About cryptochrome

Yep. That's what worries me too. In PanOS 5.0 these dependencies are automatically resolved (so you actually never see what the firewall is really opening up). says that it will never be unknown-tcp that would be resolved, but why did 4.x need unknown-tcp and 5.0 does not? Where is this documented? I find this really scary. ... View more

I was really upset when I wrote that thread and I might have become too rude throughout the discussion, but I've had it with Juniper back then. Their NSM caused so much trouble it was unbelievable. Unfortunately, the same still holds true today. I just had a major crash on NSM two weeks ago from a failed DMI schema update. I love the SRX for it's concept and the beauty of Junos, but NSM is destroying that platform for me and a lot of my customers. Anyways. This probably doesn't belong here. ... View more

yep. that's the same Cryptochrome :smileygrin: ... View more

So that means, if there are dependencies:    1.) It will resolve them automatically and add the needed services, invisible to the user.    2.) Because of that, I don't what what I actually allow through my firewall. Excuse my ignorance, but are you guys serious? ... View more

Ok, you are right, there are no warnings anymore about uknown-tcp on commit. However, you are saying that 5.0 automatically resolves those dependencies, does that mean it will actually include the needed services without me specifying them in the rule? That would mean it will still open unknown-tcp/udp. Bittorrent was just an example. I've seen this dependency with other apps as well. If other apps rely on unknown-tcp/udp, doesn't that make the whole thing completely insecure? I am opening up the firewall for unknown traffic. ... View more

Ok, say I have two rules: 1. src: any, src-user: unknown, dst: webserver-a, app:web-browsing 2. src: any, src-user: my_users, dst: webserver-a, app:web-browsing, port 10001 Now the first thing the user does is open http://webserver-a:10001 In that case, the first rule would not match and he would never see CP. Did I get that right? If so, the user always has to do something first that is allowed by another rule (in this case rule nr. 1) to be able to trigger CP? Confusing. Or I still don't get it. ... View more

Thanks. I am still puzzeled by the first policy you mention. My understanding was that the captive portal is transparent. So if I set up a rule that requires a user to authenticate, shouldn't captive portal page show up transparently and thus only one policy necessary? Anyways... so the first policy is set to unknown user to get the captive portal page to show up. But what do I allow in the first rule and to which destination? If my actual matching rule is supposed to be the second one, what do I put in the first? Sorry, but this kind of evades my logic :smileygrin: Cheers Sascha ... View more

Looks like we're getting closer    So why two policies? Can't I put this in one policy? Destination server is HTTP, but operates on port 10001. Thanks Sascha ... View more

It has local DB selected. I tried with users only, but to no avail. If enabled with a typed in user and generate traffic, I don't get a captive portal page and traffic is denied (confirmed via traffic log). ... View more

Hi, thanks. But I can't confirm this. I type in the full user/group name but it still doesn't work (I am using captive portal for this). By the way, this is PanOS 5.0. Sascha ... View more

Ok, this is definitely related to ssl-decryption. I tried from clients that are not decrypted by the PA unit and from there it works flawlessly. ... View more

yes and no. ssl forward-proxy but no blocking of sessions (the only thing being blocked in the decryption profile are expired certificates). I am seeing tons of blocked *incoming* skype sessions though (from untrust to trust). my incoming policy is to deny all. but it shouldn't block incoming skype sessions that are "stateful", e.g. result from outgoing sessions. right? ... View more