Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About jhickey
About jhickey
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
03-08-2017
64Posts
4Likes
0Solutions
Mar 08, 2017Last Visited
User
Activity
User
Profile
Latest posts by jhickey
| Subject | Views | Posted |
|---|---|---|
| 950 | 03-08-2017 10:01 AM | |
| 830 | 04-28-2014 06:54 AM | |
| 927 | 04-25-2014 09:53 AM | |
| 519 | 10-10-2013 10:00 AM | |
| 2564 | 04-01-2013 10:42 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 04-01-2013 10:42 AM | |
| 2 | 08-07-2012 04:45 AM | |
| 1 | 06-21-2012 06:56 AM |
User Badges
Public Statistics
| Date Registered | 02-09-2011 07:44 PM |
| Date Last Visited | 03-08-2017 01:21 PM |
| Total Messages Posted | 65 |
| Total Likes Received | 4 |
03-08-2017
10:01 AM
When you purchase a Western Digital Mycloud device, it comes with the ability to share this data from anywhere. I dont know exactly how they do this. I am assuming the drive/NAS calls out to a MyCloud website, nails up a connection, and allows remote users to ride this connection back to access the data. So far I havent been able to get details of exactly how this works. We are a highly regulated company and need to block this traffic. Anyone come across this ? Have any luck blocking it ?
... View more
04-28-2014
06:54 AM
Thanks for the replies. I finally got to connect with my support engineer and what jdelio is stating is correct. Panorama cannot syslog data received from managing another firewall. I am running Panorama 6.0.2 but firewall code 5.0.8. I ended up just adding another syslog destination on the firewall itself. So the firewall should be syslogging to 2 boxes. So far it doesnt seem to be working. I dont know if the firewall batches syslog traffic or does it in a constant stream or what.
... View more
04-25-2014
09:53 AM
My PA-4020's are busy to say the least. They do send traffic, threat and URL Filtering logs to Panorama. I want to be able to create a Log Forwarding profile on Panorama to send these logs off to a Syslog Server. Under Server Profiles Syslog, I create a new syslog server entry. I save it and commit the changes. When I go to Objects, Log Forwarding to create the object to syslog the traffic, the server I just created in does not show up in the drop down list. Am I doing something wrong ? Is it a bug ? Thanks, Justin
... View more
Labels:
10-10-2013
10:00 AM
Anyone else getting this ? Obviously a false positive. I have to say the URL filtering database leaves a lot to be desired.
... View more
04-01-2013
10:42 AM
1 Kudo
Im creating a rule base to limit port access to a Domain Controller in a DMZ. I want to allow TCP/636 (or LDAPS) to this server as well as a group of other applications. The only problem is that there is no LDAPS application defined. The application LDAP is defined as TCP/389 as it should be. LDAP also has TCP/636 defined but the PA does not identify TCP636 as LDAP traffic. I even created a new application LDAPS as TCP636 but the PA only recognizes it as application SSL over TCP/636. That would be fine but I dont want to create a new rule for a Service Object, I want to include it in the applications group. Nor do I want to allow all SSL to the domain controller. Any thoughts ? Thanks, Justin
... View more
Labels:
03-12-2013
11:56 AM
That is cool. I would assume this works with the SpamHaus "DROP" Dont Route or Peer list. For sure and idea whose time has come. I'd also like to put in all TOR endpoints.
... View more
03-12-2013
11:25 AM
Riddle me this… We have issues with malicious traffic coming from Open Proxies, Known Bad Hosts, etc. Is there such thing as an all IP, Realtime Blacklist for firewalls. There are certain external servers I dont want to be accessible by known bad networks. I’d love to write a rule like this: Source = RBL-or-Block-of-BAD-IPs-maintained-by-someone-else Destination=Important Server Action=Drop And no, I don’t want to buy a million dollar IPS. Isn’t there something in the Linux world called IP Tables. Justin
... View more
02-20-2013
04:54 AM
Thanks for that reply. I appreciate it. We're already blocking high and critical threats. Management here has latched onto this specific Java 0 day threat. They want to know which machines are vulnerable. The issue for me is I really dont know what to look for in the logs. Whats the name or number asscociated with this particular set of threats. It seems that every security company has a different name or pattern.
... View more
02-19-2013
12:47 PM
What is the PA Content update doing for me ? I am a little confused about this set of vulnerabilities. Are there active exploits ? If so, how is PA Stopping/Blocking them ? How could I look in the logs to see specifically which machines are infected / vulnerable. Thanks, Justin
... View more
09-26-2012
07:03 AM
We have a need to block mobile devices from getting to a particular host with active-sync, imap or pop3. From what I have read looking for and blocking traffic based on User-Agent is possible. Anyone ever do this with the PA ? Thanks, Justin
... View more
09-06-2012
11:31 AM
Is there no way to have different block pages appear per policy ? We have distint needs for a few different groups of users. We need one URL block page to come up when one policy is triggered and a different block page when another policy is triggered. Is this possible ? If not, why ? Any plans to make this happen ? Any hacks that are possible ? Can I take the block and continue category and break the continue piece and use that as a second block page ? Before you tell me to open a case I already did.
... View more
Labels:
08-07-2012
04:45 AM
2 Kudos
Im not questioning the need for the firewall to timeout connections. It's a stateful box and cleaning up old sessions is a requirement. What often happens is firewalls dont understand a certain type of control traffic and enforce a timeout that is too short, terminating an active connection and causing the app to error out. That's going to happen on any firewall. We as technicians need clear indications as to why a session was terminated. Just about every firewall out there will put spit out a TCP Timeout entry into some kind of log when this happens. If the log entry is there we will instantly know to create a custom application class with a longer timeout or with no timeout. Without the log entry we're left with more troubleshooting and time lost testing other theories. I hope they fix this because its kind of a big deal. Also if they could fix reporting and add a good log viewer while they are at it that would be great. (in my best Lundberg voice)
... View more
08-06-2012
05:05 AM
A year later and this situation has not been improved at all by Palo Alto. My URL log database filled up a month ago and I have no way to automatically clear old data. Now a Palo Alto tech will tell me to write a script or to get in the CLI and run some command. I ask them to take a look at the Websense reporting products. There is an easy way to schedule and purge any logs older then 3 months. It's unreal to me that this isnt included.
... View more
07-25-2012
06:59 AM
We subscribe to an outside service that monitors our traffic. We regularly get reports about the Trojan Zeus being identified from various different internal clients. Why isn't PA blocking this ? Here is some info about the Trojan: Regarding Zeus: Zeus (aka Zbot, Wsnpoem) is a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet. The Trojan is created using a Trojan-building toolkit. [1] [1] Trojan.Zbot http://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99 Additional information: Win32/Zbot http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fZbot Trojan-Spy:W32/Zbot http://www.f-secure.com/v-descs/trojan-spy_w32_zbot.shtml Zeus: King of the Bots http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/zeus_king_of_bots.pdf ZeuS Banking Trojan Report http://www.secureworks.com/research/threats/zeus/?threat=zeus Alert: Targeted attacks on institutional online banking http://www.ren-isac.net/alerts/banking-attacks_cio-bo_201001.html
... View more
06-21-2012
06:56 AM
1 Kudo
Thats what I expected. Thanks for the reply. I will mention it to my rep. The + - on rule groups is a necessity. Tags are ok but it's not the same. Thanks, Justin
... View more
06-21-2012
05:17 AM
Other firewall vendors provide the ability to group rules together based on whatever criteria you want. I find this very useful in organizing an often confusion rule base. Any plans to add this ?
... View more
Labels:
05-08-2012
02:10 PM
essnet, If they then advertise this website to millions of users then yes, brightcould should find reports of this instance and block it. They are already doing it. I look up the links in their database and more often then not they are correctly identified as 'Phishing and Other Scams'. I dont get the argument against URL filtering. I'll kick the tires with SSL Decryption. Thanks, Justin
... View more
05-08-2012
05:16 AM
So I dont know if its just us but we are getting hammered with phishing requests to google docs web sites. The latest is: https://docs.google.com/a/smps.k12.ok.us/spreadsheet/viewform?formkey=dGdKTFpTcW5KVVF1UGxJTFJ0aF9UdHc6MQ My URL Filter wont block this because it is SSL. It can read the cert which points to *.google.com but not the specific URL. Now, I'm not opposed to turning on SSL decryption but I dont want to turn it on for everything. Also, I dont understand how I can create the rule using IP Addresses as I'm sure docs.google.com has hundreds of IP Addresses associated with it. I also cant import a cert to everyones machine. Thats just not practicle. I'm angry that google would let this go on but its becoming a real issue for us. Are there any creative ideas out there on how to block this type of SSL phishing attempt ? Justin
... View more
05-07-2012
05:34 PM
Im nervous to turn on SSL Decryption. Is it reliable ? Do I have to turn it on for all SSL traffic ? I just want the URL information. Justin
... View more
05-07-2012
05:26 PM
Im having the same problem in a big way. I thought URL Filtering was suppose to be able to block websites through SSL even without decryption. I understand the custom block page not being allowed but I thought enough of the header was readable to throw up at least an ugly ACCESS Denied page. Google Docs is sending us fresh SSL based phishing schemes like almost every day. Not good !!
... View more
04-23-2012
05:31 AM
We're at the point where we want to apply URL Filtering policies based on userid. This means its very important that Pan-Agent is accurately identifying users. We did a test and added a user to a monitored group. The policy started working properly. We took him out and it took hours before the policy reverted properly. We only have 1 PanAgent deployed on a member server. Can I make the identification more resposive by deploying more agents to multiple places ? To specific servers ? Domain Controllers ? Any opinions on if this is a reliable enough process when tuned correctly ? Any help would be appreciated. Thanks, Justin
... View more
03-13-2012
10:15 AM
Just found this thread as I was considering turning on data filtering for SSN's and CC's and maybe specific record number we use at my company. Have you guys gotten any further ? Still stuck ?
... View more
02-09-2012
06:16 AM
I do log on session end. There is nothing that states TCP TIMEOUT like in the ASA. I do capture PCAPs but even there its tough to see the RST coming from the firewall. It's a needle in a haystack and I may be asked to do this a few times a quarter. When the firewall is creating an outage (intentionally) I think it should log it . No?
... View more
02-09-2012
05:01 AM
Hi, Thanks for the responses. As I search the forum I realized that I've posted the same question 3 times over the past year. I know both of your suggestions will work, it just seems over labor intensive to me to do this every time we suspect a timeout from the PAs. How hard would it be for the PA Developers to add a log condition for when the connection is timed out by the firewall ? Thanks, Justin
... View more
02-08-2012
02:43 PM
We have a video app that is streaming through our Palo Alto firewall on port 80. Everyone once in a while the session fails and can only be revived by hitting refresh in the browser. I am dealing with a network manager that's convinced the PAs are Resetting the session. Before I go through the hassle of creating override policies for port 80 with higher timeouts I'd like to know if there is anything in the logs that would show that the PALOALTO Terminated the connection. The CISCO Firewalls put something in their logs (TCP Timeout). I'm hoping something similar exists. Thanks, Justin
... View more
02-02-2012
09:39 AM
Does the user have rights to hit the block page over their VPN connection ? Can they route to it ? Browse to it ?
... View more
02-01-2012
05:18 AM
In the ASA you can disable SIP Policy Inspection. In the Junipers I think you disable the ALG. How do I do this in the Palo Alto ? Firewalls often try to apply rules around the way protocols work which can cause them to break. I dont want SIP to be inspected or held against some EEE Group Standard. This might be breaking some video conference traffic for us. Anyone know how to disable this ? Thanks, Justin
... View more
12-13-2011
07:41 AM
Juniper/Checkpoint and other Vendors allow you to create rule groups. Basically headers to organize functional rules/policies together. I think this goes a long way to keeping you policy organized. There's no way to do this ? Thanks, Justin
... View more
12-13-2011
07:04 AM
or maybe its as easy as the active-directory application I just found ?
... View more
12-13-2011
07:02 AM
I have 2 domain controllers across 2 dmz's and i need them to talk. I have a list of ports I want to open but I want to keep it neat and create a application group. I dont see an easy way to search applications by ports. Does anyone have a list of PA applications by name that is required for dc to dc communication ? This is not client to dc communication. Thanks, Justin
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
