About JRussell

JRussell · ‎09-04-2013

Thanks so much for this info. I have been sitting here scratching my head and talking to my support people who didn't have a clue either. I would have thought it would be URL filtering or something, not Application and threat. Sticking with 389 for now until this is resolved.

JRussell · ‎08-30-2013

Is that still applicable for PAN-OS 5? And sorry, are you saying just applying to the interface the traffic is going out on? Or does that not matter so much just as long as it is applied to one of those interfaces?

JRussell · ‎08-30-2013

QOS is something I am looking to start using for a few things but I just had a couple of questions about it. So firstly, I can set a QOS rule and assign a class. I know I can create profiles on the class, but lets just say I use the default classes that are setup. If I create a rule saying that a particular range of IP's going through my internet connection have a class 8 for skype this should then limit the bandwidth they can use for this application correct? Also, do I have to setup a rule for all other traffic or if not then what class does all other non specified traffic go on? And lastly. The QOS profile needs to be applied to the interface the traffic will be coming in on or going out on? Thanks in advance

JRussell · ‎06-20-2013

Well perhaps I should have quantified that statement a little bit. OUR banking sites don't like it when the traffic is decrypted before getting to the end point. And yes, ours does use Cert. We have a card reader that we have to pull the certs from a card they send us to get it to all work properly. But that is getting a bit off topic. All I was suggesting is to try a no-decrypt rule to see if that allows him through as that is what worked for me in other cases. Not facebook though as we block that across the board.

JRussell · ‎06-20-2013

No. I have a rule that says Decrypt all sites. Unless I have another rule in saying no-decrypt on dropbox then the website does not work. Gives an SSL error. I know about the Dropbox client and the hardcoded SSl cert as I had to change that to get it to work, but this is a website both ksabry and I are talking about, not any client software. And in these cases if you have a decrypt all sites rule in place, then you would need a no-decrypt rule for certain sites. Such as banking sites for instance. They don't like it when you decrypt their traffic before it gets to the end point and will not allow you to log on.

JRussell · ‎06-19-2013

A lot of sites like this don't like you to have a SSL decrypt rule in place. I have had the same problem with Dropbox and in the end I had to put a no-decrypt rule in specifically for the people who use that service. Basically, the site is saying that it doesn't like you doing something in the middle of the transmitting, like SSL decryption. Those sites will generally give you a reduced webpage much like what your screenshot showed. Try going to your Decryption rules and adding one that says, Any source, any destination, URL category as only Facebook, no decrypt and ssl-forward Proxy. If that works you may want to restrict it down to specific sources or specific destination zone.

JRussell · ‎06-07-2013

I would firstly try VPNC or perhaps OpenVPN. Alternatively if those said ubuntu laptops could be put behind a pfsense firewall you could get that to do all the VPN for you.

JRussell · ‎06-07-2013

I'm with sraghunadan here. I don't think it was ever intended to be used in that way, and trying to get it to work in this way would probably just waste your own time

JRussell · ‎01-03-2013

I tried the CLI commands (the exact same ones my support ppl suggested) but no joy. Seem to be getting quite a few websites that are getting this not-resolved category. Am I really the only person who is noticing this? Or does everyone else use some other way of doing security rules for allow/block lists other then URL categories?

JRussell · ‎01-03-2013

Hi Doris, No, the license is good until end of Sept 2013

JRussell · ‎01-02-2013

Hi Mbutt, Thanks for that info. I already have Dynamic Filtering enabled, but I will try do the CLI commands you suggested. I have also logged a call with my support and they have had the same issue off of the URL's we have had this issue with.

JRussell · ‎01-02-2013

Hello all, Last week I did the upgrade on my PA 2020 box from 4.18 to the latest 5.0.1 version. Today is the first day that most of the staff are back in and I have noticed that a lot of people are requesting websites to be unblocked. Having looked at the logs these URL's that are being blocked are showing as URL category not-resolved. This is causing us a bit of a headache as the web rules are based on category, but without going and requesting catagory changes on all these URL's or manually going and adding them to the allow URL list is there anything else I can do? Is this something anybody else has noticed or is it just me?

JRussell · ‎12-03-2012

Hi there, I have some DVR CCTV cameras on some other sites that I need to be able to view within my network behind the PA box. At the moment I have been able to get them access by doing a security rule allowing access from certain users/IP's to the IP addresses of said DVR's onsite. However, I have not been able to lock these down very much. At the moment they are allowed any application and any service on this rule. I tried to create a application and service based of the port it was using (port 37777), but even though I created this application with that port the traffic is still coming up as Unknown-TCP on my traffic logs when using a browser to view. But when using the remote camera software to view it was showed as Incomplete, even though it works fine. My question is. A few of those packets were captured by Palo Alto box. How could I create a signature from those packet captures? Or what would the easiest way be to create a application that I could use for this security rule to lock it down a bit more?

JRussell · ‎11-14-2012

Yes, it looks like that might be the case I am having. A few links that you could try. Halfway through booking a flight through www.ryanair.com Or using Dropbox.com. There are a few other travel websites, such as bookings.com and easyjet.com

JRussell · ‎11-14-2012

Yes, these are all using a standard web browser. But the only reason I know it is the PA box is because if I put a no-decyrpt rule in for those sites in question then it works. Without them and with the decrypt-all rule in place it doesn't work. The website loads but then will get to a point where it will not continue. This have only really noticed it on https sites though.

Member Since	‎09-14-2012 02:45 AM
Date Last Visited	‎12-21-2015 05:09 AM
Posts	59
Total Likes Received	13

Online Status	Offline
Date Last Visited	‎12-21-2015 05:09 AM

About JRussell

Re: POODLE BITES Vulnerability

Re: POODLE BITES Vulnerability

POODLE BITES (and other Informational Vulnerabilities )

What Dynamic block lists do others use?

Re: Use proxy only on certain URL's

Use proxy only on certain URL's

Re: Regin detection

Re: Regin detection

Re: Can I get a entries of Unused Rules with no repeat count from Custom Report?

Re: Regin detection

Re: Facebook is not displaying its page/images properly when SSL Decryption is enabled

Re: Time based No-decrypt rule?

Re: Facebook is not displaying its page/images properly when SSL Decryption is enabled

Re: Time based No-decrypt rule?

Re: Dropbox rules

Re: What Dynamic block lists do others use?

Re: What Dynamic block lists do others use?

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

Re: Question on QOS

Question on QOS

Re: Facebook is not displaying its page/images properly when SSL Decryption is enabled

Re: Facebook is not displaying its page/images properly when SSL Decryption is enabled

Re: Facebook is not displaying its page/images properly when SSL Decryption is enabled

Re: Linux VPN clients

Re: Can firewall act as VPN client?

Re: not-resolved URL catagories

Re: not-resolved URL catagories

Re: not-resolved URL catagories

not-resolved URL catagories

Building a custom signature

Re: Time based No-decrypt rule?

Re: Time based No-decrypt rule?

Unlock your full community experience!

About JRussell