About ssharma

ssharma · ‎11-05-2014

Hi markk96, I did some test. Here is my finding : link.rm0003.net is categorized as web-based email. But since you have put it in allow list, it is accessible. But this site does change to "go.reachmail.net" C:\Users\user>nslookup link.rm0003.net . Name: go.reachmail.net <------ Address: 66.251.253.150 Aliases: link.rm0003.net <----- go.reachmail.net is categorized as computer and info and that is why it is getting allowed. There are 2 options, for the short term, you can put go.reachmail.net in block list : go.reachmail.net *.go.reachmail.net In the long run, you can request re-categorization for the url category to change it to web-based-email as well. If you are using PAN-DB you can go to following site Palo Alto Networks URL Filtering - Test A Site You can go to brightclould site if you are using BC as your URL filtering vendor. Hope this helps. Thank you.

ssharma · ‎11-05-2014

You can configure it at following location : In above example I have requested firewall to user E1/5 which is my trust interface to use it for Panorama and User ID. Rest everything will still use management interface for other service. You can configure it under Device -> Setup -> Services -> Service Route Configuration Hope this helps. Thank you.

ssharma · ‎11-05-2014

Hi djr, No it will not failover user id or panorama functionality to trust interface once management port is down. From path monitoring you achieve failover if management ip ranges are unavailable (I haven't seen user using this approach though). Then the peer device's management will process those request normally. You can use either data port (trust port) or management port from Panorama and user id functionality. If you use data port for user id and panorama, and if that data port interface goes down, a failover will trigger from link monitoring itself. It will depend on your requirement. I will still suggest management interface for this purpose as this will lower number of packets device has to process at dataplane side, thus reducing dp cpu. Hope this helps.

ssharma · ‎11-05-2014

Hi Tigran, With skype-probe and macbook pro not able to shutdown, it seems like the either the laptops in questions are compromised with some virus or there is an OS bug with the mac. Shutdown process is entirely local to the machine, any other device or process outside the laptop should not interfere with the process. I would suggest you to run AV on the laptop in question or check on Macbook forum to see if anyone has seen issue similar to yours. Hope this helps. Thank you.

ssharma · ‎11-05-2014

Hi djr, Yes, one of the option you can do is enable path monitoring for the management ranges. Also note that the communication would still go through one of the data ports (probably trust interface). You can point to one of the IP in management range and ask firewall to failover if that is unreachable. This is by design that management port is not an option under path monitoring. But your requirement can be a good feature request. You can contact your local sales / system engineer for feature request. Hope this helps. Thank you.

ssharma · ‎11-04-2014

Hi Andy, In that case we need to get pcap from traffic in question if that is possible and analyze what type of packets are those. Thank you.

ssharma · ‎11-04-2014

Hi Andy, Can you look at the Bytes Sent and see the size of the traffic. What is the application it is classified as? Next if you do a test url for url in question, see what category you are getting. Also under Spyware setting, what is DNS action set to? Thank you.

ssharma · ‎11-04-2014

Hi Jambulo, Can you confirm the common name on your certificates and your configuration on your external gateway : If your certificate has a comman name of "mycompany.com", could you please confirm, if your gateways config has "mycompany.com" as well instead of IP of interface. If not, then could you please change, commit and test it again. If that does not help then can you try upgrading the GP Clients on iOS to 2.1.0 and see if that makes any difference. Thank you.

ssharma · ‎11-04-2014

Hi jambulo, We had seen some issues with 8.0, with the latest update 8.1 however, issue was not reproduced. Could you please confirm the version you are running? Thank you.

ssharma · ‎11-04-2014

I understand your concern. But unlike Radius, LDAP doesnot support VSA (vendor specific attribute), where PA can go out and query for users group association and their privilege levels. That is why we need to configure all users for LDAP. You can certainly contact your local sales /system engineer for a feature request. Hope this helps. Thank you.

ssharma · ‎11-04-2014

In that case Radius authentication would be more appropriate as you do not have to configure Administrators information on the device. You can add/delete/modify users on back end. Each time engineers/system admin tries to access, firewall will contact Radius server and assign appropriate privileges to the users. With LDAP, you will need to configure each 150 admins and modify each time there is a change with there privileges level. Hope this helps. Thank you.

ssharma · ‎11-04-2014

dusk2dusk This document has the information that you are looking for : Using LDAP to Authenticate to the WebUI This document is also applicable for CLI access as well. Thank you.

ssharma · ‎11-04-2014

Yes, the comment is from Flood Protection, but the statement "separate counter is maintained for each source IP/destination IP/destination port tuple", makes sense with reconnaissance protection as attacker will try to sniffs various ports on same destination or different ports on different destinations. Where as in flood, attacker will flood the network mostly to a known or single ip rendering it useless to process other legitimate request.

ssharma · ‎11-04-2014

Hi rvandegrift With regards to Zone protection, statement number 2 is accurate. That is, it is applied to specific zones regardless of number of interfaces associated with it. And for this purpose, there is only single counter. Separate counter mentioned in statement 1 is for Reconnaissance Protection, which will maintain counter for all different attempts made to sniff the traffic. Hope this helps. Thank you.

ssharma · ‎11-04-2014

Hi Amit, Like HULK suggested , you can only look for destination show session all filter destination 1.2.3.4 This should give you ike and ipsec application in the session information and you can look for source address is there. I assume, these source will be there for another hour or 2 at least. In the mean time you can run pcap capture to see if firewall is dropping anything. If not, you can explore other avenues for troubleshooting. Hope this helps. Thank you.

Member Since	‎02-22-2012 01:10 PM
Date Last Visited	‎11-06-2024 12:17 AM
Posts	372
Total Likes Received	94

Online Status	Offline
Date Last Visited	‎11-06-2024 12:17 AM

About ssharma

Re: DNS attack? False positive: urussynonumsantonums.com

Re: Clear logs older than 7 days

Re: Re: Configuring local and LDAP source users in Policies

Re: IPSEC association process in PA

Re: Configuring local and LDAP source users in Policies

Re: Configuring local and LDAP source users in Policies

Re: Special caracters for response pages

Re: User-ID for Cloudware

Re: GlobalProtect issue

Re: Deploying Panorama M-100 in HA mode

Re: Monitoring BGP stats from Palo Alto/Panorama

Re: Linux NIS User-id Integration

Re: can we block sending web based email

Re: Clear logs older than 7 days

Re: Failure to Delete a Certificate

Troubleshooting GlobalProtect MTU Issues

Re: How to monitor pending commits

Re: Dynamic Updates Problemes

Re: useridd - virtual memory limit exceeded, restarting error

Re: UDP Relay on PAN OS?

Re: Email Links

Re: HA Failover moniring Management port

Re: HA Failover moniring Management port

Re: Skype-Probe Problem

Re: HA Failover moniring Management port

Re: DNS not DNS? Strange UDP 53?

Re: DNS not DNS? Strange UDP 53?

Re: Anyone using iOS 8 and Globlal Protect?

Re: Anyone using iOS 8 and Globlal Protect?

Re: AD Group for Authentication

Re: AD Group for Authentication

Re: AD Group for Authentication

Re: Inconsistent documentation on zone protection

Re: Inconsistent documentation on zone protection

Re: Source and Destination NAT at the same time

Unlock your full community experience!

About ssharma