About BPry

Is this just going directly to the management IP and you get this without entering anything? I would check to make sure you don't have your passwords saved and your browser isn't trying to login for you directly.  ... View more

My understanding of sinkholing is that when it's active you are actively inspecting the traffic and then setting the DNS record to send it to another device, often times stopping the traffic all together. The botnet report is simply telling you that the PA has identified the devices going to the malicious links but doesn't actively take steps to block it.   ... View more

Supposibly this was tried and didn't work; I haven't tried it directly as I had configured it with the tunnel and basically called it ready to deploy. I didn't realize at the time that they had only purchased a 8 port POE switch and hadn't planned on the PA-200 using ANY of the ports on the switch...you know because magic 🙂 ... View more

Port 1/4 is configured as the DHCP server ... View more

That I'm not sure. It might be worth doing a packet capture and seeing specifically where that traffic is going and what it's doing. I haven't seen that signature throw a false positive on our 3020s or 200s but if you send the universities public IP address I could connect to it and see if it's something to do with the threat signature or if it's specific to your equipment.  ... View more

It looks like both of your threats are generic:weebcan.rapidsys.com identities. Your private address is in the attacker field because it is the "attacker" in this scenario, that information is probably correct. Both were released on 6-29 of this year.  It's being identified because rapidsys is being identified as a hacked website at the moment which is why they pushed out the threat with WildFire. I imagine that someone is either accessing or you yourself are hosting a website using the service. It's a pretty sound signature from what I can see; so I don't see how it could really be a false positive.  ... View more

I don't believe there is a breakdown for this available on the PA. show system resources would give you the CPU utiliztion listed by PID whcih might give you some insight on what is causing your high CPU utilization if you could figure out the PID number and ask your SE what it is. show system setting ssl-decrypt memory might show you if something perhaps got caught in the decryption process.  It may be worth noting to that since more websites are switching to SSL and TLS it could be that you have simply outpaced the ability for your specific model of PA to keep up with the traffic. It may be time to move up to something bigger and better.  ... View more

  My appologies, I didn't look at the threat-id very close and mistook it for a error that we were having earlier.  1) Make sure that your Vulnerability Protection Profile isn't changed from the default action. 2) In the meantime you might want to setup a rule that allows the application connection from Trust users to that specific IP address with everything except a Vulnerability Protection Profile to mediate the issue for the time being. If I would have to guess though your Protection Profile is set to something other then default.  It might be a good idea to have your programmers look at the application though. It sounds like if someone enters in the wrong password then the application is rapidly trying to login without a pre-defined wait period between authentification tries. Unless this is happening everytime a user logs in but I imagine it would be a more pressing issue if they physically could not access the application.  ... View more

Probing would ensure that the correct user mapping is established as long as they are authenticating when they enter the website and that information is forwarded to the PA. You wouldn't necissarly need to do a captive portal solution if you had them authenticate with their domain credentials when they first logged into the wireless. This can be accomplished through a Radius server. This method of course hinges on the thought that you have an AP that is actually capable of doing authentication without the captive portal; I imagine if you have some cheap home router serving out your wireless then it won't have the ability to authenticate users without a captive portal.  ... View more

We actually had this issue on our 3020 and it has to do with update 595. From what I have heard not many people were actually effected by it because most networks don't have the internal SMB traffic pass through the firewall. The only reason we noticed the issue was because of a seperate zone that we use for AnyConnect and these were the only users to my knowledge that were ever affected by it.  ... View more

"This issue was caused by a PAN-OS bug in 7.1.x, that was triggered by the introduction of an IPS signature in this content update. The bug impacts traffic processing and application identification on firewalls running PAN-OS 7.1.x"   This was the information that I was able to find. It seems like in the past month I've ran into more problems with threat signatures then what I thought was possible. It would be nice if Palo just set these to alert instead of reset-both if they were unsure if they were actually going to work. I would rather have something that was only alerting me to an issue instead of something was was breaking connections.  ... View more

It would be nice if they provided a little insight to what was actually happening with 596 as our 3020 was all ready to install it before the update was pulled; thankfully it only installs on Wednesdays at 1am or if I really want to force it because of a false positive.  This update with the SMB fix was soemthing I was really looking forward to as well, since that broke some things for us earlier and I've had to just exlude the vulnerabilty ID for a specific user group.  ... View more

Hey look it already does a thing that I wanted, thanks Palo! ... View more