About jesuscano

Hi,   One of our servers have been infected by any kind of ransomware. We can see several files encripted. So we are seeing any evidence about the infection in the PA. The only trace that we saw in PA is that the infected server sends many dns sessions to strange domains:   S is there any way to prevent these external dns sessions? are these sessions related with ransomware virus? I tried to find the ID in spyware profile in order to chenge the action from alert (current) to drop) but i cant not find it.   any advice to know what it happened and solved it in future?     ... View more

HI,   We are trying to go up a VPN using Global protect client in fedora device. We have read that global protect 4.x requires that the certificate be signed by a trusted CA. Our certificate is self-signed. So we have GP client version 3.1.x because we whitnk its not neccessary a certificate signed by CA.   Is this true? whats are the requisites for using GP client in linux?   thanks ... View more

Hi,   I would like to know if PAs support 802.1ad (QinQ? any info about this? ... View more

HI,    We are having attacks from outside to DMZ. Many diffrents ips are attacking our public range. These attacks are causing packet buffer 100% and CPU 100%, doing an outage in our network. So in traffic logs we can see all sesiones being denied for policy deny. Is there any way to avoid that FW proccess these sessions and not increasing CPU?? what actions can be taken in FW?   thanks ... View more

Hi,   We just received info about this vulneraability: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md So we would like to know if PA appliances are impacted?   Thanks ... View more

Hi,   We are trying to connect to our VPN using Global Protect client in a Fedora laptop. We have tested the following articles: https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-user-guide/globalprotect-app-for-linux.html# but we are getting a certificate error: pcdavid - david - / home / david · Globalprotect connect --gateway 191.xx.xx.2xx -u David Connecting ... Connecting ... Failed to connect to 191.xx.xx.2xx Error: Gateway 191.xx.xx.2xx: The server certificate is invalid. Please contact your IT administrator. We have tried to import the certificate and it seems that it has done it correctly. We have also tested it with different certificate formats (crt and p12).   So do you have ny manual about working GP with linux? or what is wrong for getting this certificate error.   ... View more

Hi,    We have a PA200 which takes a long time to reboot. its like 13 minutes. Is that normal for PA220 ?? any way to know why its taking this time? ... View more

Hi,    We are having an issue connecting our UserID agent (version 7.x) with a DC in W2016. We have Userid agent version 7, we know that its not compatible useridagent 7.x with Windows server 2016, but we have several DCs in useridagent 7.x and one of them has already connected.  We know that we should upgrade UserIdagent to 8.0.5 or later, but why we have a DC in 2016 and this UserIDagent is connected to useridagent.   We see in "connected servers", the W2016 DC like connecting all the time. But it should show "connected".   This is the error: STATUS_MORE_PROCESSING_REQUIRED in packet capture, in useidagent server     ... View more

We have a security event that is repeated in a series of users, Not many users but the event is very frequent   ---------------------   EVENT Memory Corruption Exploit AGENT TIME 21 May, 2019 at 6:08 (2 hours ago) AGENT LOCAL TIME 21 May, 2019 at 6:08 (UTC +02:00) (2 hours ago) REPORT TIME 21 May, 2019 at 6:10 (2 hours ago) EVENT ID ec66f123488b4f65a80648166e0581f1COMMAND LINE C:\Windows\system32\svchost.exe -k netsvcs PID 6208 PARENT PID 2644 FILE NAME svchost.exe FULL PATH C:\Windows\SysWOW64\svchost.exe FILE SIZE 20.5 KB SHA 256 121118A0F5E0E8C933EFD28C9901E54E42792619A8A3A6D11E1F0025A7324BC2 SIGNER Microsoft Windows ---------------   what that means? any way to solve it or delete these repetitive events? ... View more

We have a security event that is repeated in a series of users, Not many users but the event is very frequent   ---------------------   EVENT Memory Corruption Exploit AGENT TIME 21 May, 2019 at 6:08 (2 hours ago) AGENT LOCAL TIME 21 May, 2019 at 6:08 (UTC +02:00) (2 hours ago) REPORT TIME 21 May, 2019 at 6:10 (2 hours ago) EVENT ID ec66f123488b4f65a80648166e0581f1COMMAND LINE C:\Windows\system32\svchost.exe -k netsvcs PID 6208 PARENT PID 2644 FILE NAME svchost.exe FULL PATH C:\Windows\SysWOW64\svchost.exe FILE SIZE 20.5 KB SHA 256 121118A0F5E0E8C933EFD28C9901E54E42792619A8A3A6D11E1F0025A7324BC2 SIGNER Microsoft Windows ---------------   what that means? any way to solve it or delete these repetitive events? ... View more

Hi,    We are going to add a new syslog server in PA config. So we would like to do a bit audit about PA supporting syslog sessions. What si the best way to know: -Volume of traffic per day for syslog -Top10 destination syslogs -.....   thanks.   ... View more

Hi,   We are having an issue with a file. This file can have several hashes  so its not possible to click in "treat as benign", besause the has file changes. SO what is the correct way to permit this file?   Thanks ... View more