This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About BenLassila
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About BenLassila
07-24-2019
42Posts
9Likes
2Solutions
Jul 24, 2019Last Visited
User
Activity
User
Profile
Latest posts by BenLassila
| Subject | Views | Posted |
|---|---|---|
| 11366 | 10-19-2018 04:17 AM | |
| 6514 | 11-19-2017 10:56 AM | |
| 4376 | 11-05-2017 01:40 AM | |
| 4202 | 11-04-2017 11:05 AM | |
| 6333 | 11-04-2017 08:56 AM | |
| 1950 | 11-04-2017 08:49 AM | |
| 4387 | 11-04-2017 08:36 AM | |
| 3429 | 10-16-2017 01:19 AM | |
| 3079 | 07-24-2013 12:44 AM | |
| 3079 | 07-22-2013 02:31 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-19-2018 04:17 AM | |
| 1 Like | 11-04-2017 08:49 AM | |
| 4 Likes | 11-05-2017 01:40 AM | |
| 3 Likes | 11-04-2017 08:36 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 4 Likes | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 01-31-2011 09:13 AM |
| Date Last Visited | 07-24-2019 12:43 AM |
| Posts | 42 |
| Total Likes Received | 9 |
10-19-2018
04:17 AM
1 Kudo
I had this problem too on Expedition 1.0.7.
Similar to the solution below I hard-coded the real (non-localhost) address to the bind-address line of /etc/mysql/my.cnf.
Don't forget sudo service mysql restart.
... View more
11-19-2017
10:56 AM
Palo Alto Networks - High risk IP addresses and Palo Alto Networks - Known malicious IP addresses are selectable as source address or destination address in your security rules without any other prior configuration. You can view them as Predefined in Objects > External Dynamic Lists if you wish Hope that helps Kind regards
... View more
11-05-2017
01:40 AM
4 Kudos
In the earlier versions of PanOS for large scale corporate deployments I had to manually add a number of lesser-known Trusted Root certificates. This has got a lot better with PanOS 7.1 and up. In the newest versions of PanOS you have a pre-populated "SSL Decryption Exclusion" list under Device > Certificate Management, which may be used as alternative to your no-decrypt list. Depending on your risk appetite you can also just allow decrypt errors to be allowed in future attempts. This is set in the Decryption Profile. The failed URL in question then enters a list in memory for which the firewall won't try decrypt again. Your problem could forever go away with the right setting, except that you have less visibility or control over where SSL Decryption is failing. Hope this helps
... View more
11-04-2017
11:05 AM
You mean intrazone-default, not interzone-default 😉 It's a good idea to create a more specific drop rule or at least override the non-logging Default Rules, because setting logging options can be extremely useful to see what's going on.
... View more
11-04-2017
08:56 AM
PanOS 7.0 Global Find helps a little https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/management-features/global-find.html I'm guessing you have too many to do that manually. The Firewall Migration Tool has some clean-up functionality https://www.paloaltonetworks.com/products/secure-the-network/next-generation-firewall/migration-tool I haven't tried yet whether it can also detect junk in a PA policy.
... View more
11-04-2017
08:49 AM
1 Kudo
Yes, apply your secy=urity profiles to both. Inbound initiated traffic needs security profiles to protect you from exploits targeting a weakness in your front facing web services. Outbound initiated traffic needs security profiles to protect your browsers or other clients from weaknesses in those browsers or malware download. It also benefits from PanDB URL filtering. You may find in practice that you like different profiles for inbound initiated than outbound initiated traffic, e.g. URL filtering makes a lot more sense Outbound than Inbound. Many people may have more Outbound rules than Inbound rules, so you may want to consider using a Security Profile Group with name "default" for your Outbound traffic, which will then be applied automatically to all new security rules you recreate.
... View more
11-04-2017
08:36 AM
3 Kudos
You probably want to intercept outbound browsing. Device > Certificates > Generate > Tick Certificate Authority ... make a certificate Edit your certificate and tick Forward Trust Certificate Tick your certificate and select Export Certificate. Do not export private key. Store file locally and open it on your desktop. Install Certificate Place it to your Trusted Root Certification Authorities store. Policies > Decryption Add your decryption rule > Make it match your traffic > Options > Action: Decrypt, Type: SSL Forward Proxy > New Decryption Profile (anything works) Commit There are a few more things you can do optionally (e.g. untrust certificate), but this gets you started.
... View more
10-16-2017
01:19 AM
Where has the link gone?
... View more
07-24-2013
12:44 AM
Well, yes. We scanned the M-100. Easy to collectively refer to Panorama as PAN-OS, because the look'n'feel is so similar.
... View more
07-22-2013
02:31 AM
Qualys gives me this against Panos 5.1.1: SSH-2.0-OpenSSH_11.1 - "UseLogin" option threat, upgrade to OpenSSH 2.1.1 or later. CVE-2000-0525, bugtraq 1334. I wonder if "UseLogin" is enabled. Not sure it's relevant on a locked-down CLI, but it's coming up in Qualys.
... View more
05-30-2012
12:58 AM
No, PA said implementation would have negative impact on performance.
... View more
03-11-2011
04:14 AM
Hi Bit of an advanced regex feature, but I would like to set up a custom vulnerability signature to detect browsers (user-agent) that are not Internet Explorer. True, one could detect Firefox specifically, but there are so many different browsers in the wild that it is impossible to match them all. The regex I'm attempting therefore is: User-Agent: (?!.*MSIE).* The regular expression would match if any browser type (user-agent) is not MS Internet Explorer, which is what I need. However, PANOS 4.0.0 doesn't seem to like this syntax and returns an error:- Operation Failed: -> signature > standard > Firefox -> and-condition -> And Condition 1 -> or-condition-> Or Condition 1 -> operator -> pattern-match -> pattern "User-Agent: (?!.*MSIE).* is invalid. syntax error at ? Is there any other way to achieve the detection of non-MSIE browsers? Thanks Kind regards, Ben
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-24-2019
12:43 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks