About mikand

Service is simply what others call a port. ... View more

Personally I would set it up something like: 1) Get one M100 device with 8x1TB (4TB effective after raiding) to which you push Panorama logs. This way each PA box probably just holds a few days/weeks while the Panorama box will retain for a couple/several of months. Management Platforms 1.5) File a feature request to your SE that PA should use 4TB drives instead of 1TB to maximize amount of storage (specially since 4TB drives are fairly cheap nowadays). 2) At the same time push syslog (CONFIG, SYSTEM, THREAT, TRAFFIC and HIPMATCH) from each PA-box to a syslogserver of your choice. If you have the money perhaps Splunk or even Arcsight. Otherwise (since this is just for archiving) setup an Ubuntu Minimal running syslog-ng or rsyslog (whatever you prefer) which will rotate the logs every hour or if you have plenty of logs every 5 minutes or so (one log per logging host) - during rotation the rotated log should be compressed with "gzip -9". Preferly use 4TB drives in RAID1 (or if you have plenty of load 4TB drives in RAID10 configuration - SATA drives are cheap nowadays (at least compared to what a single PA box costs 😃 3) Get a NAS to handle the archiving. Since the rotated logs are compressed by "gzip -9" you wont need to extract them in order to search through them. Just use zcat, zgrep etc. Compression will also make the logs to take less space. Which NAS you choose is a matter of taste by Synology seems to do decent hardware (and software) in this area, for example a Rackstation RS2212RP+ which can take 10x4TB drives which in a RAID6 configuration means 32TB of effective storage. 4) Bonus: Perhaps some kind of offline backup aswell or if you setup a NAS like above on a different geographical location. This way PA-boxes/Panorama appliance will be your 1st level of logdigging/reporting. While the syslogserver will be your 2nd level. Since you log into syslog you wont suffer from when PA in future might change db formats etc (if you have used Juniper NSM back in the days you probably know what Im thinking of - you had plenty of archives but the day you needed to read those archives back in NSM it turns out that the NSM update performed a few months earlier changed the db schema so the old archives cannot be read back - so now you need a new hardware to install an old NSM at and Juniper demands another license fee for that second NSM box and so on) since the syslog is just cleartext and in this case also compressed textfiles which can easily be searched through and displayed by using the zcat and zgrep tools. The above gives that M100 and the syslogserver will be the hot sources (seconds to minutes to retrieve data) while the NAS will be the cold source (minutes to hours). And the backup at (preferly) other geographical location will be an offline source (hours to days). ... View more

Close enough? 😉 2208320   Backdoor/Win32.miniduke.a https://threatvault.paloaltonetworks.com/Home/VirusDetail/2208320 ... View more

Ohh... I guess I missed that checkbox in the lower left Also I assume that AV signatures doesnt have any default action or such attached to them? Regarding Eicar I was more thinking of why there are four of them and why threatid 100000 isnt searchable through the threat vault webpage? ... View more

Sounds odd... If verified this sounds like a bug to me. Using TSagent the TSagent will inform the PA device which user uses which srcport range on which srcip (terminalserver) and by that the PA device already knows and should be able to limit this continue to the particular user when userid is being used. If one user clicks on a continue-page this "click" should only be valid for this particular user and not the whole network or for that matter the current srcip. Another case where this can occur is if the users (for some reason) already is behind a NAT before reaching the PA device. ... View more

Ahh sorry about that, I had forgot that feature 🙂 ... View more

You mean a dynamic block list as described in ? Or do you think of deployed dynamic address objects like FQDN instead of ip address? Or somthing completely different? ... View more

Kudos for not limiting to modules from your "own" brand which are overprized like some of the competitors does this... ... View more

A glitch in the matrix? 😉 ... View more

Couldnt the CP policy use a radius or such or for that matter the internal userdb (for really small installations)? ... View more

It feels like there should exist a counter, somewhere... the question is where dampening-profile <name> | { cutoff <value> | decay-half-life-reachable <value> | decay-half-life-unreachable <value> | enable {no | yes} | max-hold-time <value> | reuse <value> } routing | { bgp virtual-router <name> | { dampening {prefix <ip/netmask> | peer <value>} | stat peer <value> } clear ... > routing — Clears routing information > bgp — Clears BGP counters > dampening — Resets BGP route dampening status (option to filter by prefix or by BGP peer) > stat — Clears statistic counters (option to filter by BGP peer) Edit: By the way shouldnt there be a SYSTEM subtype=routing logmessage generated when dampening occurs (or at least an option somewhere to log these events)? ... View more

What about ECMP (Equal Cost Multi Path routing)? Thats when you have two (or more) entries in your routingtable with the same metric/cost for a given dstip/range. ... View more

I can just agree with what darren.gibbs above is saying (with perhaps slightly more words than my one-liner 😉 Its also interresting how one hotfix obviously is breaking other things aswell. I mean if a specific hotfix lets say 4.1.11-h1 is about to fix the high mgmt cpu issue, then how come new bugs submerges once h1 is installed which (according to posts on this forum) didnt exist in the 4.1.11 itself? Another good example that the "full QA testing cycle" is failing big time is the QoS bug. Didnt take long before it was getting reported in this forum... and once PA finally released a new version - it took minutes to identify that the bug WASNT fixed... I can get that QA can sometimes be troublesome, specially when dealing with many operating systems, libraries, versions etc - but in PA case there is a limited set of locked down appliances (PA-200, 500, 2020, 2050, 3020, 3050, 4020, 4050, 5020, 5050, 5060 and then the VM-series) where looking at actual hardware specifications its down to 4-5 various models. So my question remains... whats up with this "QA process" over at PA nowadays!? ... View more