About Unibw

Malware Callbacks for command&control and also for data exfiltration are often transported in HTTP POSTs.   The URL blocking of category malware URLs seems only to block the HTTP response. The GET or POST request seems to pass untouched to the server. So it is possible to exfiltrate arbitrary data in the GET or POST request.   What is the suggested strategie to block connection to hosts listed in the URL category malware before data can be exfiltrated?     ... View more

Hi,   due to a bug (ID:80950), that PANW is not able to fix, it is necessary to create seperate IPSec-ESP policies for both directions trough the PA-7050.   IPSec-ESP that comes in response to a opened session is being dropped if there is no separate policy for incomming ESP traffic.   Example: -Client are allowed to open IPSec-Connections from "trust" to "untrust". -You have to allow ESP also from "untrust" to "trust" for any adress a IPSec client might use   To avoid flooding, etc. from outside I am searching for solutions to avoid this.   Has any PA-7k admin found a valid approach?   Regards Winfried ... View more

Is it possible to analyze multicast traffic on a tap interface? I am unable to commit a multicast policy bound on a tap. Tap {   to multicast;   from Tap;   source any;   destination any;   source-user any;   category any;   application any;   service application-default;   hip-profiles any;   action allow; } Commit error: In VSYS vsys1 from zone Tap of type tap and to zone multicast of type unknown are incompatible in security rule Tap Configuration is invalid ... View more

Hi, I would like to know, whether there are already special resources for chassis operation? There seem to be separate logs for the cards. These special things seem not to be covered yet neither by the CLI Reference Guide nor by the Hardware Reference Guide. Questions are - Logfiles for cards - Power-Supplies - Chassis-Boot-Problems - Troubleshooting ... Thanks Winfried ... View more

Hi, in my opinion some commands are still missing in the PanOS CLI. I miss some features implemented in my conventional firewall to handle the policy rule  set efficiently. Some other vendor has the possibility to use so called op-scripts in the CLI. This scripts allow to implement own CLI commands using the built in API. Is there already the possibility to use the PanOS-API from the PanOS CLI? Or are there plans to do this? Best regards Winfried ... View more