About Nikolay-Matveev

Nikolay-Matveev · ‎10-30-2020

Yes, please - post the outcome here. vwire deployments are always a good fun

Nikolay-Matveev · ‎10-25-2020

So, if your original [internet switches (VSS pair)] <> [Cisco ASR] link is LACP, then when you introduce a Palo firewall you do not have to build AE-based v-wire. Just create several "single-legged" v-wires. In such configuration Palo will pass-through LACP control frames and thus the new firewall will be completeley transparent to the internet switches and the ASR, and thus you won't have to change anything on them. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHTCA0 You also need to make sure you specify tags of all VLANs that you want to allow on that link. By default you have only 0 that means only untagged traffic (all tagged frames will be dropped).

Nikolay-Matveev · ‎10-21-2020

It might be a viable idea with DNS... You can even bypass the DNS altogether and produce different blockpages on the webserver itself (diffirentiating users by the source IP) or use a load balancer/ADC for the same very purpose - to direct users to relevant page based on their IP address (= Zone)...

Nikolay-Matveev · ‎10-21-2020

Answering my own question for the record... It appeared to be easy to upload a certificate directly to the firewall - it's just a matter of constructing a correctly formatted MIME message. It must be a POST request with Content-type header set to multipart/form-data; boundary=<random tag>, followed by Content-length set to the length of the form data. Form data has to be constructed along these lines (Python): form = '--'+<the_boundary_tag>+'\r\n'+'Content-Disposition: form-data; name="file"; filename="certificate.cer"\r\n'+'Content-Type: application/octet-stream\r\n\r\n' form = form+cert_body+'\r\n' form = form+'--'+<the_boundary_tag>+'--\r\n' cert_body here is a plain string with Base64/PEM-encoded certificate. Form data has also be encoded as UTF-8 before referencing from the actual request object. For example like this: form_binary = form.encode('utf-8') req = Request(url, form_binary) URL in its turn may be constructed like 'https://'+fwAddress+'/api/?type=import&category=certificate&certificate-name='+quote(cert_name,safe='<>[]=')+'&format=pem&key='+key I hope this help and saves somebody's time from reverse engineering Curl requests...(which is what I had to do to overcome the scarce API docs on this topic :))

Nikolay-Matveev · ‎10-21-2020

Gareth, What you can do is create separate block rules based on source zones and then in the response page create a basic client-side JavaScript that would be adjusting parts of the response page depending on the name of the block rule that was hit. There is a valiable called <rulename/> - use it in the JavaScript. Unfortunately this is going to work well only for blocks invoked via Deny action set as the rule action. If you block based on a URL-profile then things become more complicated and for that you may need to resort to creating multiple VSYSes...

Nikolay-Matveev · ‎10-14-2020

@Spongerius @RandallLoux Did you succeed with this eventually? I need to do the same but struggle with uploading a cert even directly to the firewall. Can you share a snippet of code? API documentation is exteremely scarce in this regard...

Nikolay-Matveev · ‎10-02-2020

Spoke to TAC (the engineer said he had been unable to reproduce), reproduced the issue for him, then we removed spaces from cert name and subject - the issue was gone, re-added the spaces - the issue did NOT re-occur. There must have been something else, very subtle, that trigerred the error. We'll keep playing with this and update this thread if manage to discover anything...

Nikolay-Matveev · ‎10-01-2020

I am trying to export a CSR via XML API as per this article and as per /debug output that I get when I perform the export via Web UI. The request I run is as follows: https://<fw-address>/api/?type=export&category=certificate&certificate-name=<cert-name>&format=pkcs10&include-key=no&key=<api_key> However this does not quite work - I get an error message that says: Failed to prepare CSR <cert-name> for export. PKCS10 format can only be used with CSRs and not certificates. I have now run out of ideas what it does not like in the request. The article explicitely says - "You can use the example above to export a certificate signing request (CSR). If you do so, then specify the following two parameters as shown: format - pkcs10, include-key - no" and this is exactly what I am doing. The debug out for a succefull operation suggests the same syntax: <request cmd="op" cookie="1001040547321532"> <operations xml="yes"> <download> <certificate> <certificate-name>cert-name</certificate-name> <format>pkcs10</format> <include-####censored 'key''#### [2020/10/01 23:06:58] user=1001040547321532 Response took 0.040s <response status="success"><result><content encoding="base64"> <---encoded csr goes here--> ]]></content></result></response> Has anybody has an idea about the correct format of the request?

Nikolay-Matveev · ‎09-14-2020

(it should be off, otherwise, logically, the firewalls should be querying the agents for UserID info on public IPs too, which would produce WMI queries if the relevant option is enabled...)

Nikolay-Matveev · ‎09-14-2020

Good point about WMI probing... Perhaps I am too used to have it switched off in my environment 🙂 Do you have UserID switched off for the Internet zone on the firewalls?

Nikolay-Matveev · ‎09-14-2020

KB article about what exactly? About raising a case? Just call the TAC or do it online on the support portal. Quote the application name and give your reasoning as to why a characteristic should be changed.

Nikolay-Matveev · ‎09-11-2020

Yes, you can do this but only via CLI or API, there is no UI option. In the CLI the command would be show predefined application <application name> However the best way to do this would be to put together a quick Python script and pull this via the REST API. I actually needed to do the same and may find some time over the next few days to have this data exported into a pretty XLS...

Nikolay-Matveev · ‎09-11-2020

No, you cannot. Though you can raise it with TAC and they will have a characteristic (SaaS or whatever else) assigned to an application if they believe this should be the case...

Nikolay-Matveev · ‎09-11-2020

Start with disabling NetBIOS in TCP/IP parameters on the UID agents (Control Panel > Network Connections > your connection > Properties > TCP/IPv4 > Advanced > WINS > Disable NetBIOS over TCP/IP). Unless you do use it in your network of course... (but I cannot think of a good reason to do so these days to be honest).

Nikolay-Matveev · ‎09-11-2020

We have ended up with an EDL where we place the URLs that produce the likes of Chrome's ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY error. This EDL in its turn is used in a decryption rule with "Strip ALPN" option ticked in the decryption profile, and that rule is placed above our default decryption rule. Thus we still decrypt all these sites but downgrade them to HTTP1.1 - is not a big deal. We have ~13K web users and so far discovered only a handful of misbehaving websites... running 9.0.x. Hope this helps.

Member Since	‎11-22-2016 04:15 AM
Date Last Visited	‎12-11-2020 04:06 AM
Posts	19
Total Likes Received	6

Online Status	Offline
Date Last Visited	‎12-11-2020 04:06 AM

About Nikolay-Matveev

Re: Degraded services after introducing Vwire + link aggregation deployment

Re: Degraded services after introducing Vwire + link aggregation deployment

Re: Response Pages based on Zone.

Re: How to upload a certificate into a Panorama template using XML API?

Re: Response Pages based on Zone.

Re: How to upload a certificate into a Panorama template using XML API?

Re: CSR export via XML API

CSR export via XML API

Re: UserID agent sessions to public IPs

Re: UserID agent sessions to public IPs

Re: Degraded services after introducing Vwire + link aggregation deployment

Re: Response Pages based on Zone.

Re: SSL Decryption: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY

Re: VMs cannot ping gateway / subinterface on Palo firewall

Autofocus MineMeld - how to access output node that requires authorisation

Re: Response Pages based on Zone.

How to upload a certificate into a Panorama template using XML API?

Re: Virtural router how many do have and when to have multiple

Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Stack

Re: Degraded services after introducing Vwire + link aggregation deployment

Re: Degraded services after introducing Vwire + link aggregation deployment

Re: Response Pages based on Zone.

Re: How to upload a certificate into a Panorama template using XML API?

Re: Response Pages based on Zone.

Re: How to upload a certificate into a Panorama template using XML API?

Re: CSR export via XML API

CSR export via XML API

Re: UserID agent sessions to public IPs

Re: UserID agent sessions to public IPs

Re: can we convert non saas application into saas application.

Re: Problem with exporting APP-ID list with all filter options

Re: can we convert non saas application into saas application.

Re: UserID agent sessions to public IPs

Re: SSL Decryption: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY

Unlock your full community experience!

About Nikolay-Matveev