About ericgearhart

It's nice to see a point by point response from Palo Alto's Threat Prevention Product Manager here on the forums... well done sir. ... View more

Here's an example of a block list... SANS' DSHield has a Recommended Block List. I figured the list would be a bit bigger and more comprehensive though honestly: http://feeds.dshield.org/block.txt #    This list summarized the top 20 attacking class C (/24) subnets #   over the last three days. The number of 'attacks' indicates the #   number of targets reporting scans from this subnet. ... View more

I'll try to find a firewall specific realtime black list, but funny you should mention this, in PANOS 5.0 Palo Alto added something called "Dynamic Block Lists" that do exactly what you describe. ... View more

What does the 'Monitor' tab on the firewall say about this traffic? Make sure you check "Log at session start" and check "Log at session end", just for the sake of troubleshooting ... View more

Yes I believe it is called "HA Lite": HA Lite offers the following capabilities: Fail-over of IPSec Tunnels DHCP Lease information PPPoE lease information Configuration sync Layer 3 forwarding tables The big difference is that HA lite doesn't provide session syncronization. ... View more

Oh there we go... the link to 5.0.3. and the release notes just appeared for me too. ... View more

What the.... I can't see 5.0.3 either. How is it emr can see it but we can't? ... View more

Just throwing this one out there, but you can build a rule with specific source/destination traffic and then have the PA packet capture on that one specific rule: I've used this and it works... it's kind of a "ghetto tcpdump" way of doing it. The packet captures show up in the Monitor tab with a green arrow next to them, just as though a Threat rule that had 'packet capture' turned on had matched. ... View more

The magic Google phrase to search for would be "Chromebook vpnc" - 'vpnc' is a Cisco VPN client that also happens to work with GlobalProtect gateways (you have to turn XAUTH on in the Gateway as well... there's another forum thread on here that goes over it, search for 'vpnc') Unfortunately the results I'm finding for official support for IPSec from Google don't look promising: Google Groups "Implementation of OpenVPN support is already in progress. vpnc, if I had to guess, is not likely to be implemented (because more advanced encryption options on Cisco VPNs causes vpnc not to be redistributable as a binary, for obscure legal reasons)." But if you're OK with doing it yourself, another blog post DOES look very promising: http://blog.martinh.net/2013/02/hacking-chromebook-for-fun-and-profit.html The "right way" to do this would be with a GUI, with NetworkManager or some such frontend. I'm not sure that a GUI VPN client of that nature is available for the Chromebook platform unfortunately ... View more

I can vouch for the veracity of the information... I've tested vpnc with NetworkManager and it works great with a GlobalProtect Gateway as the IPSec termination point ... View more

If you just leave the IP space area blank it'll work too... adding 0.0.0.0/0 explicitly makes it more obvious that a full tunnel is configured ... View more