About mharding

mharding · ‎03-14-2013

Are you setup with just local accounts or are you also using authentication through RADIUS/Kerberos/LDAP?

mharding · ‎03-14-2013

What version is your Panorama VM running?

mharding · ‎03-14-2013

I would be interested as well. I've never seen it work on our setup. The last time I looked at it, it showed the user authenticated with the Exchange server IP address. Not quite the desired result.

mharding · ‎03-12-2013

Do you not have a link between these two locations?

mharding · ‎03-12-2013

This is the document you want. This will walk you through setting up both HA1 and HA2 as L3 interfaces.

mharding · ‎03-12-2013

There's really not that much difference. I have it setup right now with our passive device across town using a Metro Ethernet link. I have HA1 and HA2 on separate VLANs. You can setup HA2 as a L3 interface, but I haven't had a problem using it in L2 for nearly five years. You just have to watch your timers and STP setup. The attached document should help there.

mharding · ‎03-12-2013

Dev Center generally posts a custom app for March Madness about this time of year. Here's last years...

mharding · ‎03-12-2013

For my sanity, I group the rules by zone. But, that was back when you could sort the rules by zone easily back in PAN-OS 2.0. :smileysilly: I'm starting to use the tags as we've grown to 500+ rules.

mharding · ‎03-12-2013

Have you tried adding the single IP addresses with /32 subnet? So... 10.0.0.1/32 10.0.0.2/32 10.0.0.20/32 10.0.0.21/32 10.0.0.22/32 10.0.0.23/32 10.0.0.24/32 10.0.0.25/32

mharding · ‎03-12-2013

We're going to need some more details about your configuration. Can you screenshot your security policy?

mharding · ‎03-12-2013

You can find the logs under the Monitor > Threat section. Anything blocked should show up in the log files.

mharding · ‎03-12-2013

Those are non-routeable,private addresses. 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

mharding · ‎03-08-2013

I see that error when the management is running high on our PA-2050. Just be persistent.

mharding · ‎03-08-2013

Yes, because when you're decrypting a SSL session to expose the underlying application. To the firewall, it will look like web-browsing over port 443.

mharding · ‎02-20-2013

+1 on the PA-3000 series if you are doing a lot of QoS and SSL Decryption. If memory recalls, the PA-2000 series does QoS and SSL decryption in software whereas the PA-3000 and PA-5000 handle this in hardware.

mharding · ‎02-20-2013

I've never worked with OpenDirectory before, but maybe the information in this post will help you out.

mharding · ‎02-20-2013

I would be interested in the auditing part.

mharding · ‎02-20-2013

From the release notes of 5.0.x: In order to upgrade to PAN-OS 5.0.0, the device must be running PAN-OS 4.1 or later. Attempts to upgrade to PAN-OS 5.0.0 from earlier releases will be blocked. 4.0.11 to 5.0.x is a mighty big jump.I would recommend upgrading the 4.1.x first, work out any bugs in your config/setup, and then go to 5.0.x.

mharding · ‎02-20-2013

The short answer is the management process is running high, and is consuming all of the memory/CPU on the management side. The command debug software restart management-server will solve the problem temporarily. It will take 10-15 minutes before you can log back into the firewall to make the commit. PAN Support will need your tech-support files to see why it is running so high.

mharding · ‎02-13-2013

DNS and mDNS shouldn't be confused. mDNS is a broadcast on that VLAN to specific UDP ports. The broadcast advertises what the client can do; like Screen Sharing or AirPlay. What you're looking for is a Bonjour Gateway. If you have all your VLANs running through the Palo Alto, you could try creating a multicast rule between the VLANs/Zones with these UDP ports being allowed: 554,54780,62572,5353,5298,5297

mharding · ‎02-12-2013

Do you have a WPA/WPA2 password on your guest network?

mharding · ‎01-18-2013

These Cacti templates should get you up and going. You can download a Cacti VM appliance at: CactiEZ - Home

mharding · ‎01-14-2013

Correct, but make sure your allow rule is above your blocked rule. So it would kind of look like: Allowed Java Traffic over HTTP/HTTPS Blocked Java Traffic over HTTP/HTTPS And if you aren't using SSL Decryption, the file blocking might not work on the HTTPS traffic.

mharding · ‎01-14-2013

It would be two rules. One rule to allow Java on the Allow_Java category and then a second rule to block the JAR files from everywhere else (but you might still have that ZIP file problem). After reading about the attack (Malware Intelligence Lab from FireEye - Research & Analysis of Zero-Day & Advanced Targeted Threats:Zero-Day Season is Not Over Yet) you might want to look at the Drive-By Download feature. And make sure you're updated to Content Release 349. Message was edited by: Matthew Harding

mharding · ‎01-14-2013

You can do that with the custom URL categories and data/file blocking profiles. The only problem is the Java spec is written so that JAR files may look like ZIP files.

mharding · ‎01-12-2013

I believe you would have to bypass the built in captive portal page to do this. (Or maybe not. Depending how you want to do it.) You could setup a web server inside that zone that would handle the user authentication using the UserID-API and PHP. The user would just have to remember the web server DNS name/IP address to get back to the log off link. Just make sure your security policy has the source user set to either the specific user/group or known user. The short answer is it's possible.

mharding · ‎01-12-2013

WildFire won't test the JAR file, but it should test the dropper EXE that the JAR file attempts to download.

mharding · ‎12-28-2012

Are the Macs joined to Active Directory?

mharding · ‎11-15-2012

They do. Let's look at this another way. Windows 8 came out in October. I bet very few businesses have installed Windows 8 on 100% of their production desktops. If WIndows 8 has bugs, is it Microsoft's fault for releasing a buggy OS? No. You can't test for every scenario, and PAN-OS is always improving with new features. If PAN-OS was perfect the first time, we'd all be running PAN-OS 2.1 still.

mharding · ‎11-01-2012

The management interface is out of bound compared to the rest of the interfaces on the Palo Alto. It's bad form to connect the management interface to a Public/WAN link. It's best practice to only allow only certain IP addresses to the management interface. You can also use CIDR format to help protect it. You can move management functions to one of the other interfaces under Network > Interface Management. You can add SSH or HTTPS and then assign it to an interface. Then you can apply the IPS/IDS functions to that interface (assuming you use SSH/SSL decryption).

Date Registered	‎07-30-2009 01:30 PM
Date Last Visited	‎09-27-2019 04:33 PM
Total Messages Posted	286
Total Likes Received	70

Online Status	Offline
Date Last Visited	‎09-27-2019 04:33 PM

Strata

Prisma

Cortex

About mharding