About mikand

Would the new return to sender feature in PANOS 5.0 be something of your taste? " Symmetric Return (Return to Sender) – This feature extends the functionality of Policy Based Forwarding (PBF) rules to circumvent the route lookup process and the subsequent PBF lookup for return traffic (server to client). The firewall will use the original incoming interface as the egress interface. If the source IP is in the same subnet as the incoming interface on the firewall, symmetric return will not take effect. This feature is useful when you have servers accessible through two ISP connections (on different ingress interfaces) and the return traffic must be routed through the ISP that originally routed the session. " ... View more

If im not mistaken using TS-agent will assign a portrange per user on the server which the TS-agent then informs the PA device of. Like sending info to the PA device that if an outbound connection is made where sourceport is 1100-1199 then the PA should log this as userX. If port 1200-1299 is used then its userY and so on. However im not sure if its the TS-server that does on its own and the TS-agent just reads these values or if its the TS-agent who configures the TS-server for this. So my thought is if your application for some reason tries to use its own srcports which the TS-server simply just drops (because its not the srcports which is assigned to the user running your application) so your app logs connection errors? ... View more

What about Teredo and other similar tunneling protocols for using IPv6 through a IPv4-only network? The example I had in mind was a IPv4-only network where the servers and clients themselfs do the 6-in-4 stuff. ... View more

I think your best option would be to file this as a feature request against your PA sales engineer. The new log/panorama appliances do have 2 NIC's where the other is named "Reserved for future use" so I hope it should be at least theoretically possible. ... View more

When you setup a profile for the IPS in Objects -> Security Profiles -> Vulnerability Protection you can define if packet capture should be performed or not (either globally like a group of threatid's or specific threatid's). I cant find any info in the manual if packets from before the packet that triggered the attack signature will be part of this pcap. ... View more

What do you think is the probability that PA can do this in near future? Because I understand that a single session can only have one appid at a time but what if a subappid is added or something like that? Like if youtube is identified you will have: appid: youtube subappid: none But if youtube is identified within a 6in4 tunnel you will have (for example): appid: 6in4 tunnel subappid: youtube This way appid is the outer identified appid (the tunnel itself) while subappid is the inner identified appid (the content of the tunnel). Specially now when IPv6 will grow and the organisations who cannot convert to IPv6 for one reason or another but still need to access IPv6 hosts will in many cases use various 6in4 tunnels and by that the good stuff of PA regarding application identification will virtually be lost. ... View more

I think thats expected behaviour regarding volume counting. I mean thats what I would expect it to do if the PA box were in inline mode (lets say vwire). TCP session 1 sends packets (lets say 100 bytes each): 1, 2, 3, 4, 5, 6 = 600 bytes in total and 6 packets. TCP session 2 sends packets (duplicates): 1, 1, 2, 2, 3, 3 = also 600 bytes in total and 6 packets which has pass the unit. Otherwise I think you would also end up with broken stats like regarding bandwidth utilization. Lets say someone tries to DDoS your setup and send the very same packet 1953125 of them per second (64 byte packets). This would fill up your 1Gbit/s link and I would expect the PA device to show just this that the bandwidth consumed is 1Gbit/s and not 512 bit/s. ... View more

What if you run a snmpwalk against the device starting at .1 ? I mean in case the OID's changed. ... View more

Can PA modify this if feature request is raised or is this hardcoded on the silicon being used? ... View more

I had to Google to find out what DSRI stands for: DSRI = Disable Server Response Inspection (in case someone else wonders 😉 I found this document at the same time regarding performance figures: http://www.commsolutions.com/uploads/PA-lNetwork%20World%20PA-5060%20Review.pdf So yes if performance is an issue (and you cant get more PA-boxes to cluster as described in http://www.paloaltonetworks.com/literature/solution-briefs/tech-partners/arista.pdf ) you can enable DSRI (that is disabling server response inspection) for specific flows. However there are many cases where disabling DSRI (that is enable server response inspection) would be good security wise. Clients browsing the Internet is probably the most obvious (this way we can detect infected clients (trying to infect servers) but also infected servers trying to infect clients). This including "trusted" sites. But I think it can be healthy also for incoming traffic to your own internal servers. If you have DSRI enabled for those flows you wont detect (and possible block) if one of these servers gets infected. And the risk might be higher for that on internal networks because you often keep a track on patching (hopefully 😉 the servers in DMZ (facing Internet) but internal servers tends to get sloppy after a while (or are appliances where it depends on how active the vendor is before patches are released). Probably because the threat isnt as visible as with that Internet facing DMZ. I wonder if the PA-devices are "smart enough" to not perform server response inspection where this inspection wouldnt find something bad anyway (which on its own might be bad aswell if you enable IPS and it actually wont do as you think it does)? Or for that matter what is disabled when you disable server response inspection? Could you for example enable inspection for the antivirus engine but disable it for the IPS - and if so, would you really gain something performancewise as quoting from the above pdf: " Regardless of which UTM features we enabled - intrusion prevention, antispyware, antivirus, or any combination of these - results were essentially the same as if we'd turned on just one such feature. Simply put, there's no extra performance cost, beyond the initial sharp drop in rates, for layering on multiple types of traffic inspection. " Edit: Changed some text above because disabling DSRI actually enables server response inspection :smileysilly: ... View more

Where can I then find whats the currently latest available recommended version to use in production? Because with that explanation I interpret this as, for example, PANOS 5.x should be avoid for the next 6 months or so!? Doesnt PA do any quality assurance before a new version (major or minor version) is released to the public? ... View more

While other https sites like gmail.com works without problems? ... View more

Yes, I think X509 is the way to go. And yes I was wrong about the order - it seems that it should be with the most specific cert first like so: -----BEGIN PUBLIC CERT----- base64stuff of Thawtes signing of your key -----END PUBLIC CERT----- -----BEGIN PUBLIC CERT----- base64stuff of any intermediate CA-cert -----END PUBLIC CERT----- -----BEGIN PUBLIC CERT----- base64stuff of CA-cert -----END PUBLIC CERT-----   have a better description of the intermediate problem. Then on the client side im not sure if its sufficient to just import this as trusted CA (in the client browser): -----BEGIN PUBLIC CERT----- base64stuff of Thawtes signing of your key -----END PUBLIC CERT----- or if you need to have the intermediates included in the same pem file. ... View more

By the way, could you verify if this is the case for you? ... View more