This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About atul.srivastava
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About atul.srivastava
03-24-2019
7Posts
0Likes
1Solution
Mar 24, 2019Last Visited
User
Activity
User
Profile
Latest posts by atul.srivastava
| Subject | Views | Posted |
|---|---|---|
| 4072 | 03-24-2019 03:35 PM | |
| 2144 | 03-24-2019 03:26 PM | |
| 4077 | 03-24-2019 01:07 PM | |
| 4085 | 03-21-2019 03:52 PM | |
| 2701 | 03-19-2019 08:48 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 03-18-2019 03:48 AM |
| Date Last Visited | 03-24-2019 04:28 PM |
| Posts | 7 |
03-24-2019
03:35 PM
Thanks Reaper. I have found a video explaining the actual working of AutoFocus as well. https://www.youtube.com/watch?v=dI0QrybypVg
... View more
03-24-2019
03:26 PM
Hi, What is the correct default Hello Message interval in Panorama HA? Is it 5000ms or 8000ms? I am asking this because, PA docs have quoted these two values at default at two different places. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/high-availability/ha-timers quoting 8000ms see the screenshot taken from EDU-120, Module - High Availability -- quoting 5000ms Thanks Atul
... View more
03-24-2019
01:07 PM
Hello Reaper, Thanks for your message! so basically AutoFocus do not block any threat and only works on identifying the threats?
... View more
03-21-2019
03:52 PM
Hi, Anyone please explain the major difference and usage between AutoFocus and WildFire in terms of enterprise security. Thanks
... View more
03-19-2019
08:48 PM
PA FW method of dealing any packet is very impressive. The moment PA see the traffic as tunneled SSL traffic and found that Content inspection is not allowed(as no-decrypt is configured), it wont care the payload inside the establised encrypted SSL connection. From PA point of view, it just see the layer 3 and layer 4 information and not even care of the certificate since the client server authetication establishment is already done between client browser and the server hosting the webpage. The entire path is now encrypted between client machine and server. PA will check the server trusted digital signature and will take appropriate action if its performing SSL forwarding or SSL inbound inspection between Client and destination domain. Hence for your question, PA will only see IP address of example.com in this case and nothing else. It can only see any extention if it can check the content. Thanks
... View more
03-19-2019
08:09 PM
Hi There, I will be greatful if anyone can please help me to understand the below which is taken from https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/high-availability/session-owner.html "You configure the session owner of sessions to be either the firewall that receives the First Packet of a new session from the end host or the firewall that is in active-primary state (the Primary device). If Primary device is configured, but the firewall that receives the first packet is not in active-primary state, the firewall forwards the packet to the peer firewall (the session owner) over the HA3 link. The session owner performs all Layer 7 processing, such as App-ID, Content-ID, and threat scanning for the session. The session owner also generates all traffic logs for the session. If the session owner fails, the peer firewall becomes the session owner. The existing sessions fail over to the functioning firewall and no Layer 7 processing is available for those sessions. When a firewall recovers from a failure, by default, all sessions it owned before the failure revert back to that original firewall; Layer 7 processing does not resume." Doubt - 1. If we configure one of the primary firewall as session owner which means as per the above stated content, the secondary firewall will pass the packet to session owner all the time, in that case what exactly secondary firewall is doing? 2. when the session owner failover happens, Is that existing sessions from the previous session owner will pass to the new one but layer 7 processing will not happen? I am not getting the point "Layer 7 processing does not resume" Sorry in advance if you find this question silly. Ta,
... View more
03-19-2019
07:49 PM
Multiple points for consideration: 1. Usually PA will block the URL you are planning to add in no decrypt policy if it marked as malicious/threat by URL database in PA FW. Moreover if a Company security policy allowing this which means its a allowed legitimate domain or unless some home grown application is cultured by your company for its customised testing and implementaion. Lets assume the Domain you are about to include in "no-decrypt" policy is not legitimate and somehow bypassed the access profiling of your network and HIPS and caused end device compromised. Now for any C2C operation, the malware will try to connect to public domain for further action at some stage. Their are multiple checks in place in PA FW when it comes network traffic profiling, DNS Sinkholing config is one of the example. As long as necessary Virus, spyware, fileblocking and wildfire profiles are in place for the traffic reaching out to Internet and Saas/DC environment, it should be okay. 2. PA FW will not block the URL "without decryption" provided: -URL is not in block list in FW url database and is not reported malicious by Wildfire -URL is not blocked in custom "BLACKLIST-URL" list Moreover any malicious site comes with some bad intention of malign purpose. Though the URL wont be dropped at PA firewall level but the moment this traffic decrypted at user computer, action will be blocked at that level depend upon the user action related to that site and security parameters in place. Thanks
... View more
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks