About jhickey

jhickey · ‎03-08-2017

When you purchase a Western Digital Mycloud device, it comes with the ability to share this data from anywhere. I dont know exactly how they do this. I am assuming the drive/NAS calls out to a MyCloud website, nails up a connection, and allows remote users to ride this connection back to access the data. So far I havent been able to get details of exactly how this works. We are a highly regulated company and need to block this traffic. Anyone come across this ? Have any luck blocking it ?

jhickey · ‎04-28-2014

Thanks for the replies. I finally got to connect with my support engineer and what jdelio is stating is correct. Panorama cannot syslog data received from managing another firewall. I am running Panorama 6.0.2 but firewall code 5.0.8. I ended up just adding another syslog destination on the firewall itself. So the firewall should be syslogging to 2 boxes. So far it doesnt seem to be working. I dont know if the firewall batches syslog traffic or does it in a constant stream or what.

jhickey · ‎04-25-2014

My PA-4020's are busy to say the least. They do send traffic, threat and URL Filtering logs to Panorama. I want to be able to create a Log Forwarding profile on Panorama to send these logs off to a Syslog Server. Under Server Profiles Syslog, I create a new syslog server entry. I save it and commit the changes. When I go to Objects, Log Forwarding to create the object to syslog the traffic, the server I just created in does not show up in the drop down list. Am I doing something wrong ? Is it a bug ? Thanks, Justin

jhickey · ‎10-10-2013

Anyone else getting this ? Obviously a false positive. I have to say the URL filtering database leaves a lot to be desired.

jhickey · ‎04-01-2013

Im creating a rule base to limit port access to a Domain Controller in a DMZ. I want to allow TCP/636 (or LDAPS) to this server as well as a group of other applications. The only problem is that there is no LDAPS application defined. The application LDAP is defined as TCP/389 as it should be. LDAP also has TCP/636 defined but the PA does not identify TCP636 as LDAP traffic. I even created a new application LDAPS as TCP636 but the PA only recognizes it as application SSL over TCP/636. That would be fine but I dont want to create a new rule for a Service Object, I want to include it in the applications group. Nor do I want to allow all SSL to the domain controller. Any thoughts ? Thanks, Justin

jhickey · ‎03-12-2013

That is cool. I would assume this works with the SpamHaus "DROP" Dont Route or Peer list. For sure and idea whose time has come. I'd also like to put in all TOR endpoints.

jhickey · ‎03-12-2013

Riddle me this… We have issues with malicious traffic coming from Open Proxies, Known Bad Hosts, etc. Is there such thing as an all IP, Realtime Blacklist for firewalls. There are certain external servers I dont want to be accessible by known bad networks. I’d love to write a rule like this: Source = RBL-or-Block-of-BAD-IPs-maintained-by-someone-else Destination=Important Server Action=Drop And no, I don’t want to buy a million dollar IPS. Isn’t there something in the Linux world called IP Tables. Justin

jhickey · ‎02-20-2013

Thanks for that reply. I appreciate it. We're already blocking high and critical threats. Management here has latched onto this specific Java 0 day threat. They want to know which machines are vulnerable. The issue for me is I really dont know what to look for in the logs. Whats the name or number asscociated with this particular set of threats. It seems that every security company has a different name or pattern.

jhickey · ‎02-19-2013

What is the PA Content update doing for me ? I am a little confused about this set of vulnerabilities. Are there active exploits ? If so, how is PA Stopping/Blocking them ? How could I look in the logs to see specifically which machines are infected / vulnerable. Thanks, Justin

jhickey · ‎09-26-2012

We have a need to block mobile devices from getting to a particular host with active-sync, imap or pop3. From what I have read looking for and blocking traffic based on User-Agent is possible. Anyone ever do this with the PA ? Thanks, Justin

jhickey · ‎09-06-2012

Is there no way to have different block pages appear per policy ? We have distint needs for a few different groups of users. We need one URL block page to come up when one policy is triggered and a different block page when another policy is triggered. Is this possible ? If not, why ? Any plans to make this happen ? Any hacks that are possible ? Can I take the block and continue category and break the continue piece and use that as a second block page ? Before you tell me to open a case I already did.

jhickey · ‎08-07-2012

Im not questioning the need for the firewall to timeout connections. It's a stateful box and cleaning up old sessions is a requirement. What often happens is firewalls dont understand a certain type of control traffic and enforce a timeout that is too short, terminating an active connection and causing the app to error out. That's going to happen on any firewall. We as technicians need clear indications as to why a session was terminated. Just about every firewall out there will put spit out a TCP Timeout entry into some kind of log when this happens. If the log entry is there we will instantly know to create a custom application class with a longer timeout or with no timeout. Without the log entry we're left with more troubleshooting and time lost testing other theories. I hope they fix this because its kind of a big deal. Also if they could fix reporting and add a good log viewer while they are at it that would be great. (in my best Lundberg voice)

jhickey · ‎08-06-2012

A year later and this situation has not been improved at all by Palo Alto. My URL log database filled up a month ago and I have no way to automatically clear old data. Now a Palo Alto tech will tell me to write a script or to get in the CLI and run some command. I ask them to take a look at the Websense reporting products. There is an easy way to schedule and purge any logs older then 3 months. It's unreal to me that this isnt included.

jhickey · ‎07-25-2012

We subscribe to an outside service that monitors our traffic. We regularly get reports about the Trojan Zeus being identified from various different internal clients. Why isn't PA blocking this ? Here is some info about the Trojan: Regarding Zeus: Zeus (aka Zbot, Wsnpoem) is a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet. The Trojan is created using a Trojan-building toolkit. [1] [1] Trojan.Zbot http://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99 Additional information: Win32/Zbot http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fZbot Trojan-Spy:W32/Zbot http://www.f-secure.com/v-descs/trojan-spy_w32_zbot.shtml Zeus: King of the Bots http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/zeus_king_of_bots.pdf ZeuS Banking Trojan Report http://www.secureworks.com/research/threats/zeus/?threat=zeus Alert: Targeted attacks on institutional online banking http://www.ren-isac.net/alerts/banking-attacks_cio-bo_201001.html

jhickey · ‎06-21-2012

Thats what I expected. Thanks for the reply. I will mention it to my rep. The + - on rule groups is a necessity. Tags are ok but it's not the same. Thanks, Justin

Member Since	‎02-09-2011 07:44 PM
Date Last Visited	‎03-08-2017 01:21 PM
Posts	65
Total Likes Received	4

Online Status	Offline
Date Last Visited	‎03-08-2017 01:21 PM

About jhickey

Blocking Western Digital MyCloud

Re: Cant Syslog off of Panorama ?

Cant Syslog off of Panorama ?

URL Filtering 4183 blocking Yahoo Mail as Phishing ?

LDAPS TCP-636 shows as SSL

LDAPS TCP-636 shows as SSL

Re: TCP TimeOut caused by the PA?

Re: Looking for Rule Groups in the firewall policies.

Blocking Western Digital MyCloud

Re: Cant Syslog off of Panorama ?

Cant Syslog off of Panorama ?

URL Filtering 4183 blocking Yahoo Mail as Phishing ?

LDAPS TCP-636 shows as SSL

Re: IP-RBLs for firewalls

IP-RBLs for firewalls

Re: The hunt is on - 0day for java 1.7u10

Re: The hunt is on - 0day for java 1.7u10

blocking traffic with User-Agent header, ie Mobile

Different block pages based on policy

Re: TCP TimeOut caused by the PA?

Re: Log Management on Panorama

Zeus (aka Zbot, Wsnpoem) ignored by PA ?

Re: Looking for Rule Groups in the firewall policies.

Network Security

Cloud Security

Security Operations

About jhickey