About ce1028

ce1028 · ‎09-23-2020

@TravisC The existing device group/template is the one that the PA-200 is currently in. Want to add the PA-220 to that same device group and template. PA-220 currently has no config on it.

ce1028 · ‎09-23-2020

@TravisC Thanks for the response. Understood and this is normal, but for this specific customer, they already have a device group and template. They want the PA-220 to be in the existing template and device. The PA-200 has a mix of panorama and local config on it.

ce1028 · ‎09-23-2020

This would work if I was importing a firewall that was previously locally managed. The device state that I will be importing on the PA-220 will contain both local config and panorama config (from the PA-200)

ce1028 · ‎09-23-2020

Hi, I've done this successfully in the past, but cannot remember the proper order. I have a PA-200 that I want to replace with a PA-220. The PA-220 is in Panorama, its a device group + template. Should I 1) configure the PA-220 with basic ip connectivity to Panorama, add the serial add it to the device group, template, push the config and then import the device state or 2) import device state on the PA-220 and then add the serial to panorama, put the device in the device group/template and then try to push the config? I feel the order is important but can't remember

ce1028 · ‎04-11-2020

@Mick_Ball Edited my post. I was able to get it to work. It was a configuration issue in my lab. I set the computer template to include a subject and worked like a charm.

ce1028 · ‎04-10-2020

@Mick_Ball ah thanks. That would explain it, but also would be useless for me. I'm trying to use computer certs that way regardless of user, the machine would have a cert. Windows won't put a user cert in the computer store on its own, but I will definitely try your suggestion to see. Thanks!

ce1028 · ‎04-10-2020

@Mick_Ball Thanks for the reply. I'm not sure its the type of cert that I'm using, as both templates that I have tried are computer certs. I can try moving the user cert to computer store, but not really going to help me determine what the problem is

ce1028 · ‎04-10-2020

Hi, I'm having a challenge with GlobalProtect when trying to do ldap authentication with a machine cert (from internal MS pki). I've tried both the computer and workstation authentication template, but neither worked. GlobalProtect states certificate is missing. I'm not doing pre-logon, I have GP set to always on. In GP portal app setting, I have the client certificate store check set to machine. Is this not supported or am I missing something else? As a test, i deployed a user certificate from the same MS pki, set GP client store to be user and that works as expected

ce1028 · ‎03-30-2020

@reaper I agree your assessment. I'm all for encrypted dns, but I want all my dns requests coming from my internal dns servers, as you stated. However, I thought dns-over-https uses certificate pinning, which would not allow it to be decrypted?

ce1028 · ‎03-30-2020

@reaper Reason for blocking is corporate policy is to allow dns requests from internal DNS servers only. Also, they both create security risks that could allow tunneling of malicious traffic and also could potentially bypass your security policies Palo Alto also recommends blocking. You don't believe they should be blocked? I'd like to hear your reasons

ce1028 · ‎03-29-2020

Hi, I plan to create security policy rules to block dns-over-https and dns-over-tls. Is it also recommended to block dnscrypt? In regards to dns-over-https. If the browser attempts this and fails, does it fallback to using the client's configured dns servers?

ce1028 · ‎03-23-2020

Yes, I am aware of that much, but if the action is drop/block etc, will it be able to capture any packets?

ce1028 · ‎03-23-2020

@reaper thanks much. One more question, when you're using the action Block IP (or even Deny or one of the reset options), is setting packet capture to single or extended useless? Documentation says it won't capture unless action is alert or allow, yet it suggests setting extended for critical, high medium?

ce1028 · ‎03-23-2020

thanks @reaper , good to know. Yes, definitely about url filtering. I was referring to using a url profile without the custom allows

ce1028 · ‎03-23-2020

@reaper thanks for reply. If that theoretical scenario happened, what action would the firewall take? Would it still block the threat, even if it had no memory to block the IP? The custom URL list is a very good idea, I was thinking of a scenario where you have a web server and Palo url database changes and your site get's categorized as malware or unknown or another category you typically block, you would essentially block your customers from accessing the site

Member Since	‎08-23-2017 02:17 PM
Date Last Visited	‎11-03-2021 09:26 PM
Posts	98
Total Likes Received	5

Online Status	Offline
Date Last Visited	‎11-03-2021 09:26 PM

About ce1028

Re: Shared Security Policy Rules

Shared Security Policy Rules

Decryption Exlusions

Re: Replace firewall order

Re: Replace firewall order

Replace firewall order

Re: HSCI Port

Re: HSCI Port

HSCI Port

Re: Adding zones in Panorama

Re: GlobalProtect with Certificate Profle

Re: Shared Security Policy Rules

Re: HSCI Port

Re: Block Wetransfer Upload

Re: Untrust to Untrust - Allow

Re: Shared Security Policy Rules

Re: HSCI Port

Re: HSCI Port

Re: HSCI Port

Re: HSCI Port

Re: import device state order

Re: import device state order

Re: import device state order

import device state order

Re: GlobalProtect with machine cert

Re: GlobalProtect with machine cert

Re: GlobalProtect with machine cert

GlobalProtect with machine cert

Re: Blocking DNS-over-https

Re: Blocking DNS-over-https

Blocking DNS-over-https

Re: VPP Block IP and URL Filtering

Re: VPP Block IP and URL Filtering

Re: VPP Block IP and URL Filtering

Re: VPP Block IP and URL Filtering

Unlock your full community experience!

About ce1028