About Brandon_Wertz

@FWPalolearner wrote: Hello ,   We have currently three diffent zones defined .   Zone A vlan 100. For wired users  Zone B vlan 200 for wireless users  Zone V tunnel/ loopback interface for Global protect users.   All the above users mentioned are corp users.   Now customer wants to create. single zone called "All users" and want to put vlan 100 200 and loopback/ tunnel into it.   Is it wise to use same zone for GP users ?   Is it doable ? What are the challenges of we have a single common zone for user traffic ( wired+wireless+gp users )                     In general a good security practice would be to keep remote / VPN users in a separate security zone.  There would be some mitigating factors for not doing so like an "always-on" VPN, but still to ensure the most visibility it would be better to keep VPN users in a separate zone.   It's very doable to have all in the same zone.  You just need to weigh the various components of the reasons for keeping them separate.  Functionally what's the benefit to have wired and wireless users that are internal in a separate zone?  Are they a different user or business function?  Personally I don't see the need to break out "on-prem" users into different zone, but there might be a logical reason to do so.   For a VPN user there's more of a logical reason to keep those users/devices in a separate zone even if it's still a corporate owned device. ... View more

@dtran wrote: I heard that even PAN got hacked as well because it is using Solarwinds in its environment. Well considering "...including more than 425 of the companies listed on the Fortune 500 as well as the top 10 telecom operators in the United States." it wouldn't surprise me if Palo Alto might have been running the affected software.  Further just because a company might have been running Orion doesn't mean they had deployed the vulnerable software versions.   That listing of 425 companies was more likely just a listing of "customers" and not necessarily customers running affected software versions. ... View more

What are the Traffic logs in the firewall reporting?   @Han.Valk wrote: I have an FTPS server behind the PA. When I enable either AntiVirus, AntiSpyware or vulnerability protection with default profiles it is impossible to connect to the FTP server over TLS. The below errors are seen. When I disable these protections I'm able to connect.   Regards, Han.   Command: PASV Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,194,31). Command: LIST Response: 150 Opening BINARY mode data connection. Error: GnuTLS error -15: An unexpected TLS packet was received. Error: The data connection could not be established: ECONNABORTED - Connection aborted Response: 226-Directory has 53,565,587,456 bytes of disk space available. Response: 226 Transfer complete. Error: Failed to retrieve directory listing Error: GnuTLS error -110 in gnutls_record_recv: The TLS connection was non-properly terminated. Status: Server did not properly shut down TLS connection Error: Could not read from socket: ECONNABORTED - Connection aborted   ... View more

I'm surprised more of these attacks haven't occurred or at least been detected.  Last year I went to an ICS security conference in Atlanta and sat through a briefing on this very topic.  A company Adolus had been working with the DHS under a SVIP project to develop protections in the ICS / IoT space against supply chain attacks.  It basically involves embedding some sort of visibility within a vendor directly monitoring suppliers directly within their core private networks.  Under this project there's an attempt to create a trust within the larger global supply chain ecosystem.     The brief really got me excited and hopeful that something like this could be used to prevent such attacks, but it only works if you have vendor involvement, or if the government mandates it.  There have been other successful supply chain attacks in the past (Rockwell / Dragonfly) nothing as large as Solarwinds, but there's still an obvious need to better protect our supply chain. ... View more

Just wanted to stop by and say thanks to @OtakarKlier for your involvement and being a part of the community. ... View more

Thanks all for the feedback.  Just hope to provide assistance or insight where I can. ... View more

@simsim wrote: Hi,  cisco  campus lan design ( access distribution  core ) In data center  we are using  cisco vpc (spine and leaf )  Now I want to  place an (acive standby  fw ) in data center .  I place the Please guide me to do so , Where should I Place the firewall Thanks   Given you mentioned "spine and leaf" I'm going to assume you've got an ACI deployment.  Like @S.Cantwell  mentioned the FW needs to be inline.  The natural spot would possibly be plugged into your core routing device which would be connected to your ACI fabric, but ultimately where it would get plugged in will vary based on your specific network design and needs. ... View more

To me #CXDAY2020 is about acknowledging to truly have a great product you have to also focus on on your customer's use and how they interact with your product.  Especially in a product a critical as a network firewall, if the focus is on the customer; from how the UI is laid out to interact with the device to how support is offered.  I think Palo does a great job at trying to address the user experience at all levels.   Having a robust collaborative community is a great way to add to the tool sets that us customers have in the various products ... View more

@simsim wrote: Hi @Brandon_Wertz  Currently I am using the simple solution as you shown in the screen shot .That is permitted ip .  I am trying to learn something new  .  I can just creat  a vlan in dc  .  But my worry is if someone put a deny policy and he can  deny management network also ? Thanks   Under normal circumstances you really can't create security policy which will block access to the management interface and prevent access. ... View more

@dtran wrote: I have premium level support.  Waiting on the phone for that long is not a good thing, regardless of Covid-19.   My situation is unique and I couldn't find a solution in the forum.  I wasn't trying to suggest an elongated wait time is ever appropriate, I was just trying to offer an outside perspective of why that situation could occur.   I've been told that Palo's had huge growth and I think they're trying best they can to staff appropriately.  That said I've had situations where I've also ran into a wait time that was longer than I would have expected. ... View more

I think there are multiple things going on which would be leading to a longer hold time.  First is probably COVID, I really don't know of a single company that hasn't seen an impact, and I would guess Palo has gotten even busier during the pandemic.   I'm also not sure of your support agreement level, but it's possible for your support level all other engineers were tied up with higher priority cases.   One thing you could also try in the interim is look through the LiveCommunity here and see if potentially there's a solve that you could find without needing a support case. ... View more

@simsim wrote: hI @BPry   @SutareMayur  Thanks for the reply . I can a create a separate vlan .  when you say an isolated vlan  what about the  inter vlan routing .  It would be great if you give a  diagram  Thanks Routing between routers is accomplished via routing protocols which you run in your network, either OSPF, BGP, EIGRP or something else.  Networks (VLANs) owned by the respective routers are shared via those routing protocols.   You have have a single router, for your DC, which controls the routing for all your networks (VLANs) including the management network or you can chose to break that apart.  Given what you've shared thus far, it seems a simpler solution might be easier for you to manage and implement.  That said as @BPry suggested the simplest and best way for you to apply security to your FW management is to apply "allowed IPs" that are allowed to communicate with the management interface (Seen in the right hand of the screenshot.)   ... View more

@AndrewPaloAlto wrote: So I need to update my PanOS on my PA-3020, but because I have a mission-critical network I need to avoid downtime as much as possible.  In the walk-through for the PanOS upgrade, it says 'any change a content releases introduces that affects App-ID could cause downtime.'   I was not fully clear on what an App-ID is, and why it might change from an update.  If I have a few rules in place regarding allowing some configured alerts, are those configured alerts considered App-IDs?       Can someone please shed some light on this for me?   I'm going from PanOS 9, to 10.     I think what you're referring to is what might happen if Palo Alto adds to or changes how an "application" is identified by the firewall.  Palo Alto uses multiple identifying characteristics of network traffic to create an "application" definition.   For instance on 7-23-2020, Palo Alto released application updates which changed how some applications are identified.  Before this release traffic would have been seen simply as "cip-ethernet-ip-base" after this update the same traffic which the firewall saw could further be identified by the following applications:   cip-ethernet-ip-disable-io (functional) cip-ethernet-ip-disable-sfc (functional) cip-ethernet-ip-enable-io (functional) cip-ethernet-ip-enable-sfc (functional) cip-ethernet-ip-read-mod-write (functional) cip-ethernet-ip-read-tag (functional) cip-ethernet-ip-read-tag-frag (functional) cip-ethernet-ip-run (functional) cip-ethernet-ip-stop (functional) cip-ethernet-ip-test-mode (functional) cip-ethernet-ip-write-tag (functional) cip-ethernet-ip-write-tag-frag (functional)   So if you wrote a rule that ONLY allow the previous application of cip-ethernet-ip-base, after the application update download to your firewall it's entirely possible these new applications wouldn't have been allowed since they weren't previously allowed in your security policy. ... View more

@MP18 NP...Yeah I learned that lesson the hard way about 10 years ago when I first deployed Palos...Flash, RTP...all that stuff will render a page useless if you're not careful haha ... View more