About apackard

Not sure if the SSL Decryption Broker feature coming in PanOS 8.1 will allow this.   I'm intrigued to find out myself, especially if there is a simple load balancer feature in it. ... View more

Thanks Sam. ... View more

Cheers - yep we'd assumed it was an Epoch time (the source is EST so also 5 hours behind GMT).   We are unable to access the UserID services generating the raw data - much as I'd like to ask them to change their 7,200 second timeout to something more palatable and stop (their) users being blocked by (our) firewalls.   The interesting aspect is that we pick these up on a Palo, redistribute back to Panorama and from there push out to other firewalls (I said it was convoluted).  As part of that sequence these entries seem to get filtered as if something along the way assumes they're corrupt and discards them - we've actually got it setup so that the 'least important' firewalls get the direct updates and push out to the important ones so we can use this (undocumented!) feature to fix the data. ... View more

Isn't this where you have to append a comma and the selected method to the user password i.e.   Password1,push   to tell it Password1 is your password and you want to use the push option for your second factor? ... View more

We've now been running for 4 days on both nodes at the latest release and no issues, so looks like you've fixed it.   No repeats of the errors in the logs, and re-running the checks (port process lists etc) shows no repeats of the trace evidence we saw before.   I'll leave this thread open as someone else had an issue that he may want to comment on to see if this also fixed it, but I'm happy for you to close as the fix for me.   Many Thanks ... View more

Not that I know of, there may be some discovery tools running on the network I'm not aware of but unlikely.  I'll check the iptables logs on the box to double check.   I wondered that when you asked how many devices would be pulling list data down. ... View more

..tried it just incase and looks good for version.  I'll run over the weekend to soak test, many thanks.   2016-12-02 15:36:30,296 INFO:0.9.7 Package minemeld-engine current version set to 0.9.30 2016-12-02 15:36:30,299 INFO:0.9.7 Package minemeld-webui current version set to 0.9.30 2016-12-02 15:36:30,301 INFO:0.9.7 Package minemeld-prototypes current version set to 0.9.30 ... View more

Excellent.   Using APT we're showing:-   minemeld/stable 0.9.7-8 amd64 [upgradable from: 0.9.7-6] as the latest version, should I use APT or manually install? ... View more

Here you go.   Hopefully this is even better - we have 2 instances of MM running (we're looking to "make" a HA pair).  I have done this for both, the first "MM1" is working, the second "MM2" is currently down,so we can see the difference.   <Added as ZIP as text was too long for a post>.   Rgds     ... View more

Will do.   In terms of the question:-   We currently have an IP block list provided by a 3rd party.  I have some custom PS scripts that I currently run that downloads this, produces DIFF reports, does some mangling and outputs as a file for serving up on an internal web server for our Internet facing firewalls (about a dozen).   I'm looking to replace this with MineMeld so in future it will be supporting at least 10 devices; but until we can work out why it keeps stopping we can't proceed - so right now there isn't actually any client devices etc.   I'm also hoping to use some dynamic behaviouir to get round some limitations in your dynamic blocklist max sizes and block-ip duration.  As we can only serve up ~1,200 IP's (out of the 50k plus in the 3rd party IP list), and as we can only block an IP for 1 hour with THREAT block-ip action, I have a SIEM that triggers a script if it sees any of the the "non-served" IP's attacking us, or if it sees repeated block-ip actions from a common source.    This will poke an offending IP to a smaller 'active' attackers list that we can use for a dynamic blocklist that will have a lifetime of a month (ex.), once that functionality is in place we may serve up to our full estate of PA's, with is over 30. ... View more

Hi - sorry for delay.  While arranging to get the file off I noted that it was flooding with these errors:- Traceback (most recent call last): File "/opt/minemeld/engine/0.9.28/local/lib/python2.7/site-packages/gevent/baseserver.py", line 140, in _do_read File "/opt/minemeld/engine/0.9.28/local/lib/python2.7/site-packages/gevent/server.py", line 93, in do_read error: [Errno 24] Too many open files <StreamServer at 0x7fbffaa0cd90 fileno=5 address=127.0.0.1:5000 handle=<functools.partial object at 0x7fc001c0e8e8>> failed with error   I restarted and they stopped, so may be a good indicator?   Rgds ... View more