About BPry

http://www.theregister.co.uk/2016/09/05/sundown_exploit_kit_authors_champions_of_copypaste_hacking/   This is the most recent article that I could find explaining the SunDown exploit kit. Esentially they just steal what is already being used in the most popular exploit kits and repackaging everything as their own kit.  ... View more

Just wanted to make sure that the IPSec Tunnels that we are using with this set aren't actually covered by the license. Thanks for the link!  ... View more

Brad, The official list of supported VPN Clients would include PA's GlobalProtect Client. Even Cisco will not officially tell you that you can use any other VPN client except for AnyConnect.  This question also would have two different answers to me. IF you setup an IPSec VPN connection and terminate it on the Palo Alto then hypothetically anything that included IPSec connection capabilities should work as long as they don't hard-code variables to work with their equipment. If you are trying to terminate GlobalProtect SSL connection through a third party then I'm pretty sure that isn't actively going to work.    P.S I can see why you would want to do this, seeing as IMO I don't think the GlobalProtect client is user friendly, but I doubt your actually going to get this to work.  ... View more

Generally you would just create a custom application ID. Since you already know the IP addresses and the ports that they are going to that would be the route that I would take if you are blocking traffic on non-standard ports. Shouldn't take more than a few minutes per custom application.  ... View more

I've found the best way to actually manage something like this is app-id and URL Filtering. Trying to keep up with the IP addresses of different service providers (Google, Azure, AWS) is only going to get more difficult; you may try and contact Google Support and see if they will give you the IP address list itself that is associated with 1e100, they are generally pretty good at handing out that information.  ... View more

It would be nice if Palo just added the dang functionallity of wildcards or FQDNs in the policy map. We all know that this is possible since almost every other major Firewall brand is offering it, and Palo itself is capabale when it comes to URL Filtering. I don't see any reason to have to buy MineMeld to get this to function.  ... View more

I'll second the fact that PA should allow more than 500 results on a custom report; even when it comes to applications or connection attempts there are times where frankly 500 results can amount to an hours worth of results to particular applicaitons. As it sits when I run weekly reports that are very vague I run into an issue where I can't actually get all of the information in one run because I cross the 500 result limit, even with grouping and heavily segregating out the information that I actually need.  ... View more

Personally we don't run GP at all and have chosen to just continue to use ASAs for the VPN and have the PA do everything else. The issue with GP had more to do with it not being near as user friendly as AnyConnect has been and given the choice users didn't want to switch.  ... View more

You would run the same tests, just after moving your laptop behind the firewall. As a side not, because I'm not sure if I 100% understand your question, if you are getting the quoted speed infront of the firewall it doesn't really matter what you get behind the firewall for the ISP; as long as they get the bandwidth to their termination point they don't care if you get that bandwidth after any device you put behind it.  IF you are having problems with the throughput on the firewall look at what your model actually supports, if this is coming from a PA-200 or PA-500 it would be fairly easy to bump your ISP speeds over what those models actually support.  ... View more

The conversion tool is far from perfect and does require alterations when the config is actually put onto the Palo Alto.  ... View more

@DensonJHH you may want to run both show vpn ipsec-sa tunnel {name} and show vpn ike-sa gatway {name} and see if they are not being released from there. I've run across an issue on our 3020s that if the tunnel goes 'down' but still shows up on the system the 3020 won't realize that the tunnel has dropped and still show that it's up on the gui.   ... View more

@Brandon_Wertz Thanks! I've actually had the server setup for a while, evidentally I never actually enabled it on any of the interfaces however.  ... View more