About BPry

BPry · ‎11-22-2016

A few things about this setup: 1) If you are forming the IPSec connection through the Palo Alto Firewall just use GlobalProtect and setup the SSL VPN. 2) Don't use an unsupported Cisco client that has known security issues that will NEVER be fixed. 3) GP is a free product and way more servicable than IPSec connections. IPSec is great for Tunnels, but not to actively use on client devices trying to connect back to the office. You should really be moving away from IPSec as a whole.

BPry · ‎11-22-2016

That was what I was thinking of when I commented. When you are trying to find out addresses or URLs the best way to test them is to turn all traffic off but what you are testing. Of course you can't stop all unintended traffic but you can limit it, and by only using SnapChat while testing you should be able to filter out anything else your phone connects to.

BPry · ‎11-22-2016

Where is snapchat pulling the pictures from? My guess is that part is not being identified correctly and they pull it from servers that are not identified as Snapchat but instead identified under something else. I would setup a rule that monitors the traffic and then see if you can't get the domain or IP address of the pictures source and block that as well.

BPry · ‎11-22-2016

How did you block it in the URL filtering? If you make a custom URL Filtering for this user and list *.youtube.com and youtube.com in the block-list and set the action to block then you should be perfectly fine by just listing the URLs and it shouldn't block Google. You would just need to make a special rule for your special user. Really though this is trully an issue for your HR department; sometimes companies try to solve HR issues with Tech and it never works out.

BPry · ‎11-22-2016

Just following the replies so that I know the solution to this. To get around this in the past I've been simply putting all applicaiton rules above my more broader rules at the bottom of our Security Policies list. This is a really a good time to get MineMeld involved though, as you can pull the list of IP addresses that Microsoft is recording and simply set that as the destination. It gets to be more upkeep on services that don't list the IP addresses that they use but I've been making it work with selecting the IP addresses and making a custom URL Category when it only lists the URLs

BPry · ‎11-22-2016

To add on this because of the way that Skype opperates there will likely never be a good way to not decrypt Skype traffic and make it identify properly.

BPry · ‎11-16-2016

I'm thinking that it's likely a typo. There isn't an argument like that for a batch file

BPry · ‎11-16-2016

You could simply export the Object lists through by taking them out of the XML and then just modifying them all to use vsys1. Then import into your VM-200

BPry · ‎11-16-2016

I'm with @Brandon_Wertz. There has to be a better way to actually role these out if it isn't going to ever work with our software version; getting high level system alerts in the middle of the night isn't exactly 'fun' only to look at the release notes and relize that they are objects that will never be installed on the version we are running, for an OS that isn't even public yet. Does this mean that we will see these alerts until the release of 8.0 and our eventual deployment to that platform, because if so I need to figure out a way to modify how these alert so it doesn't come across as a 'high' level system alert. Not a fan of waking up to discover a non-issue at 1 in the morning.

BPry · ‎11-16-2016

Glad it was something simple. I actually just realized a few minutes ago that I was also running get instead of set; when you run set you do actually get a malformed entry but when you run get it just says success regarless if there is a rule that matches the name or not even when I add the missing 'entry' statement.

BPry · ‎11-16-2016

Okay so below is what I've been attempting to use for the creation of policies automatically though the API; however when I run it I simply get a Success output and the rule never actually completes. Can anybody tell me where this is missformated? /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/[@name='$NewRule']&element=<source><member>$Source</member></source><destination><member>$Destination</member></destination><service><member>$Service</member></service><application><member>$Application</member></application><action>$Action</action><source-user><member>$srcuser</member></source-user><option><disable-server-response-inspection>no</disabled-server-response-inspection></option><negate-source>$negsource</negate-source><negate-destination>$negdest</negate-destination><disabled>$disabled</disabled><log-start>$logstart</log-start><log-end>$logend</log-end><description>$description</description><from><member>$srczone</member></from><to><member>$dstzone</member></to>

BPry · ‎11-16-2016

Is this a new user-id setup or was this working previously?

BPry · ‎11-15-2016

The easiest way I can think of with Firefox is building out a config file with CCK2 and then just pushing it out to everyone. The process really does depend on what your cert actually looks like though; if it's an old self-signed then Firefox likely doesn't support adding it anymore.

BPry · ‎11-14-2016

If you have setup a rule that allows it to bypass all your security policies and didn't include any of the protection profiles then I would go out on a limb and say that it isn't your firewall, esspeically if the traffic is getting reset from the client. Run a PCAP and make sure that the firewall is reporting things correctly but it sounds like someone is actually reseting you from whever you are trying to download these files from.

BPry · ‎11-11-2016

What mode are you running in? Full transparency with Reset is known to cause time-out issues which would explain why you are seeing issues.

Member Since	‎05-26-2016 07:16 AM
Date Last Visited	‎02-24-2026 02:19 PM
Posts	6,520
Total Likes Received	2296

Online Status	Offline
Date Last Visited	‎02-24-2026 02:19 PM

Unlock your full community experience!

About BPry