About Indorama_Ventures

Dear Palo Alto experts...,   We have various systems in our LAN seperated by our Palo Alto firewall.   In the last 24 hours the firewall detected 2.7K times the virus  "Virus/Win32.WGeneric.rktkq"   The systems are scanned for inventory by two programs. Spiceworks and PDQ inventory. The scan server is on one side of the firewall. The other servers are on the other side of the firewall. The "Spiceworks" server has been scanned by our Kasperksy AntiVirus solution. No detections here.   What could be causing this? And if it is a false positive, what would the next path forward to solve this problem?   Any thoughts you might have are very welcome.   Remko       ... View more

This week I noticed a "CoinHive Javascript Detection" in the logs of our Palo Alto. When reading on the subject I noticed that there are websites around that use Javascript to start mining Crypto coins on the users' computer.   https://live.paloaltonetworks.com/t5/Community-Blog/Unauthorized-Coin-Mining-in-the-Browser/ba-p/183457   Detailed description can be found here : https://researchcenter.paloaltonetworks.com/2017/10/unit42-unauthorized-coin-mining-browser/   I noticed in the Palo Alto blog that : PANDB is able to block URLs hosting Coinhive JavaScript.   My question: How does one actually block this? When I visit for example https://coinhive.com/ and push the button "Start Mining" the CPU goes up to 100%. ... View more

Hi, I am currently investigating the possibily to add an extra layer of protection on our GlobalProtect Clients. Currently LDAP authentication is used but I want to add an extra layer on top of this by using a certificate handed out to each  user. As we do not have that many clients I figured I might as well have the PaloAlto Firewall hand these out. I would like to have a intermediate solution where I can test this first. Do I need to set-up an extra gateway to accomplish this? If I would enable a Certificate Profile on the current gateway then all my users will be blocked as they do not have a certificate yet. I noticed that I cannot have two gateways on the same IP adress. What would be the best approach for this?   Remko ... View more

Hi guys,   We wittnessed a very strange phenomenon this morning. First we received a call that our VPN gateway was not accepting any VPN connections. At the same time we received calls that certain websites were not accessible. These websites had in common that they were SSL encrypted.   We have 2 PA-500 firewalls with a HA configuration. SSL decryption is enabled for certain networks (workstations). SSL decryption uses a different certificate than our VPN gateway. Both certificates are valid.   As soon as we turned off SSL decryption, the VPN gateway started to accept connections. When we turned SSL decryption back on we noticed that some websites were decrypted while others were not. The sites that were not decrypted should have been decrypted. They were not in the "Do-not-Decrypt" list. To be certain the firewall was doing the job right,  I deleted the certificate cache on my browser. I also visited sites that were SSL encrypted which I had not visited before.   We are a bit puzzled what happened here. Currently we have SSL decryption turned off but would like to have it on again.   The PA-500 is a few software versions behind. Currently on version 7.1.2 I have tried to find anything related in the release notes of the newer versions that might indicate a problem with our current version. I was not able to find this.   Any ideas what might be going on?   Remko ... View more