About OMatlock

OMatlock · ‎08-28-2018

Hello folks, Curious if others have been getting a ton of alerts for this threat like we have? Anyone have a goto website for reading up about latest threats or researching certain CVE?

OMatlock · ‎08-27-2018

Thank you BPry. Yea, after talking to PA support, should break that rule out if wanting it to match differently. You are right, unrelated to our Veeam issue. We believe the issue could be that ping traffic works because it replies back through the Nexus directly to Veeam server. But when using TCP (connection based), it needs to come back through the PA interface and routed back properly. We are working on the best method for that. Will update. Updated diagram showing successful ping. This only fails with this particular subnet. Believe its because they share the same physical PA interface. Other subnets that don't work fine.

OMatlock · ‎08-27-2018

Thank you BPry! I did include a pic of the security rule that is being called out for this traffic. Here it is again. I've seen rules created with both zones included (instead creating two rules). Wondering if that is causing a conflict and need to break this rule up into two? I don't know why the rule is being triggered in the first place, which what I am trying to understand, if expected, or a problem, or related to this problem...

OMatlock · ‎08-27-2018

Hello folks, We have recently installed Cisco Nexus switches and UCS system. All of our routing has been through our PA firewall and continues to be, except for a new Management network created on the Nexus switch. We are trying to use this management network for our vsphere hosts, etc. We added a static route on PA to route requests to the Nexus to resolve. The problem is that Veeam server is unable to backup VMs from the new Hosts. As we troubleshoot, I noticed the traffic between the Veeam server and host is being identified by a Security Rule that is not related. Wondering if that could be interferring? I wondering why identified this way and does incomplete mean it fails? Port 902 is Veeam related traffic... I wondering if the unrelated security rule is identifying because of the nature of its creation, including both zones on source and destination? I was thinking may not hit a security rule at all, since traffic should not traverse out of L3_Trust? Config:

OMatlock · ‎06-27-2018

Thank you for the feedback! Good advice about allow all and see the applications used in the traffic. After that could narrow the rule to ftp and ssl (and or if other). Will update.

OMatlock · ‎06-27-2018

You were right. I did not think to go add the VPN zone to the security rule to Untrust and Dynamic IP and Port NAT rule. Resolved. Thanks again!

OMatlock · ‎06-27-2018

Yea, I think your are right, thank you. We do not have a security rule in place from VPN zone to Untrust zone. I assume because it was not necessary. I just tried it, but still not working. I believe I need to add all the IPs in there, since I am now getting a page not found error (instead of time out). Traffic to the Okta public IP is not even registering the traffic log at the moment, have not packet captured yet. Not sure if the internal DNS zone I created for <name>.okta.com is needed or not, will try to find out. Still testing, will update.

OMatlock · ‎06-27-2018

Hi folks, We are using a PA 3020 PANOS 7.1.14. We have entered all public IP addresses for Okta in our Global Protect Gateway Client Access route settings. Our intention is for Okta to only see client IP requests come from our one corporate public IP (instead of the client's ISP). We want split tunnelling except for when accessing <name>.okta.com. We have our internal DNS server IP added for the GlobalProtect clients to use (forwarding configured to public DNS). However, when connected to GlobalProtect <name>.okta.com will not resolve, "this site can't be reached", times out. I've confirmed with a ping -a that the public IP it resolves to is in the list for access routes. I've also tried adding adding an internal DNS zone for <name>.okta.com, but has not helped. Wondering if anyone has any tips?

OMatlock · ‎06-27-2018

No response so far. I will close this thread by the end of the week.

OMatlock · ‎06-22-2018

Hello Folks, We have a CrushFTP server installed on a server behind our PA 3020 PANOS: 7.1.14, SSL decrypt not enabled. Security Rule: NAT Rule: Trying to figure out why Active and Passive with FTP over TLS (SSL) will not retrieve the directory listing and will not complete connection. Works fine with just FTP (insecure). Do I need to add SSL to the security rule? Filezilla client set to Active - FTP Only (Insecure) - Why do I not see the data transfer port 20 when I upload a file? Filezilla Client set to Active - FTP over TLS Filezilla client set to Passive - FTP Only (Insecure) Filezilla client set to Passive - FTP over TLS (SSL) - Does this mean that FTPS is detected as SSL and discarded because not added to the security rule? For reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Allow-FTPS-FTPES-Traffic-Through-the-Firewall/ta-p/55425 https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-an-Application-Override-for-FTP/ta-p/58420

OMatlock · ‎04-20-2018

Hey folks, This is a follow up question from one of my other posts. We are using PAN-OS 7.1.15 and GP client 4.1. https://live.paloaltonetworks.com/t5/General-Topics/GlobalProtect-and-general-Internet-access/td-p/207888 We are moving to Okta as our IDP for our applications. When logging into Okta it recognizes your client public IP and we have policy based on that. When we connect to Global Protect first and then log into Okta the traffic goes outside of our VPN tunnel (because we have internal network entries in the access routes - split tunneling). I believe I understand that. We need all Okta.com traffic to traverse through our VPN tunnel and use our specific static public IP (when connected to VPN). It appears to me that this function is only available after upgrade to 8.1? https://www.paloaltonetworks.com/documentation/41/globalprotect/globalprotect-app-new-features/new-features-released-in-gp-agent-4_1/split-tunnel-for-public-applications Could anyone agree or confirm?

OMatlock · ‎04-03-2018

@BPry Thank you. This is a standalone firewall. I see path monitoring in the HA section. Is that what I use? I do not see any options to configure alerts. Is that somewhere else? Looking for the documentation about it. If you have any more feedback, appreciate it.

OMatlock · ‎04-03-2018

Hi folks, We have a PA-200 over in London (on the recall list) that get complaints that the internet has intermittent connectivity issues. Everytime I login to it, the interface (1/1) is up, green, and no indication of a problem. Other than contacting the service provider about outage status, does anyone have method(s) on the firewall to determine if the internet connection experiences intermittent connectivity problems?

OMatlock · ‎03-29-2018

Thanks @fjwcash I think I just proved Split tunnel is functional in my test because I disabled my security rule that allows access from VPN zone to Untrust and general internet still works on remote client. Feeling better about this now. 🙂

OMatlock · ‎03-29-2018

Thank you all for your feedback and your patience. 🙂

Member Since	‎02-13-2017 12:47 PM
Date Last Visited	‎06-26-2019 07:20 AM
Posts	182
Total Likes Received	24

Online Status	Offline
Date Last Visited	‎06-26-2019 07:20 AM

About OMatlock

Threat log forwarding from unlicensed PA device?

Re: Palo Alto firewall vs Web Proxy

Re: Palo Alto firewall vs Web Proxy

Palo Alto firewall vs Web Proxy

Re: Interface Management profile with public IPs?

Interface Management profile with public IPs?

Re: Maintenance Page redirection via Palo Alto?

Re: NAT rule best practice for a mail server?

Re: NAT rule best practice for a mail server?

Re: NAT rule best practice for a mail server?

Moving Colo Datacenter

IPSec VPN Tunnel - Tunnel interface IP address use?

Enable FTP and FTPS for Active/Passive?

Re: Enable FTP and FTPS for Active/Passive?

AWS IPSec Tunnel success?

Re: Palo Alto firewall vs Web Proxy

Re: AWS IPSec Tunnel success?

Re: Moving Colo Datacenter

Re: Global Protect include a specific URL?

Re: Activate a new GlobalProtect Client?

Mirai and Reaper Exploitation

Re: Traffic using unintended Security Rule?

Re: Traffic using unintended Security Rule?

Traffic using unintended Security Rule?

Re: Enable FTP and FTPS for Active/Passive?

Re: GlobalProtect Access Route for a public website?

Re: GlobalProtect Access Route for a public website?

GlobalProtect Access Route for a public website?

Re: Enable FTP and FTPS for Active/Passive?

Enable FTP and FTPS for Active/Passive?

Global Protect include a specific URL?

Re: General Interface status?

General Interface status?

Re: GlobalProtect and general Internet access?

Re: GlobalProtect and general Internet access?

Unlock your full community experience!

About OMatlock