About gchandrasekaran

Hi Simon, As of now, the options to view the default action is by checking "Show all signatures" in the Exceptions tab. You can also use the following CLI commands to view all the threats and their associated default action. > configure # show predefined threats  ---> displays all the threats. Use forward slash followed by the threat ID to search for a specific threat ID (/36729) # show predefined threats vulnerability <threatID> You may find https://threatvault.paloaltonetworks.com/ to also be helpful as it provides more information Click the magnifying icon to view the default action. You can contact SE to place any feature requests. Hope this helps. Thanks ... View more

Hi Simon, You are right and that is the expected behavior. When you create a rule and choose the action for that rule to "block" for the severities "critical and high" and have chosen "Any" in the CVE and Vendor-ID column, then any CVE (even CVE whose default action is alert) will be blocked. The vulnerabilities rules and the corresponding action in that rule (for any CVE/Vendor-ID OR for specified CVE/Vendor-ID) take precedence over the default threat ID actions. Again, the rule must be matched correctly for the corresponding action to take place. You can change the default action for threat IDs. Click the "Exceptions" tab and then click "Show all signatures". Enter the threat ID in the search bar and click on the action to see the dropdown. Now choose the required action and ensure to check the "Enable" box. Thanks ... View more

Hi Vesna, Could you let us know for which feature of PAN-OS would you like to know whether SHA-1 is supported or not? It could be for SSL/TLS decryption, IPSec VPN, PAN-OS certificates, etc. If it for IPSec, kindly refer the document IPSEC Crypto Options Thank you ... View more

Hi Warner, PA does not automatically block these threats. The default action for CVE-2014-6271 and CVE-2014-7169 is "alert" with the severity critical. To block these threats, follow the steps given below (Please ensure that you have the latest content version installed. As of now, 458-2380 is the latest version. Once 458 version is installed, log out of the WebUI and log back in) 1. Go to Objects > Security Profiles > Vulnerability Protection. 2. Click Add and enter a name 3. Click the "Exceptions" tab 4. Enter the required Threat ID (36729 or 36730. Entre one threat ID at a time) 5. Check "Show all signatures" at the bottom 6. Click on "default (alert)" under the Action column 7. From the drop-down, choose the action to "drop" and click OK 8. IMPORTANT: Check the"Enable" box for the corresponding threat ID and Click OK 9. Use this Vulnerability Protection profile in the required security policy and commit the changes. Refer the document How To Block Shellshock - CVE-2014-6271 and CVE-2014-7169 Thanks ... View more

Per product management, "The Bash vulnerability currently appears to be a low severity issue due to the fact that only authenticated users could potentially exploit the vulnerability against PAN-OS.  Normal PAN-OS maintenance release updates will provide a fix for the vulnerability." Also, there is an internal bug open where the bash patch will be applied in the PAN-OS (it is yet to be confirmed in which release will the fix be available and whether it will be backported to the previous releases) Hope this helps. ... View more

Hi ClintL, Since the requirement is  to use only One public IP, (as far as I know) from configuration perspective on the PA 3020, I don't think this can be achieved unless you use different destination ports to identify the internal servers A and B that share the same public IP, say 1.1.1.1. In that case, the external hosts need to know that if server A is unreachable over the socket 1.1.1.1:xx, then use server B's socket 1.1.1.1:yy. As of now, fail-over or redundant NAT rules cannot be configured (meaning you cannot have two D-NAT rules pointing to the same public IP with different internal destination IP transalations unless you want to use destinaion IP and port translation) Also, refer Understanding PAN-OS NAT Thanks Gayathri ... View more

PAN-OS 6.0.x has a feature to disable SIP-ALG. Please refer How to Disable SIP ALG. For prior PAN-OS versions, SIP-ALG can be disabled by configuring an application override policy which will prevent the PA firewall from doing any Layer 7 inspection. So, PA firewall would not open any pinholes. For App override setup, refer How to Create an Application Override Policy ... View more

PAN-OS 6.0.x has a feature to disable SIP-ALG. Please refer How to Disable SIP ALG. ... View more

After installing content 394-1961, it took sometime (around 7-10 mins) for me to see the TID 36128 and CVE-2013-3893. I request you to wait for sometime and then check whether your able to see the TID in the vulnerability protection profile. Also, run the CLI command "> show system info" to ensure that the threat-version 394-1961 is installed. ... View more