About mikand

mikand · ‎09-05-2012

I find it harder to read... But my intepretation is: srczone: trust dstzone: untrust srcaddress: any but A or B dstaddress: any but X, Y or Z unless you meant that you negated B and Z only and not all the selected ip/ranges :smileysilly:

mikand · ‎09-05-2012

That depends if the device is a PA or not. The PA who will be managed must have ssh enabled in a mgmtprofile and that mgmtprofile attached to proper interface as Ameya said. However if its some other device but have a PA as a firewall you could first try without ssh-termination: 1) Create NAT. 2) Create security policy who will allow incoming SSH connection (to be forwarded to the device that will be managed). then when above works you can add the SSH-termination (decrypt rule) aswell. Regarding NAT and security policy this is what you would need to do: NAT: Original packet src zone: untrusted Original packet dst zone: trusted Original packet dst int: eth1/1 Original packet src address: <ip or range of the ssh client> Original packet dst address: <ip the client will connect to> Original packet service: TCP22 Translated packet dst: <ip of the device to be managed on the inside> Security policy: src zone: untrust src address: <ip or range of the ssh client> src user: any src hip: any dst zone: trust dst address: <ip the client will connect to> application: ssh service: TCP22 The thing(s) to remember when creating security policies for NATed traffic is: src zone: zone the original packet comes from dst zone: zone the translated packet will go to dst address: dst ip address the original packet had Edit: I think I was incorrect regarding "Original packet dst zone" in this case. It should read untrusted because the ip the client is connected to is the ip of the untrusted interface of PA.

mikand · ‎09-05-2012

I guess that domain\group is a static value. Are there any variables available to make the reportengine enumerate through all groups? For example if I want a report for example.com and admin-group one would write: example.com\admin Output would then be: example.com\admin: trust -> untrust, 123456 bytes but if one want a report where one want all groups displayed in the report (bytes grouped by group): example.com\$group Output would then be: example.com\admin: trust -> untrust, 123456 bytes example.com\a-group: trust -> untrust, 567 bytes example.com\b-group: trust -> untrust, 890 bytes ... example.com\z-group: trust -> untrust, 123 bytes

mikand · ‎09-05-2012

I feel that the default values in the doc mentioned earlier are a bit high - but I guess there is some good reason behind each setting for why its so high. What are the most aggressive settings that are still fine to use regarding mgmtplane utilization etc? Because I have a bad feeling that something would break if one select the lowest values for each item like: Age-out timeout: 1min User membership timeout: 1min Security log timer: 1sec Netbios probing (is the same as for wmi?): 1min Server session timer: 1sec

mikand · ‎09-05-2012

Since . is treated as wildcard in many regexp engines you need to escape such characters. Escaping is often done by adding a backslash in front of the character you wish to escape. Same goes with if you want to detect \ you need to escape it so its written as \\ So in your case: value: /a/domain\.com\.br should be the proper one.

mikand · ‎09-04-2012

Shouldnt a decreased TTL for the various caches slightly increase the load for the mgmtplane?

mikand · ‎09-04-2012

Check out this doc regarding various types of threat prevention: https://live.paloaltonetworks.com/docs/DOC-3094 If im not mistaken file filtering can be set for the same protocols as antivirus filtering: http, smtp, imap, pop3, ftp and smb. However file blocking is set per application (only applications where you can use file-blocking on is selectable when you create a file block profile - usually one would use "any" as application for file blocking profile and then let the security profile decide which application will be allowed through).

mikand · ‎09-04-2012

I dont know how roundrobin dns names are handled in the PA. But regarding address objects containing FQDN instead of IP the FQDN is resolved during commit and then there is a script that every 20 (or if it was 30) minutes will recommit the FQDN portions to keep them up2date (because in the fabric only ip addresses are being handled). In you case (if possible) you could add an url filter aswell if you only want to allow requests towards www.microsoft.com.

mikand · ‎09-04-2012

Even if PA on itself doesnt (yet?) support STP (spanning tree) - shouldnt a L2 interface still forward the STP-packets? I mean if you setup int1 and int2 as L2 (on the PA), connect a vlan-interface to int1 and int2 (within PA) - then the switch which is connected in the other end (running STP) should be able to disable the interface who is causing the loop?

mikand · ‎09-04-2012

My best guess is that it cannot create such report unless you add some sort of estimate for how long an ongoing session will be. The data a PA will save is the lifetime of a single session. A session is either a tcp-session or a udp session regarding TTL settings. This gives that unless keepalive is being used on the http server the client will have multiple (tcp)sessions towards this webserver during a single visit (or rather a single visit where the client is browsing around on this particular site). So there is (as far as I know) no data stored in the PA to determine if the client visited this site at 12:00 and at 12:10 used the same browser session or if it is one person browsing from this client at 12:00 and at 12:10 it was someone else (with a different browser but from the same client ip) who visited the same site. I guess contacting your Sales Engineering and suggest this report type as a feature request would be something good to do because I guess more will request the same thing (specially from those who replace a webproxy with a PA device).

mikand · ‎09-04-2012

Stuff in the same decryption policy works as AND, while compared to a different policy it works as OR. So it should be the same execution path as security policies have regarding top-down first-match. A tricky part when it comes to decryption policies might be the "allow encrypted traffic" which a rule can have in case it cannot decrypt the matching traffic. If a session (or packet) matches your particular decryption rule and "allow encrypted traffic" is not set then the flow will be blocked.

mikand · ‎09-03-2012

I think it should work fine. However there are a few manual steps involved depending on which features you use. For example if you use custom block/continue-pages and ssl-termination, then those needs to be manually loaded afterwards (or beforehand - I dont recall if the config will scream or not if the cert is missing when loading the conf).

mikand · ‎09-03-2012

And the license is not expired?

mikand · ‎09-02-2012

If im not mistaken you can do this in 3 different ways in a PA device: 1) Setup a custom URL-category which you attach to each rule (rule1 will allow srcip:any to access service1 and rule2 will only allow srcip:x.x.x.x to access service2). 2) Setup a custom APP-ID that will be identified when each service url is being used. 3) Setup a custom IPS signature to trigger if the request doesnt match, and use this custom IPS signature only for the two rules above. You could of course also combine the methods mentioned above. The good part with using method 2 above (as example) is that your reports will have these requests as their own line (appid:service1 and appid:service2) - the bad part is that you probably have other files on your webserver which each service will use (lets say background pictures or such using /pics as uri or so) and in those cases you will need to look at several appids to find out for example how much traffic each service uses.

mikand · ‎09-01-2012

You are in the vuln profile instead of the antispyware profile - dunno if that should matter (but it does when you search at threatvault where there are virus, vuln and spyware as three different databases for some reason).

Member Since	‎03-30-2010 08:39 AM
Date Last Visited
Posts	1,446
Total Likes Received	496

About mikand

Re: What is your experience of using site-to-site VPN with PA devices and how is the performance?

Re: Azure VPN Tunnel configuration MTU adjustment

Re: What the different between 'count' and 'repeat count' in the report?

Re: HA Cluster different transceiver type on each firewall

What is your experience of using site-to-site VPN with PA devices and how is the performance?

What tunnel options do you have for site-to-site using PA devices?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: Feature Request

Re: When should I use a non-tunnel mode gateway with GlobalProtect? Also: license needed for HIP? SSL vs. IPSEC?

Re: Pc does not join into Domain

Re: Overcoming an application filter and url groups

Re: Encrypted and Zipped files with virus in it

Re: SSH decryption policy

Re: SSH Config

Re: How to generate reports?

Re: User Identification Timeout - What to do ?

Re: Custom Gmail Signature

Re: User Identification Timeout - What to do ?

Re: Mail filtering

Re: Will FQDN names work when the name resolves to a content delivery service?

Re: Redundant links

Re: Site Visited User Report by Time.

Re: SSH decryption policy

Re: Device Upgrade 2020 to 5000

Re: URL categories not being resolved

Re: Can PAN support inbould traffic filtering based on URI?

Re: Singnature to detect Flashback trojon

Unlock your full community experience!

About mikand