About mikand

Would it be possible to implement some kind of "ignore these messages" so you wont get warnings you already know about (since a warning force you to read the commit popup just to find out you already knew that warning - compared to if no warning at all is displayed)? Along with somewhere in the GUI where one could see a list of ignored warnings (and be able to re-enable that warning again)? ... View more

To me it sounds more like that the youtube appid must be updated. Contact the app enhancement team at http://www.paloaltonetworks.com/researchcenter/tools/ for more information (they will most likely need pcaps and stuff). Another thought would be the "log portalpage only" (or whatever this setting is called) - but this (I think) would only affect whats being logged and has nothing to do with the appid stuff on its own. But sure, in case only portalpage is logged it would mean that a youtube session within a gmailsession (or whatever) wouldnt be logged and perhaps not even identified (in case this feature does more than just affect logging)? ... View more

Not that im aware of. However I think you could setup a DNAT rule to forward the NTP request made against some ip thats routed through the PA device (or ip which is already been used by the PA) into some NTP server of your choice. For example if you only use RFC1918 addresses in your core you could address the ip of the PA device and with DNAT similar to: srczone: inner dstzone: inner srcip: innerrange/cidr dstip: PA_ip service: udp123 translated dstzone: outer translated dstip: NTP_ip_on_outer along with a security rule that allows inner to reach outer for particular service like udp123 (and ip) and appid=ntp. ... View more

And I guess it wont work if two different VSYS (or for that matter two different PA devices) use the same panagent? Because (if we ignore redundancy for a short moment) one pan-agent per site will serve whatever this site has in its directory. Then no matter if you use 10 VSYS or 10 PA devices I think they should be able to speak to the same pan-agent (since the pan-agent is just a proxy between how PA wants the information and how the AD (or whatever) can present it). Or is a pan-agent limited to only serve a single PA device (or VSYS) at a time? ... View more

Is it possible for site B to setup an encrypted tunnel towards site A? Because then site B could force all its traffic (or whatever traffic you like) into this encrypted tunnel which will then pop out at site A in order to reach Internet. I dont have the details of how the China Firewall works (just some random rumours) but sending your facebook request in cleartext sounds odd that its allowed through this "Firewall" (or just a matter of time before also that is being blocked). ... View more

What kind of switch is this (model and perhaps firmware version)? Because if IGMP snooping in the switch is disabled then multicast packets will be handled as broadcast and flooded to all interfaces which belongs to the same VLAN except the interface which the packet arrived at. I have not dug into how the IGMP snooping will perform if there is no IGMP querier available but that sound somewhat odd to me that it would start to flood the packets as broadcast just because of that. Perhaps there is some setting for the IGMP snooping in your switch which can take control of this behaviour? From Allied Telesyn docs: " When IGMP snooping is enabled, the switch listens to IGMP membership reports, queries, and leave messages to identify which ports are members of multicast groups. Multicast traffic is then forwarded only to ports that are members of the multicast group. " which gives if there are no members the traffic will be dropped by the switch (not forwarded at all). In the case of Allied Telesyn there is also settings for which multicast addresses the IGMP snooping should act on (all, multicastrouter, default or ip) - perhaps this is a mismatch between your switch and your developers? You can also often configure the IGMP in the switch statically (as workaround) which will force the switch to forward a particular multicast address to specific interfaces (which should avoid having your other interfaces being flooded). ... View more

Check if any of these docs can be any helpful? How to Create an Application Override https://live.paloaltonetworks.com/docs/DOC-1071 Application Override and Scanning Engines https://live.paloaltonetworks.com/docs/DOC-1343 Does application override adversely affect Threat ID? https://live.paloaltonetworks.com/docs/DOC-2344 ... View more

Was the solution to construct the block page so it will on its own redirect the user? Like such: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">         <head>                 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />                 <meta http-equiv="Content-Language" content="sv" />                 <meta http-equiv="Refresh" content="0;url=http://www.example.com/" />                 <title>Blocked</title>         </head>         <body> Blocked<br><br> For more information click <a href="http://www.example.com/">here</a>.         </body> </html> ... View more

Im trying to dig into which setting will provide this in squid (if any). I know for sure that Farist proxyfw can do this but I dunno about squid. On the other hand the squid can add X-Forwarded-For header which PA can pickup in its logs. However the userid doesnt seem to be compatible with this according to: https://live.paloaltonetworks.com/message/1723#1723 https://live.paloaltonetworks.com/docs/DOC-1128 ... View more

Sorry I havent tested that many but what kind of limit is forcing you do to this? ... View more

No, I think its becuase the session WILL change and this is bad later on. An application can (as example) be first identified as unknown, and then web-browsing and then finally facebook. If you PBF just facebook it means that the syn/synack/ack is unknown, the http request is web-browsing and when the server replies its identified as facebook. If facebook server suddently get a packet from a new ip (your ISP2) without a syn first it will (most likely) just drop the incoming traffic due to its own sessionhandling (whatever firewalls they use) - or it least its a common thing to do. Which means you need to either use a forward-proxy which can split outgoing sessions depending on what the client requests or do this at L3 level by help of BGP magic. Facebook uses their own AS (if im not mistaken), if you use BGP towards your two ISPs you can make sure that traffic towards facebook AS will use ISP2 as primary connection. Another way is to do this at L4 level in the PA device, so outgoing TCP80 and TCP443 is always routed through ISP2 as primary way out. You can also setup a combination so that your clients use a forward-proxy for normal traffic while traffic to *.facebook.com (clientside configuration in the browser) is not sent through the forward-proxy (but this just adds complexity and is just wrong 🙂 ... View more

I agree... If you still need a forward-proxy (can be handy for cases where you dont want to have public ip's flowing around in your core and by that be able to setup IDS to sound an alarm if such packet submerges anyway) you should use a device dedicated for this work. Examples (depending on your needs, demands (assurance and stuff) and walletsize etc): http://www.squid-cache.org/Support/products.html http://www.bluecoat.com/ http://www.tutus.se/products/farist-firewall.html Most of the forward-proxies can be setup with keep-source meaning that you can still use user/panagent in your PA device (along with url-categories, av, ssl termination etc) if you setup like: client <-> forward-proxy <-> PA <-> Internet ... View more

The "cpu" of dataplane is the asic/fpga (depending on model). While the system cpu is what PA calls mgmtplane or controlplane. ... View more

The blockpage is just a htmlpage delivered to the client. So if you want it to selfadjust according to windowsize you should create your html so it will do so. The most simple way is just something like: <html> <head> <title>Blocked</title> </head> <body bgcolor="#ffffff"> <table> <tr> <td> <center>Blocked</center> </td> </tr> </table> </body> </html> or perhaps just a blank page (but you must then inform the clients about this ) ... View more

I find it odd that PAN would whitelist certain urls as the first document states - perhaps someone from PA could verify if this document is still valid? I believe that any whitelisting such as this should be done by the admin of the unit for security reasons. For example if I setup to decrypt EVERYTHING then I expect that EVERYTHING is being decrypted (and if one client fails such as with windowsupdate and I wish to allow it then I would add windowsupdate to the exclude list manually). As long as the dropbox client maintains its own trusted CA list and use a CA which isnt allowed by the PAN then allowing "dropbox" would mean that you only allow the webbrowser version (and can perform datafiltering regarding what type of files are allowed, antiviruscontrol and such). However this feels like far from 100% method to block the client itself (just look at the javaclient I linked to earlier). I believe that best option is still that PA develops two different applications for this (if possible) such as: dropbox - dropbox-webbrowser - dropbox-client Regarding your termination tests, how is your termination certificate setup in your PAN unit? Since there are flags if unsuccesful termination should be allowed or not (along with which cert to use for that case - the effect can be one cert when termination works and another cert where it fails, if you then in your browser placed the second cert as blocked the client would get a warning and decide on its own if it like to continue or not (for example if the cert at the webserver have expired or such)). ... View more