About mikand

mikand · ‎12-12-2012

I dont know if that is possible, I guess you will have to contact your Sales Engineer and file this as a feature request. A possible workaround might be if you can duplicate this application and in the copy specify which srcip (or srcuser if possible) must be used for this app to trigger. This way these dedicated users will have their app identified as copy_app while the other would be identified as original_app (and by that you specify session timeout settings in copy_app).

mikand · ‎12-12-2012

Will you get any values if you run snmpwalk against the PA device?

mikand · ‎12-12-2012

I usually look for the figures in the datasheets vs actual traffic load vs size of the wallet :smileysilly: It seems that the values presented in PA datasheets are closer to reality than other manufacturers figures.

mikand · ‎12-12-2012

Yes its related to the zone protection settings: show zone-protection {zone <zone_name>} Displays the running configuration status and run time statistics for zone protection elements. For more information, refer to the “Network Configuration” chapter in the Palo Alto Networks Administrator’s Guide.

mikand · ‎12-12-2012

I guess these settings might help (the first one is to remove that header from leaving your internal network): set deviceconfig setting ctd strip-x-fwd-for yes set deviceconfig setting ctd x-forwarded-for yes According to the CLI manual for PANOS 4.1: > ctd + bypass-exceed-queue — Set whether to skip inspection of session if queue limit is exceeded + http-proxy-use-transaction — Set whether to use transaction for stats for http proxy sessions + skip-block-http-range — Whether to skip the blocking of HTTP range requests + strip-x-fwd-for — Set whether to strip x-forwarded-for in http header + url-admin-timeout — Set URL admin continue timeout in minutes (1-86400) + url-coach-timeout — Set URL coach continue timeout in minutes (1-86400) + url-lockout-timeout — Set URL admin override lockout timeout in minutes (1-86400) + url-wait-timeout — Set URL category query timeout in seconds (1-60) + x-forwarded-for — Enable/disable parsing of x-forwarded-for attribute There is also a similar setting in "set system setting", dunno what the difference is: > ctd > regex-stats-on — Whether or not generate regex statistics > strip-x-fwd-for — Whether or not to strip x-forwarded-for from HTTP headers > x-forwarded-for — Enables or disables parsing of the x-forwarded-for attribute

mikand · ‎12-12-2012

Hopefully this thread might help you?

mikand · ‎12-12-2012

I found this document in the knowledge base, perhaps someone from PA could direct you to one more updated?

mikand · ‎12-12-2012

I cant find it either when looking through the CLI manual for PANOS 4.1. It seems that only the alarm facility has the vsys option to filter on when doing show log: > traffic — Displays traffic logs + action — Action equals or does not equal allow, deny, or drop + app — Equals or does not equal value + csv-output — Equals CSV output (no or yes) + direction — Backward or forward direction + dport — Destination port equals or does not equal (0-65535) + dst — Destination IP address in or not in (x.x.x.x/y or IPv6/netmask) + dstuser — Equals destination user name + end-time — Ending date and time YYYY/MM/DD@hh:mm:ss (e.g., 2011/08/01@10:00:00) + from — Equals or does not equal value + query — Equal to query value + receive_time — Receive time in the last specified time period (press <tab> for list) + rule — Equals or does not equal rule value + sport — Source port equals or does not equal (0-65535) + src — Source IP address in or not in (x.x.x.x/y or IPv6/netmask) + srcuser — Equals source user name + start-time — Starting date and time YYYY/MM/DD@hh:mm:ss (e.g., 2011/08/01@10:00:00) + to — Equals or does not equal value

mikand · ‎12-12-2012

If im not mistaken you need the wildfire license to get the logging to work from within PA regarding wildfire submissions. Other than that I assume each PA device should forward its logs to the Panorama if you set it up to do so.

mikand · ‎12-09-2012

Makes one wonder how the Quality Assurance was performed for: 46285 – Resolved the issue where QoS statistics were not displaying in the web interface.

mikand · ‎12-09-2012

Well actually metasploit is true exploits so I would rather be suprised if your PA would let this files through without any remarks

mikand · ‎12-06-2012

I had a similar discussion with "my" Sales Engineer at PA that wildfire claimed "benign" for a malware (in my case a custom made one to test how well behavioural (spelling?) analysis works). A major flaw with wildfire, in my opinion, is that wildfire will whitelist any signed (by known CA in the chain) applications. To me that is just bad looking at the stolen realtek certs and the others which have been used for the past year or two. Perhaps this could be the reason in your case? The other thing is what wildfire triggers on. It seems that it doesnt trigger on downloaders but rather the actual payload. Which I also finds a bit odd because if you trigger on the downloader (which often use at least one exploit) you would have a higher probability to keep your clients clean (or at least get a notify on how the actual malware got in). Otherwise you will (if lucky) only get a warning from Wildfire for the actual payload but the source of the infection will remain unknown (and can infect others when new payload is generated - on the other hand the downloader itself can of course also get new versions to avoid signaturebased detections).

mikand · ‎12-05-2012

Uhm yeah... Could it be that PA have some bug where "whatever.example.com" wont match a wildcard cert issued for "*.example.com" since "whatever" != "*" ? The only differences I could pick up between the two certs (since both intermediate and root cert was the same): [*.infoman.de] http://crl.godaddy.com/gds1-28.crl 2.16.840.1.114413.1.7.23.1: Certification Practice Statement pointer: https://certs.godaddy.com/repository/ DNS Name: *.infoman.de DNS Name: infoman.de [www.godaddy.com] http://crl.godaddy.com/gds3-61.crl 2.16.840.1.114413.1.7.23.3: Extended Validation (EV) SSL Server Certificate Certification Practice Statement pointer: http://certificates.godaddy.com/repository/ DNS Name: www.godaddy.com DNS Name: godaddy.com

mikand · ‎12-05-2012

mbutt's suggestion is for the userid to actually take effect for your security policies. In order to be able to select specific users (or groups) when you setup userid for a particular security policy you need to have the ldap server configuration active on your PA. You either let PA connect on its own to your current LDAP service or you let your PA box proxy through the userid agent.

mikand · ‎12-05-2012

You cant use your wildcard cert from GeoTrusts (unless they were really stupid and gave you a wildcard cert for "*" (compared to "*.example.com" which I assume is what you actually got from them)). What PA does is to use the CA cert (private key) to sign a cert created on the fly (when session starts) which is then sent to the client. The cert sent to the client will have expiration date etc copied from the real cert (real cert as in the cert which the target system sent to the PA box). The above is maintained just as you described, you either create this particular CA cert within the PA box (and then export it to its HA partner (private key + public cert) and put the public cert as trusted CA in all your clients to avoid getting a warning that the connection is not trusted) or you create this CA cert (and key) in a "real" CA server (or just use openssl) and then import it to both your PA boxes in the HA pair (if you have a HA pair otherwise just import the private key and public cert to the PA box you got). As a sidenote in order to handle cases where the real cert couldnt be verified you can use another cert (created just like above) as "untrusted cert" (and perhaps add it as untrusted issuers in your clients browsers). This way if the real cert (between PA box and target system) was successfully verified the PA box will sign the inbound cert (between PA box and client) using its "trusted forward" cert and then send it to the client. While if something went bad (like the real cert is expired or issued by a not trusted CA etc) the PA box will sign the inbound cert using its "untrusted forward" cert and then send it to the client.

Member Since	‎03-30-2010 08:39 AM
Date Last Visited
Posts	1,446
Total Likes Received	496

About mikand

Re: What is your experience of using site-to-site VPN with PA devices and how is the performance?

Re: Azure VPN Tunnel configuration MTU adjustment

Re: What the different between 'count' and 'repeat count' in the report?

Re: HA Cluster different transceiver type on each firewall

What is your experience of using site-to-site VPN with PA devices and how is the performance?

What tunnel options do you have for site-to-site using PA devices?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: Feature Request

Re: When should I use a non-tunnel mode gateway with GlobalProtect? Also: license needed for HIP? SSL vs. IPSEC?

Re: Pc does not join into Domain

Re: Overcoming an application filter and url groups

Re: Encrypted and Zipped files with virus in it

Re: custom session timeout for select user group

Re: PAN-OS 5.0.1 No Graph on QOS statistics

Re: Product sizing

Re: Interface "attack" counters

Re: How to get the client's IP address with x-forwarder-for in PAN.

Re: PAN Default Values for Threat Actions

Re: Support SSL/TLS Ciphers supported??

Re: search traffic logs by vsys in CLI

Re: Panorama WildFire Reporting

Re: PAN-OS 5.0.1 No Graph on QOS statistics

Re: Slow download for Metasploit Updates

Re: Is wildfire mistaken? false negative?

Re: SSL decryption - Forward UNtrust certificate presented

Re: Mapping users with user agent

Re: SSL Decryption: Clarification With Regard to Use of Wildcard Certs and Forward Proxy

Unlock your full community experience!

About mikand