎10-30-2012

Hi Mikand, My settings on my PAN-Agents are as follows. Enabled Security Log monitor. 1 Sec Enable Server Session Read Frequency was off but I now have it on as 10. Enabled WMI probing Enabled NetBIOS Probing. 1 minute Interval Enabled User Identification Timeout 45 min And Use SSL is the only other option ticked in my settings.

JRussell · ‎10-26-2012

Hi there, I have a random issue occur whereby one or two of my users seem to loose access to their internet privileges. I check on PA and it shows the traffic but no source user, which is what the rule for their internet access is based on. If we reboot their pc then it is fine again, but I just wondered what could be causing this to all of a sudden and randomally not identify their user. I have checked and they are not running any applications with elevated permissions. So just wondered if this is something anyone else has come across or knows how to resolve? Oh, I have a PA 2020 box and 2 User identification servers running. Both online.

JRussell · ‎10-25-2012

I am running a 2020 series box but I have not noticed any notice to the commit times. It's still as slow as ever. Although reading mikand's comment of it taking 20 minutes to commit then perhaps my commit time of up to 10 minutes at times is not that bad?

JRussell · ‎10-25-2012

Hi Andre, Thanks for that info. Although strangely I have only noticed this issue since updating to 4.1.8 on my PA box. I actually did have 2 users who were up til recently using the dropbox application without any issues. It is only since upgrading to 4.1.8 from 4.1.6 that we have noticed this issue. Is there anything in the update that anyone knows about that would affect this? Or is it more a case of it is changes on Dropbox's side of things that has caused the problem with the PA boxes?

JRussell · ‎10-24-2012

Hi Guys, I have had an issue arise that seems to be related to Dropbox using Amazon's S3 storage. We have had need to allow certain users access to dropbox to upload files to clients and between sites with slow connections. And in the beginning I created a rule that allowed access using dropbox and SSL to the Dropbox Netrange they use. Which was fine, but now some of the users want to use the Dropbox application which is causing some problems. I have tried creating a no-decrypt rule for those users to just the Dropbox netrange, but as it tries to synchronise it's file with Amazon's servers it is unable to do so. I know it is the decryption that is causing a problem as it complains about not being able to make a secure connection and as a test I enabled 1 computer to have a no-decrypt rule for all traffic and it then works fine. So my question is. Are there any other people having this same problem with Dropbox? And if not then how do you get around this? Is there a server range for Amazon S3 that you know of that I can put in, or is there some way to set a no-decrypt rule just for this traffic? I know there are problems with PA recognising the signature for Dropbox as it is dynamic and recognises it at SSL, but if I had a server netrange to limit it to then I wouldn't mind it as much just allowing all SSL traffic from those peoples computers to a specific range.

JRussell · ‎10-10-2012

No. But I found and resolved the problem this afternoon. I found that there was an old no-decrypt rule I had for my pc IP when I was testing something a while back and forgot to remove. Hence why my pc was fine on that site but other people were not. So it was nothing to do with the version of IE or windows in the end. Put a no-decrypt rule in for my colleagues for that website and it works fine now. Although this problem only happened since the PA update and my ISP are saying nothing has changed on their website. However, as I want to prove it one way or the other I am going to plug my other PA box in after hours which is running the old PA S/W 4.16 and see if I get the same issue. Thanks for all the help on this one guys. You pointed me in the right direction as it was the URL-Filtering logs that showed me that my data was not being decrypted while my colleagues was.

JRussell · ‎10-10-2012

Hi Numan, It says it https: private-ip-addresses (base db) when I do that command. Does that tell you anything?

JRussell · ‎10-09-2012

Thanks for the suggestions guys. I have checked the threat logs and no, there are no deny's in there for that server address. I am going to run a packet capture to see if anything shows up in there, but if you have any other suggestions I would be happy to hear them

JRussell · ‎10-05-2012

Hi All, I have a rather strange thing happening. Tuesday this week I did the latest PA updates (Software, URL, Antivirus and The Application/threat). It all seemed to go fine, but I have been informed that since the updates our users are having problem with our ISP management site. Now there is nothing fancy about this site. It is all HTTP. However, when they are navigating through the site they will click on something and then it will go to a blank page and say done. Or only load up half the page. If you refresh sometimes you will get the page. But it only seems to be on users with IE8 and Chrome. Works fine on IE9. I have checked the PA monitors and we are all using the same rule to get to that site. The site is added to the allow list. I have tried all the usual things of troubleshooting IE itself. I would try upgrading them to IE9 but they are on XP, so can't do that. It just seems strange as PA doesn't seem to be blocking anything, however, if I connect a computer directly out to the internet and bypass the PA box then this site works fine. Anybody got any ideas on this rather odd problem? Thanks, James

Member Since	‎09-14-2012 02:45 AM
Date Last Visited	‎12-21-2015 05:09 AM
Posts	60
Total Likes Received	13

Online Status	Offline
Date Last Visited	‎12-21-2015 05:09 AM

About JRussell

Re: POODLE BITES Vulnerability

Re: POODLE BITES Vulnerability

POODLE BITES (and other Informational Vulnerabilities )

What Dynamic block lists do others use?

Re: Use proxy only on certain URL's

Use proxy only on certain URL's

Re: Regin detection

Re: Regin detection

Re: Can I get a entries of Unused Rules with no repeat count from Custom Report?

Re: Regin detection

Re: Can I get a entries of Unused Rules with no repeat count from Custom Report?

Re: Since update problem with a particular site

Re: Dropbox rules

Re: Time based No-decrypt rule?

Re: Since update problem with a particular site

Re: What Dynamic block lists do others use?

Re: What Dynamic block lists do others use?

Re: Time based No-decrypt rule?

Time based No-decrypt rule?

Re: Source user not found

Re: Source user not found

Re: How to allow unidentifed and insufficient-data application in the policy ?

Re: Dropbox rules

Re: Source user not found

Source user not found

Re: Is it PAN 4.1.8 ready for production environment?

Re: Dropbox rules

Dropbox rules

Re: Since update problem with a particular site

Re: Since update problem with a particular site

Re: Since update problem with a particular site

Since update problem with a particular site

Unlock your full community experience!

About JRussell