About mikand

Hopefully the document at IATAC will be updated aswell when the EAL4 cert is completed: http://iac.dtic.mil/iatac/download/firewalls.pdf ... View more

If I remember correctly the PA will do a precheck on the packet before it start to crunch it through the "singlepass" engine. This precheck (described in a pdf/picture on this site) will check for the ip-header stuff like srcip, dstip, srcport, dstport. Which gives if you for example only have one rule setup and thats something like "appid:web-browsing, service:TCP80" then if the packet arriving has a dstport of something other than TCP80 then this packet will be dropped (and logged if you have a rule in the end which will log dropped packets, the builtin hidden last rule is just a drop without logging). Thats why you should avoid to use "service:any" and always use at least "application-default" or even better define exactly which ports you allow. The next step (when this "singlepass" kicks in) is to try to detect what kind of application this packet actually is, send it through a protocol-decoder and if thats successful it will do other tests aswell on the packet before finally (hopefully) give a final verdict of letting this packet pass through (or drop the session completely). This gives that if your rule instead was "service:any" the precheck would always fail (given the combo of srcip + dstip is valid aswell) and the PA must let through enough of packets before the particular application can be identified. Some applications can be identified on the first packet (after the tcp handshake if we talk about tcp applications) while others need a few more packets before the verdict can definately say "this packet is not the allowed appid". You can see this yourself in action if you setup a rule like "appid:web-browsing, service:any" and put a webserver to listen at lets say TCP81. Your tcp-handshake will complete (since its obviously part of web-browsing) and you will also be able to send a packet through towards the webserver - lets say a packet such as: a b c that is three letters with whitespace in between. As you can see "a" is not a valid http method - but PA obviously doesnt know this (yet)... not until the server responds with "HTTP ERROR 400/Bad Request" it seems that PA is 100% sure that this flow has nothing to do with web-browsing and will now drop the flow (and log it if you have such rule in the end). I have no idea why PA will let through such requests (or if this particular case has been taken care of by an appid update) but a workaround is to create a custom appid which is based on web-browsing but with the addition of "http-method" (or whatever its called when you create custom appids) needs to be GET, HEAD or POST (or whatever http methods you like to let through). Now, with the custom appid, even the request would be dropped. There are also other corner cases such as if you wish to block skype. In order to block skype you must first allow skype-probe. Which gives that the more you go into "applications" the more leakage will occur. Personally I recommend to first configure your PA device as you would with an older SPI based device - look at srczone, dstzone, srcip, dstip and service. THEN add which application is supposed to get detected by this flow. And in some cases also add a url-filter (if dealing with browsing). And of course the rest of a proper IPS profile, AV, SSL-termination (to inspect https sessions) etc. Edit: Here is the document I had in mind: There is also an "executive summary" edition of the flows described on page 4 (anyone else remembers what that document is called? its like light green boxes describing the same flow but with less technical details). Edit2: Here is that "executive summary" (well sort of) I had in mind: http://media.paloaltonetworks.com/documents/techbrief-app-id.pdf ... View more

If anyone from PaloAlto is reading this thread, it would be nice to get some kind of official statement of wtf is going on with the QA process within PaloAlto!? Or did the QA process get infiltrated by people from PA's competitors (sometimes I get this as a bad feeling, on the other hand MIT tested and verified that alu foil hats doesnt work http://berkeley.intel-research.net/arahimi/helmet/ 😉 ? ... View more

Sounds like a case where you should contact the appid team and submit this as a request: http://researchcenter.paloaltonetworks.com/tools/ ... View more

This blocking of jar files, is it only for browsers or for email etc aswell? If its just for browsers then it should work if you create an url-filter blocking *.jar (given that you want to block on extension and not on contents). And/Or create a custom app using http as base and define uri or url to end with *.jar OR the mime-extension which is being used (I think its "application/java-archive") - the custom appid should contain both rules (as an OR). ... View more

Perhaps creating an URL-filter instead? ... View more

Basically what you can do (with the PA device): 1) Enable IPS and AV for all flows. At least with a profile such as: Critical: Block High: Block Medium: Block Low: Default Informational: Default 2) Enable SSL-termination (so the above IPS and AV inspection will also be on SSL traffic). 3) Enable URL-filtering and only allow already classified domains/URLs (by category). You will most likely need to enable dynamic lookups (against the urldb "cloud") since the downloadable db is only like top 10000 (or so) of each category. 4) Enable using a dynamic blocklist. This way you can have a box on your network which downloads and/or generates a txt-file with ipaddress which the PA box then will have a schedule for how often it should fetch this txt-file from this server and put it in a specific rule which you configured to block access. Either if there already exist a site which publishes recommended ip addresses to block and the particular bad sites are already included or if you do this on your own by using whois or such (for example if these sites is registered by the same user or so). 5) If possible also limit which filetypes will be allowed to download from Internet (and since you have SSL-termination also SSL/HTTPS stuff will be covered by this). Preferly by a whitelist ("only these filetypes are allowed, drop any other"). 6) If PA didnt create a public threatid for these bad files you could contact your SE or the appid team and ask them to do so. If possible you can also create your own signature (depends on how dynamic the bad files are). ... View more

Honeypot? 😉 Registered through: GoDaddy.com, LLC (http://www.godaddy.com) Domain Name: PANUG.COM Created on: 18-Mar-12 Expires on: 18-Mar-14 Last Updated on: 17-Dec-12 Registrant: Jason Ottwell 123 Nowhere Dallas, Texas 75126 United States Administrative Contact: Ottwell, Jason [email protected] 123 Nowhere Dallas, Texas 75126 United States (972) 555-5555 Technical Contact: Ottwell, Jason [email protected] 123 Nowhere Dallas, Texas 75126 United States (972) 555-5555 Domain servers in listed order: NS1.OTTWELL.COM NS2.OTTWELL.COM Registered through: GoDaddy.com, LLC (http://www.godaddy.com) Domain Name: OTTWELL.COM Created on: 11-Jan-06 Expires on: 11-Jan-15 Last Updated on: 17-Dec-12 Registrant: Akbar Ottwell 123 Nowhere Dallas, Texas 75226 United States Administrative Contact: Ottwell, Akbar [email protected] 123 Nowhere Dallas, Texas 75226 United States (972) 555-5555 Technical Contact: Ottwell, Akbar [email protected] 123 Nowhere Dallas, Texas 75226 United States (972) 555-5555 Domain servers in listed order: NS1.OTTWELL.COM NS2.OTTWELL.COM ... View more

oh bummer... Why do you use active/active? Could 2 standalone machines be an option in your case? Another way can be to use VWIRE so each box has two VWIREs and then your have routers/switches before/after which simply just run a 2x2 line etherchannel through your PA-boxes. Like so: switch/router1 int1 <-> PA1 (VWIRE1) <-> int1 switch/router3 switch/router2 int1 <-> PA1 (VWIRE2) <-> int1 switch/router4 switch/router1 int2 <-> PA2 (VWIRE1) <-> int2 switch/router3 switch/router2 int2 <-> PA2 (VWIRE2) <-> int2 switch/router4 ... View more

doh! oh yeah sorry about that I guess your best option is to file this as a feature request through your SE. A workaround might be to setup a dedicated dataplane interface and use that as your new mgmtinterface until this is resolved (unless there is some other method) which you then attach a dedicated VROUTER for the proper routingtable. ... View more

What if you go to Device -> Setup -> Services and click on Service Route Configuration. Choose "Select" instead of "Use management interface for all". Select "MGT" for all services (default should be just fine but explicitly select interface will make it more visible which interface is being used). And then in the right field named "Destination, Source Address" put your static route for these two specific ip addresses and use the MGT ip as source address in this configuration? ... View more

Thanks, I have filed this as a RFE (Request for Enhancement). ... View more

you are doing it wrong 😃 ... View more

Also stuff that needs ssl-termination (on some models) will be affected during a reboot of the mgmtplane. ... View more

However content updates do occur as emergency updates so checking daily should still be valid (personally I would like to see PA release updates hourly but thats me ) ... View more