About ericgearhart

ericgearhart · ‎07-02-2014

Looks like Havex made it into the ThreatVault: https://threatvault.paloaltonetworks.com/Home/VirusDetail/2889719

ericgearhart · ‎07-01-2014

In my humble opinion a DMZ is still necessary because pivoting is still a tactic employed by the bad guys and pen testers. If you expose something to the Internet, assume it has vulnerabilities which would allow an attacker to get a shell on the box on the DMZ and pivot into your internal network. If you had that box 'sandboxed off' into its own zone with appropriate rules and profiles bound to it then you'd prevent pivoting.

ericgearhart · ‎06-30-2014

Thank you Steven for sharing! I'm going to go ahead and steal your idea and share it with my team 🙂

ericgearhart · ‎06-26-2014

If you get an FR let me know, I'd like to talk to my SE and vote for that FR too. Thanks, Eric

ericgearhart · ‎06-26-2014

PA really, really needs to implement Check Point's "Where used?" functionality. The backend code that determines where objects are used is already there, because if you try to delete an object that is used in the firewall rule base it won't let you, and it will prompt you as to where the object exists. That's the closest I've been able to get to "Where used?" - try to delete the object, and if it doesn't let you it will tell you where the object is used. If it does let you delete it you can just "Revert to last saved configuration"

ericgearhart · ‎06-25-2014

Oh yea wow, gotcha. What the heck PANOS is this? I'm avoiding the 6.0 train for about a year on my side

ericgearhart · ‎06-25-2014

Maybe he named the zone on the firewall web-browsing? That would be kinda weird though

ericgearhart · ‎06-04-2014

Honestly screenshots would work... I can personally attest that I have seen PAs that I've tested pick up on Metasploit sessions, just as an aside

ericgearhart · ‎05-28-2014

Zabbix 2.2's built in SNMP interface template can walk devices too, and automatically find interfaces. You'd have to make a copy of it and modify so that it uses SNMPv3 with AES and SHA, but it should work

ericgearhart · ‎05-22-2014

Ahh I see. Ouch.

ericgearhart · ‎05-06-2014

ltosi - jay.martin's suggestion sounds like the best thing to do to me. You can even configure a "Block IP' under the Properties section of the Configuration tab, and set it to the max, 3600 seconds. Every time the user agent is seen the IP will be blocked for an hour.

ericgearhart · ‎05-06-2014

Well, that depends on what you're using to tap honestly. Are you using anything intelligent to tap, like Gigamon? We use filters in Gigamon to filter out traffic. Would it be a bad thing if you send all the traffic to the PA tap interface, and then only configure policies on the PA side concerning DNS? I suppose if/when backups run you might peg your tap interface, but that should be at night anyway, right?

ericgearhart · ‎05-06-2014

mario11584 - would you be able to build a tap interface on your PA, and tap the client traffic going to your DNS server and feed that to your PA? This is one way we have solved this problem where I work

ericgearhart · ‎05-06-2014

Andie there's a blog post here where the guy seems to have had luck with IKEv1, routed VPNs and Palo Alto... Stuff I've learnt: IPSec VPNs and IKE

ericgearhart · ‎05-06-2014

Thanks HULK, that does indeed help

Member Since	‎04-26-2012 04:24 PM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	412
Total Likes Received	154

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About ericgearhart

Re: Intial Setup Help

Re: Intial Setup Help

Re: Intial Setup Help

Re: THREAT ALERT : high : 169.254.254.238 -> 169.254.255.255 Microsoft Windows NAT Helper DNS Query Denial of Service(31339) alert

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

PANOS 7.0 timeline?

Re: Assistance: my palo is not accessible.

Re: Havex Malware

Re: PANOS 6 and PA2000 series

Re: IPSEC with Cisco ASA

Is there a possibility of Palo Alto releasing rule content, similar to the way Sourcefire/Snort handle IDS rules?

Re: Cacti - Templates

Re: Tunnel between PaloAlto and PaloAlto

Re: 2050 only handles 1/4 of its advertised throughput

Re: Intial Setup Help

Re: Intial Setup Help

Re: Has anybody encountered a situation where a rule was configured for one application but matched other applications?

Re: Assistance: my palo is not accessible.

Re: Havex Malware

Re: Havex Malware

Re: Are DMZs still necessary?

Re: How do I find out every place an object is used?

Re: How do I find out every place an object is used?

Re: How do I find out every place an object is used?

Re: URL Filtering Log shows FORWARD

Re: URL Filtering Log shows FORWARD

Re: Meterpreter not detected?

Re: Can I see throughput through snmp? Let me know throughput OID Value

Re: Does or when will Palo Alto support IKEv2?

Re: Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me?

Re: Sinkhole Feature Trouble

Re: Sinkhole Feature Trouble

Re: Does or when will Palo Alto support IKEv2?

Re: Frustration with threats from PA

Unlock your full community experience!

About ericgearhart