About santonic

santonic

In our demo SD-WAN setup we have a couple of SD-WAN rules for ping traffic and also a catch-all rule for all unmatched traffic. For most of the tested applications everything is fine. But for ping (and traceroute) the SD-WAN policy name field in traffic logs is always empty. The SD-WAN rules for ping are getting hits, also the performance of ping suggests that the SD-WAN policy rule is working (it's directing it over LTE link). Are there any specifics about ping and SD-WAN Policy Name field? Or maybe just a bug? Anyone has similar issue?

santonic

I agree with @Josef.Honc and it's a very good question. I am also curious if PA can measure quality of DIA links.

santonic · ‎03-05-2020

With PBF you could re-route traffic to some destination based on various criteria. That destination has to be a device on connected network. So I don't think that will work for Menlo. PA is not a proxy, so the integration you have in mind won't work. But I am pretty sure PA will do a great job securing your web traffic without any help.

santonic · ‎03-03-2020

I am following the admin guide: https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/sd-wan/1-0/sd-wan-admin/sd-wan-admin.pdf At first I'm doing it without BGP and on page 58 you can either use Panorama template variables or define static routes directly on FW. And the variables you make you use in destination field which must be of type IP address.

santonic · ‎03-03-2020

Anyone been trying to setup SD-WAN routing with template variables? Surely that page in admin guide is completely wrong? Variables should be of type IP address.

santonic · ‎01-16-2020

The scenario is to introduce PA capabilities to the customer (SLR) so we want to put it in TAP mode on north/south traffic.

santonic · ‎01-16-2020

We have a situation where we can't get all the mirrored traffic to the same interface. But as it's asynchronour souting nevironment a packet can be mirrored to one interface and the reply to the other. So we need to connect 2 PA TAP interfaces to capture whole sessions. The question is will PA match the packets into same session if we put both interfaces into the same security zone?

santonic · ‎11-20-2019

Yeah, logs are fine. So we assumed it's ok. Just wanted to be sure so it doesn't bite us some time later.

santonic · ‎11-19-2019

Scenario: Panorama (in Panorama mode) with single local Log Collector A/A cluster of firewalls managed by this Panorama We managed to change the master key on Panorama and both firewalls. But trying to change the master key of the single local Log Collector on this same Panorama fails with "Failed to schedule deploy masterkey job". Is it even neccessary to change this master key in this scenario where Log Collector is on the same (virtual) appliance as Panorama?

santonic · ‎10-14-2019

Even though 9.0.4 is already out I still don't recommend using this version in production. I've seen some really weird and annoying bugs on all 9.0 releases so far. I must say this is by far the buggiest release ever from PA.

santonic · ‎09-30-2019

Yeah, in the end I went for 2 VR option as well and it works well.

santonic · ‎09-11-2019

Good stuff! Thanx!

santonic · ‎09-09-2019

Yeah, only specific static routes (to, GW, Portal, maybe updates...) would work if the customer doesn't want backup default route over internet in case there are issues with VPN. And yeah, PBF is another way to go. Tho I think i would prefer the solution with 2 VRs. Thanx for your feedback.

santonic · ‎09-09-2019

I meant the initital default route for the remote location to get internet access and establish LSVPN connection to the gateway. After that the idea is to route all user traffic including internet traffic through VPN.

santonic · ‎09-06-2019

I want all satellites to route all traffic through VPN tunnel when it's available. In GP gateway if I leave Access Routes emtpy or if I publish 0.0.0.0/0 to the satellite I get the default route with metric 100 on the atellite. But that means the static default route entered on initial configuration of satellite will still remain the active route in forwarding table. And if we change metric on static default route (to more than 100) I guess the satellite will lose connectivity with GW gateway over outside interface? Anyone played with this scenario of routing all traffic from satellites? I guess I could add 2nd virtual router on satellites but seems overkill just for this.

santonic · ‎09-06-2019

On GP Gateway -> Satellite -> Route Filter you can filter which routes does GW accept and enter in its own routing table.

santonic · ‎08-26-2019

Yes, but we got this error when we set next hop to 'none'. In this case this check is irrelevant. But I think they fixed it as I didn't see it for a while now.

santonic · ‎08-26-2019

Output format: "aclIPVT_in_2; index: 2" { from INSIDE; source [ 10.200.10.116 10.200.10.115 10.200.10.110 10.200.11.0/24 10.200.10.113 10.200.10.112 10.200.10.117 10.200.10.111 10.200.10.0/24 10.200.10.114 ]; source-region none; to OUTSIDE; destination [ 10.140.1.15 10.140.1.10 10.140.1.20 ]; destination-region none; user any; category any; application/service [0:any/tcp/any/49152-65535 1:any/tcp/any/42 2:any/tcp/any/53 3:any/tcp/any/88 4:any/tcp/any/135 5:any/tcp/any/139 6:any/tcp/any/389 7:any/tcp/any/445 8:any/tcp/any/636 9:any/tcp/any/3268 10:any/tcp/any/3269 11:any/tcp/any/1025-5000 12:any/tcp/any/9389 ]; action allow; icmp-unreachable: no terminal yes; }

santonic · ‎08-25-2019

According to specs (from FW comparison tool: https://www.paloaltonetworks.com/products/product-comparison.html?chosen=pa-850,pa-220,pa-3220) PA-3220 should be able to have 10.000 security rules. The output is in xml format. They are making an internal app which will check all their firewalls for rules associated with certain IP.

santonic · ‎08-21-2019

@BPry I have a case where customer has over 5000 rules on PA-3220. And every time they try running command " show running security-policy " either from CLI or via API they always get only first 2664 rules?

santonic · ‎08-09-2019

Is Windows 10 image supported on any version of WildFire appliance? Maybe in PAN-OS 9?

santonic · ‎08-09-2019

It's a very strange issue. I would try capturing traffic at multiple points and comparing them: - ingress interface of internet FW, - egress interface of internet FW, - ingress interface of internal FW, - egress interface of internal FW. Maybe on server as well.

santonic · ‎08-02-2019

Only resetting the certificates didn't help in my case. But this worked: 1. You should delete all the license keys for this Firewall and then fetch them back. at the CLI: delete license key ? delete each one Fetch them back on the GUI 2. From the Panorama ...Panorama>Device Deployment>License. Click refresh for this firewall 3. Delete the certificate request logging-service-forwarding certificate delete request logging-service-forwarding certificate fetch 4. Re-fetch customer info request logging-service-forwarding certificate info

santonic · ‎07-23-2019

Yes, I have considered using MineMeld. But as far as I understand MineMeld is a tool for manipulating with different feeds? At the moment I'm still looking sources of info, that is free anti-spam lists which can be downloaded (and not only queried).

santonic · ‎07-23-2019

Hello. A customer would like to add smo more anti-spam features to a Palo Alto FW setup and is intersted in using EDLs in connection with publicly available anti-spam lists. Anyone knows a good and free anyti-spam list I could use for that? I've checked all the most known ones but they all offer only lookup capabilities (you query an IP/FQDN and get a response from them). Anyone knows an anti-spam list which could actually be downloaded and fed into EDL?

santonic · ‎06-13-2019

DNS security doesn't use signatures on the device. It is a cloud service, every DNS query is sent to PA cloud to be checked. To use it you need the license and PAN-OS 9.0. DNS with app default doesnt protect you from DNS tunneling because the DNS queries used for it are compatible with the protocol.

santonic · ‎06-11-2019

You weren't even changing any major release version, that is strange indeed.

santonic · ‎06-11-2019

From which version were you upgrading? Though this shouuldn't happen from any version. What did the logs say? Were you getting decrypt errors for all traffic? Turn on decryption just for 1 user (yourself?) and investigate the issue for more details.

santonic · ‎05-20-2019

I've sucesfully connected FW 8.1.x to Data lake but am having issues connecting one on 9.0.1. Both are managed by the same Panorama (PAN-OS 9.0.1). The difference is that on non-working one I have disabled Panorma Policy and Objects. But logging service setting is under template setting anyway. License seems to be ok. First error says "No certificate found" but there isn't any certificate configuration required for logging service. The second error says "Logging Service Preference List is malformed". No idea how to check/fix that. Any Ideas? The status it shows is: @PA-3060> request logging-service-forwarding status Logging Service Licensed: Yes Logging Service forwarding enabled: Yes Duplicate logging enabled: No Enhanced application logging enabled: Yes Logging Service License Status: Status: Status: success Expiration date: June 22, 2019 Msg: License is valid Last Fetched: 2019/05/16 10:44:43 Fetch: Install: Upgrade: Logging Service Certificate information: No certificate found Logging Service Customer file information: Info: Failed to fetch ingest/query FQDN for customer (curl failed) Status: failure Last Fetched: 2019/05/20 10:01:07 Logging Service Preference List is malformed

santonic · ‎05-17-2019

I remember I had some extra lines in text file and after removing theose it worked. But later I had another issue with Juniper config which I eventually gave up trying to import as it only had like 10 rules.

Date Registered	‎01-26-2011 05:56 AM
Date Last Visited	15 hours ago
Total Messages Posted	618
Total Likes Received	152

Online Status	Offline
Date Last Visited	15 hours ago

Strata

Prisma

Cortex

About santonic