About BPry

BPry · ‎06-17-2016

With the IP instead of the EBL object the rule functions as it should. I also tried creating a rule specifically saying that our inside network can't go to the EBL as the destination and that appears to function fine.

BPry · ‎06-16-2016

Hopefully this is what you were looking for. domain: 1 receive_time: 2016/06/16 14:39:46 serial: 001801005401 seqno: 34507671 actionflags: 0x0 type: THREAT subtype: vulnerability config_ver: 1 time_generated: 2016/06/16 14:39:46 src: 184.24.76.74 dst: 10.191.44.21 natsrc: 184.24.76.74 natdst: rule: Rule 644 srcuser: dstuser: \jallison srcloc: US dstloc: 10.0.0.0-10.255.255.255 app: soap vsys: vsys1 from: outside to: inside inbound_if: ethernet1/2 outbound_if: ethernet1/1 logset: Solarwinds-Email time_received: 2016/06/16 14:39:46 sessionid: 51703 repeatcnt: 10 sport: 80 dport: 63177 natsport: 80 natdport: 13041 flags: 0x400000 proto: tcp action: reset-both cpadding: 0 dg_hier_level_1: 0 dg_hier_level_2: 0 dg_hier_level_3: 0 dg_hier_level_4: 0 vsys_name: device_name: LegFPA1 vsys_id: 1 threatid: HTTP Request Brute Force Attack(40059) reportid: 0 category: computer-and-internet-info contenttype: severity: high direction: server-to-client url_idx: 1 padding: 0 pcap_id: 0 filedigest: user_agent: filetype: misc: cloud: xff: referer: sender: subject: recipient: file_url:

BPry · ‎06-16-2016

Here you go. I'm trying to block the traffic coming from the EBL IP list; I'm starting to question if I don't need to set the destination as the EBL IP. When I look at the alert however it shows the source as one of the EBL IPs coming into the inside (Trust) interface, so I'm fairly certain that this should function perfectly fine. http://textuploader.com/5b84q/raw : This is the link to the test EBL that I made, from what I could see in Palo Alto guides to working with the EBL the fact that I left out the /32 shouldnt' be causing issues but I'm not 100% positive on that.

BPry · ‎06-16-2016

Yes, that's actually where I pulled it for the original post.

BPry · ‎06-16-2016

I've just started to test working with an EBL to quickly update a block list without having to apply the URL Filter to all of the different groups that we have. I've verified that I have connection to the document and that the Palo Alto sees it but I can't actually get it to stop showing traffic, instead the HTTP Request Brute Force Attack reset picks it up instead of the rule that I have the EBL on. Currently the output looks like the following: Next update at: Thu Jun 16 15:00:31 2016 IPs: 184.24.76.74 104.66.34.213 23.197.186.129 173.241.244.220 104.95.37.162 The Rule is near the top of the list, set to universal on the outside zone with the EBL list set as the source address to any destination, any service, any applicaiton, and the action is to block it and log at end. The issue is I'm seeing in the alerts is that it's identified as Rule 644 which is a catch all allowing traffic on HTTP and HTTPS instead of being blocked by the EBL. Is there something wrong with the way that I've inputed the IPs?

BPry · ‎06-16-2016

Out of curiosity; is there any way to be notified about issues such as this as soon as it happens? Palo Alto doesn't seem to do a very good job of notifying owners about potential issues, as this is the first time I've seen any mention of major issues with 7.1.2 with the 3k series.

BPry · ‎06-16-2016

Couldn't you just modify the scrpit and leave out the portions of opening and closing the VPN connections? I'm not sure what your scripts are doing but I don't see a reason to need the VPN to close after a script unless you're trying to limit the amount of traffic through the VPN.

BPry · ‎06-15-2016

jprovine, If you look at the following I'm fairly certain that you can accomplish this fairly easily with anti-spyware filtering.

BPry · ‎06-14-2016

Angel, It's probably best to start a new discussion rather then respond to one that is a few years old. There you would be able to provide more information about your setup and what issue specifically you are having.

BPry · ‎06-14-2016

Could you not use the pre-logon?

BPry · ‎06-14-2016

Any chance you're running into an issue with the FTP rule not catching FTPs?

BPry · ‎06-13-2016

We had an issue with our LDAP servers not pulling in updates to groups that was causing issues. The solution turned out being deleting the connections and readding them; after that everything has been workign perfectly. Not sure if you have tried doing so yet?

BPry · ‎06-13-2016

slv, It takes a minimal hit on the CPU utilization having one tunnel enabled with about 10 users behind the device. I don't know if you had more devices if it makes a bigger impact or not, but I would not say that it causes a major concern.

BPry · ‎06-07-2016

Thanks Ben! That's what I was seeing but I wanted to make sure that I wasn't missing something.

BPry · ‎06-07-2016

Does anyone know of a way to make multiple response pages for different user groups. Specifically the URL Filtering and Category Match Block Page? Essentially what I'm trying to do is create two different responses; one that will tell you your request was blocked because of policy, and the other one will simply block the traffic and display a blank page that doesn't give the end user any notification that the category in question is actually being blocked.

Member Since	‎05-26-2016 07:16 AM
Date Last Visited	‎05-14-2024 01:03 PM
Posts	6,012
Total Likes Received	2084

Online Status	Offline
Date Last Visited	‎05-14-2024 01:03 PM

Unlock your full community experience!

About BPry