About Brandon_Wertz

thanks to all of you. Im actually in the process of setting up SSL decryption right now. I have a rule set up on my computer to decrypt all the outbound traffic. Once that is set up, it'll give me better info on what the SSL traffic really is. ... View more

which syslog filter did you use for meraki? did you create a custom one or use one of the ciscos? ... View more

Sorry I guess I shoulda been clearer.  I realize it's not about the VPN per se, but it is because we're looking at not allowing split-tunneling.  So GP VPN users with a normal user count of 800-1200 with a high water mark of 2500 or so would have all their traffic coming down the tunnel.   This was my thoughts...   Today home users have 10Mbps to 1Gpbs home network connections.  I'm trying to understand the potential scope of impact if I turn split-tunneling off.  (Essentially what experience you guys have had.)  Is this a problem which really isn't a problem?   Today secured routes are only my corporate IP space all other traffic goes through a cloud service.  If I flip that migrate to GP VPN and turn split-tunneling off what general amount of BW do I need to account for?  If I'm at home and download a 3GB OVA that traffic now comes over VPN.  Add in users watching FB video or YouTube or really any other of today's web activities should I be concerned about that additional VPN load?     ... View more

I don't want to speak for Palo Alto, so I'm not going to disclose much.  Hopefully there'll be something released as an official statement.   Essentially the domain I posted was coming into PAN-DB as phisihing.  That categorization was corrected and placed back into CDN. ... View more

@rrealica, everyone,   Thanks for your questions. I work for Palo Alto Networks and wanted to share the following:   The 2017 NSS Labs Next-Generation Firewall Test Report results reflect 6 missed evasions out of more than 1,000 attacks. As soon as we were informed of the misses, our engineering team collaborated with NSS to detect and block the missed evasions. Within two weeks, we released Content Update 699 which blocked all evasions tested by NSS. NSS Labs has tested this Content Update. Please feel free to read our full report from NSS to verify this, or get in touch with your Palo Alto Networks systems engineer, who can share more documentation. We recommend that you use Content Update 699 or later on your Palo Alto Networks Next-Generation Firewall.   @rrealica, I see that you are about to start your evaluation process. As I’m sure you realize, the best way to determine the full impact of a security product is to evaluate the product in your own network where your corner cases are included in the assessment. This is the best way to understand the prevention capabilities and performance using applications and traffic mixes that are actually seen in your environment, as well as understand the true costs and savings, both capital and operational.   Please let your Palo Alto Networks systems engineer know if we can help you in any way. ... View more

@BPry well, seemed to be so. Probably I did something wrong while I was searching:) p.s. good to know that it is there, so I will not waste time by installing it, i just had doubts.  ... View more

Thank you so much for your patience 😊You're right I'll start with an endpoint/trap hopefully that keeps the intruders out! Thank you!!! ... View more

AWS, O365, Azure are all low hanging fruits because they publish their ranges and URLs in machine readable format. We could build a miner to parse HTML and PDF files to extract the ranges, the problem is when the vendor decides to change the format of the HTML page or of the PDF file. More vendor should start publishing their ranges to make security admins life easier 🙂 ... View more

I concur with SuryaR´s suggestion to differentiate between normal and emergency updates. With long threshold times like 48h it can happen that the device is waiting and waiting for the threshold to be reached.   Normal content update released => do not install until 48h old Within 48h, emergency content update released => do not install until 48h old etc.   Rolling out content updates manually thwarts the ability to prevent known attacks automatically. ... View more

Looks like this might be a function of SSL Interception and not having it enabled, perhaps?  It looks like you aren't getting details for things which are over HTTPS. ... View more

Thank you, that worked.  Don't know why I was expecting it to work without changing the client's DNS settings... 🙂  I'm checking if boss is happy with safe search for all, before touching our DNS servers. ... View more

Thanks for the feedback folks.  I probably did not explain my questions very well and made it confusing (for me).   I will digest all this info and close this thread.   Thanks again! ... View more

Your other option is to hop on a switch or router in the same subnet as the mgmt ip address and do the ssh from this device.   Then the communication is all over the local vlan and the missing default route will not matter. ... View more

The newly released platforms 800 and 5200 series platforms only support the 8.X train of PAN-OS ... View more

Hi   solved my problem. Seems like even though the ip is shared between active active nodes. the actual ip isn't for routing. I believe what tech support advised was they don't want both nodes replying to pings.   This caused a problem with OSPF, it was registering with one node and not the other and the other node would add the route but by a different interface. once it was registered on a different interface it stopped repling to arp's !   So now I have a OSPF exclude for all VIP addresses, that was interesting... Makes me thing should the VIP addresses be /32 or /24 (the same as the network, I am used to using /32 aka vrrp... )   I think i have enough capacity between DC. and I will be using the 10G (LACP connects).   I will probably go back to failover once I have completed my test as currently teh DGW for each network is not really needed between DC's.   A ... View more