About ericgearhart

ericgearhart · ‎08-10-2013

Wow what an interesting and creative hack to get a "Terms of service" portal to work with PA! I applaud your ingenuity on this one. PA should really add this simple feature.

ericgearhart · ‎08-06-2013

I believe this is impossible based on the post by JohnaL: JohanL wrote: I'm running a PA-VM in VMware workstation 9. It is important that your network adapters supports vmxnet3. It runs smootly. If VMware proprietary vmxnet3 adapters are "baked into" the VM series appliance and they are required, then there's no way to get the appliance to work in VirtualBox. The only way to even possibly get it to work is if some generic adapter were used in VirtualBox, that the VM series appliance kernel would happen to see and recognize as valid eth interfaces. Sorry! I basically gave up after seeing that vmxnet3 was required as the adapter.

ericgearhart · ‎08-05-2013

There is hope! I have been monitoring my PA's with Zabbix and it has been working great. In Zabbix 2.2 support for SNMPv3 with AES/SHA is being implemented as well, further cementing it for us as a monitoring solution (right now only SNMPv3 3DES/MD5 is supported on the Zabbix side, and only AES/SHA is supported on the PA side, which created a deadlock. Basically you have to use SNMP v2c)

ericgearhart · ‎08-02-2013

App-ID DNS and "application default" for the service should let DNS in... at least I've not seen PA mis-identify DNS traffic in the past for me.

ericgearhart · ‎08-02-2013

Not that I'm aware of honestly... if you allow the App-ID DNS inbound it should "just work" in theory.

ericgearhart · ‎08-02-2013

Just saying "I did proper NAT and security policies" doesn't really help us honestly... do you have screenshots of your rules? You could possibly try to build an app override for TCP port 53 and UDP port 53 and apply them to the security rule you built, just to rule out the App-ID engine being the problem.

ericgearhart · ‎07-30-2013

Ah! I see. I didn't realize the way that the X-Forwarded-For header was being "mangled" actually broke websites that presumably use a WAF or IDS/IPS and interpret the mangled XFF header as bad traffic. In that case I completely agree that XFF might not be the best answer. Maybe replacing the XFF inside IP with some bogus IP (or an outside IP address assigned to the PA?) would be a better solution. Hmph.

ericgearhart · ‎07-30-2013

We have Palo Alto appliances and we have Sourcefire IDS appliances running side by side in various configurations at work. I can't emphasize enough how convenient it is to be able to have an IDS event fire off from our Sourcefire boxes, and when I drill into the event I can actually see the rule that was written that matched on the event. In my experience it's to the point where weeding out legitimate traffic that was false positively identified as malicious entirely depends on my ability to read the rule that fired off. For this reason we now essentially run two IDS/IPS solution... Palo Alto's threat and vulnerability subscription, and the Sourcefire VRT rule subscription. What would be a "game changer" in this regard would be if Palo Alto released their rules to customers and followed essentially the Sourcefire model of "open rules, released a month late." Right now I can't do a lot with the Palo Alto threat events that fire off, because while I can open up a pcap of the network traffic involved in the event, I have absolutely no idea why the event was trigered by PA's threat engine.

ericgearhart · ‎07-29-2013

See https://live.paloaltonetworks.com/message/30256 5.0.6 has been problematic for us... we're sticking with 5.0.5 on all our devices for now. 😕

ericgearhart · ‎07-29-2013

Well... bogus? It strips the IP off. Considering that I don't think there's even an RFC defined for X-Forwarded-For it's tempting to say that it's not exactly "bogus." Also IDSs are made to be tuned... tuning that one rule out from firing off wouldn't be that big of a deal (here, where I work it wouldn't be a big deal, can't speak for others).

ericgearhart · ‎07-26-2013

Another possible solution along with mikand's could be to have the proxy add "X-Forwarded-For" HTTP headers that the PA can interpret, so the PA can do user identification using the client IP. You'd have to get User-ID set up for that to work, either on t he PA itself or via the User-ID agent. I believe adding this header is this is a common feature with web proxies. I've never done the X-Forwarded-For HTTP header parsing with PA, but it looks neat. These two forum thread links look promising: I think the PA can even strip out the X-Forwarded-For header as the traffic leaves out to the Internet, so your internal IP space doesn't "leak out" in the HTTP headers.

ericgearhart · ‎07-26-2013

A possible solution could be to have the proxy add "X-Forwarded-For" HTTP headers that the PA can interpret, so the PA can do user identification using the client IP. You'd have to get User-ID set up for that to work, either on t he PA itself or via the User-ID agent. I believe adding this header is this is a common feature with web proxies. I've never done the X-Forwarded-For HTTP header parsing with PA, but it looks neat. These two forum thread links look promising: I think the PA can even strip out the X-Forwarded-For header as the traffic leaves out to the Internet, so your internal IP space doesn't "leak out" in the HTTP headers.

ericgearhart · ‎07-26-2013

Well in essence the answer for right now is that you cannot replace something like a BlueCoat explicit proxy with a PAN device. You can replace an implicit, inline proxy with PAN using Vwire or having the firewall be a hop on the way to the Internet, but I am not aware of a way to make a PA device accept explicit proxy requests. I get where you're coming from... PA does act as a DNS server ("DNS proxy" is really "DNS server" honestly... it's not transparent at all, the client has to explicitly be configured with the PA as its DNS proxy for DNS to work), and PA can act as a DHCP server too. I'm just not aware of any explicit proxy functionality, caching or not.

ericgearhart · ‎07-25-2013

can you please reply? You had a few different people who have had the courtesy of asking you for more information in this thread that you started who are trying to help you...

ericgearhart · ‎07-25-2013

This is the only firewall that we have in this configuration... what I mean by that is, this is the only firewall that we have in only tap mode, where we're sending it gigs of traffic per day via the taps we have into it (not more than the dataplane can handle, it's just that we don't have any other firewalls in this specific configuration). I don't mean this in a mean way, but I would hope that you guys (PA I mean) have various models of your Palo Altos in tap mode, basically running different code revisions and you're feeding your corporate office "day to day" Internet traffic through them, just sort of as your own "canaries in the mine" so to speak. Thanks, Eric

Member Since	‎04-26-2012 04:24 PM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	411
Total Likes Received	154

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About ericgearhart

Re: Intial Setup Help

Re: Intial Setup Help

Re: Intial Setup Help

Re: THREAT ALERT : high : 169.254.254.238 -> 169.254.255.255 Microsoft Windows NAT Helper DNS Query Denial of Service(31339) alert

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

PANOS 7.0 timeline?

Re: Assistance: my palo is not accessible.

Re: Havex Malware

Re: PANOS 6 and PA2000 series

Re: IPSEC with Cisco ASA

Is there a possibility of Palo Alto releasing rule content, similar to the way Sourcefire/Snort handle IDS rules?

Re: Cacti - Templates

Re: Ubuntu and PA-200 DHCP

Re: Why do "incomplete" sessions show as "allowed"

Re: Intial Setup Help

Re: Intial Setup Help

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

Re: Assistance: my palo is not accessible.

Re: Havex Malware

Re: Captive Portal - Terms of Service

Re: VM-Series firewall on VirtualBox

Re: A better monitoring solution

Re: Windows DNS Server behind PA

Re: Windows DNS Server behind PA

Re: Windows DNS Server behind PA

Re: PAN as an explicit proxy?

Is there a possibility of Palo Alto releasing rule content, similar to the way Sourcefire/Snort handle IDS rules?

Re: Experience in 5.0 code train

Re: PAN as an explicit proxy?

Re: PAN as an explicit proxy?

Re: User-ID via NTLM and a BC explicit proxy

Re: PAN as an explicit proxy?

Re: How Palo alto detect virus

Re: Upgraded our tap mode only PA 4020 from 5.0.5 to 5.0.6 and it "cratered"... we get dataplane restarts every 10 minutes. Anybody else seeing this?

Unlock your full community experience!

About ericgearhart