About mikand

As debug it would be great if you can connect the device directly to your PA to rule out any firewall settings in between. I guess you have already read through these docs/posts (some are more or less related to your topic)? https://live.paloaltonetworks.com/docs/DOC-1735 https://live.paloaltonetworks.com/message/19299#19299 https://live.paloaltonetworks.com/docs/DOC-1608 ... View more

Depends on your situation. A regular web-browsing client usually doesnt have to be able to use ftp for daily use. So if your case is to block malware reaching clients then the hole which you allow clients through should be as narrow as possible. And if possible also consider using terminalserver solutions or dedicated (virtual) appliances such as Webconverger - opensource Web Kiosk PC operating system An easy way to achieve the above (in terms of PA configuration) is a combination of your suggestions. First of all, not everyone should be allowed for ftp. And those who are will be limited to dedicated sites. Im not sure if you can use url filtering for this but if you can then a somewhat healthy approach is to only allow sites which belongs to specific categories. Also dont forget to enable AV scanning in PA for the traffic passing through. A potential threat is encrypted ftp. There is both SFTP and FTPS. Im not sure if the SSL-termination in PA will help you that much with both of the cases (if any). ... View more

First of all, did you enable ssl-termination (unless Im wrong hotspot shield tries to use ssl to bypass firewalls)? Second, I doubt that the port 990 traffic identified as "insufficient-data" would be enough to make the application run in long term (perhaps only as a way to find other nodes) - from the admin guide: " * Incomplete - A handshake took place, but no data packets were sent prior to the timeout. * Insufficient-Data - A handshake took place followed by one or more data packets; however, not enough data packets were exchanged to identify the application. " If you are positive that the PA didnt successfully identify hotspot shield even if you were using ssl-termination (as a debug use both "log on session start" and "log on session end" on all rules) you can contact the appid team and submit some pcaps so they can improve the hotspot shield detection: Tools ‹ Palo Alto Networks BlogPalo Alto Networks Blog ... View more

Did you have enabled SSL-termination (SS-decrypt)? Which appid does your PA identify this session with? As debug enable both "log on session start" AND "log on session end" for all rules. ... View more

As long as your syslog server who will receive the syslog stream from your PA is compliant for the syslog RFCes then it should work without any troubles. A sidenote is that the default logging format for PA is in CSV mode. So in case your syslog server does some kind of analysis of the incoming syslog stream you will most likely need to manually conifure each log format with spaces as delimiter instead of the default comma. Check this document for information of the order which the default log format uses of each variable: ... View more

LDAPS is SSL. Or rather LDAP within SSL-tunnel. In order to make your PA to identify this properly you need to enable SSL-termination (SSL-decrypt). ... View more

PaloAlto perhaps isnt best in class (but among TOP5 or so) when you only look at the IPS itself but its not far behind from the one who currently is. On the other hand a PA is mainly a NGFW with IPS capabilities and not IPS-only (but thanks to VWire or L2-mode it can still be used as IPS-only). However these testresults can show you if you need an additional IPS or not if you already have a PA in place which is (hopefully) properly configured. Another thing to take into account is that SSL-termination capabilities is included with PA where with, for example, Sourcefire you need to buy another expensive box to be able to handle SSL-based threats. The test also shows that no matter which IPS you use (or combinations) - there will always be threats that can bypass which boils down to that you need a proper design of how, for example, webbrowsing should be allowed or not from the same hardware that at the same time is handling sensitive information related to your company/organisation. I didnt manage to find a copy of the 2012 report from NSS Labs (anyone who knows if PA perhaps licensed it to publish it in public?) but I do have the 2010 year testresults of PA-4020 in the IPS-testing (which was/is publish in PA public site). Back in 2010 the result for PA (in IPS test made by NSS Labs, 1179 exploits tested) was: Default configuration block rate: 56.4% Tuned configuration block rate: 93.4% and split up by attack vector: Attacker initiated Default configuration block rate: 49% Tuned configuration block rate: 89% Target initiated Default configuration block rate: 64% Tuned configuration block rate: 97% So if you use the above attacks through a SSL-connection the PA box would find 97% of target initiated threats where Sourcefire would find 0% unless you buy that additional box to perform SSL-termination. Another thing to take into account is the performance when you use various IPS settings. For example on a Checkpoint (with their builtin IPS) you are basically forced to use "Recommended" setting which wont find that many threats. If you want to block all known IPS signature (as with PA if you set all severity levels into Block) then the performance drops dramatically. I have also read a testreport where Sourcefire IPS was involved and that stated a throughput of approx 400Mbit/s (using 10Gbit/s links) for HTTP-traffic - I have no idea if that box is badly configured or not but if it isnt it probably means that using IPS for "critical" high bandwidth applications would result in that the IPS would be bypassed for performance reasons and then you are down to 0% hitrate again. And, as you most likely already know, how many IPSes are actually put in block mode? When you use IPS internally (like for the datacenter) there is a chicken race between finding and stopping malware vs. availability of the applications. Which is not uncommon that this IPS you bought suddently only is configured as a IDS. And for an IDS to be effective (that is IPS runned as IDS) you need to have someone looking at the logs and take action as soon as possible when a threat is detected unless you use it only for reporting purposes. ... View more

You mean close to the 09:35 mark? That shows number of vulnerabilities (exploits) able to bypass the IPS. The point here is as I described in my comment regarding page 26 from the report that you need to "tune" the defaultprofile from default everything into: Critical: Block High: Block Medium: Block Low: Default Informational: Default If its not possible for you to enable blocking even for Low and Informational aswell (with higher probability of false positives). ... View more

I guess you have already read through the Admin Guide and CLI Guide for the PANOS version you are running? Here is a short KB article regarding DNS Proxy and ways to set it up: ... View more

I found this presentation on Youtube the other day which is somewhat related to this topic: http://www.youtube.com/watch?v=XJ0iwnu-sjE " Vulnerability Threat Trends Published on Mar 27, 2013 Dr. Stefan Frei, Research Director at NSS Labs, presents key findings from an analysis of publicly-available vulnerability data found in the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE), identifying industry-wide threats and trends covering the last ten years. " ... View more

Personally I would suggest to use one set of hardware as outer firewalls/protection and another set of hardware as inner firewalls/protection. Simply because if you get a DDoS on the outer firewalls the DMZ's connect there will basically go offline and with another hardware set as internal firewalls your internal network will continue to work even if the external firewalls are flooded. This will also take in account regarding misconfigurations or for that matter hardware failure all together (where HA doesnt help). But given that you cant afford to get a dedicated HA pair as internal firewalls a workaround can be to setup a different VSYS on your already existing set of PA HA pair. That is VSYS1 is ExternalFW and VSYS2 is InternalFW. This will also make life easier the day you can afford a dedicated set of internal firewalls. Now back to the VSYS... how you setup VSYS2 is up to you - simpliest way is to make it VWIRE and connect this between your internal router and the switch(es) your servers are connected to. This is also how an IPS usually is setup as. But if you want to make it an internal firewall (and not just IPS) I would configure it with L3-interfaces so you get a design such as: Internet | ExternalFW - Internet-DMZ | Router - Clients | InternalFW | Server-DMZ ... View more

I wouldnt be suprised if defrxpwgklm.capco.com is a malware url, I have seen similar design of the subdomain part which previously have been classified as malware-related. Also currently it doesnt seem to resolve at all: ;; QUESTION SECTION: ;defrxpwgklm.capco.com.         IN      ANY ;; AUTHORITY SECTION: capco.com.              3600    IN      SOA     ns1.netnames.net. hostmaster.net names.net. 2013032800 10800 1800 3600000 21600 ... View more