LIVEcommunity - About tasonibare

tasonibare · ‎11-19-2014

Hey Satish, TO add to Samir's comment, if the encaps are incrementing but the decaps remain at 0 in the > show vpn flow tunnel-id <tunnel-id> command, then it might be an issue with the zones associated with actual tunnel traffic. To understand this better, if the interface configured for IKE Gateway is Ethernet1/1 in the UNTRUST zone but the ESP packets actually travel in and out the firewall through Ethernet1/10 in the WAN zone, then that configuration would not work. Both interfaces would need to be in the same zone for the tunnel to successfully forward traffic. See VPN Tunnel Traffic Encapsulation Incrementing but no Decaps for more details on this issue. Regards, tasonibare

tasonibare · ‎11-11-2014

Hello dthibodeaux, If you go to the Policies -> Captive Portal tab, you can add a rule at the very top for URLs that you do not want to activate Captive portal for. The action of this rule would be "no-captive-portal" and this should take care of your requirement. Here is a document on configuring Captive Portal for your reference. https://live.paloaltonetworks.com/docs/DOC-1159 Regards, tasonibare

tasonibare · ‎05-26-2014

Hello KC, Have you tried posting your question in the Devcenter's discussion forum? Devcenter is dedicated to assisting with questions such as this and you might even find someone who has already implemented what you are looking to achieve, and may be able to share examples with you. The link to devcenter is DevCenter Regards, tasonibare

tasonibare · ‎05-26-2014

Hello Eugene, Yes, you can perform SSL decryption without getting any security warnings on your web browsers. These security warnings only occur in web browsers that do not already trust the Root CA that signed the subordinate certificate that's doing the decryption. Adding the Trustwave Root CA certificate to your workstations' certificate root stores, if it's not already there, would ensure that you do not get the security warnings when SSL decryption is implemented. Here are a few links that have details on importing root certificates into Chrome, IE, Firefox and pushing it into the root store of a whole domain, using AD Group Policy Objects: SSL Decryption Certificates Installing root certificate in Mozilla Firefox - WebMoney Wiki Installing root certificate in Google Chrome - WebMoney Wiki Regards, tasonibare

tasonibare · ‎05-22-2014

As mzh mentioned, this feature is not supported on the PAN at this time. A feature request (ID 1307) has been filed for this functionality and you could request that your local SE vote on it as well. Regards, tasonibare

tasonibare · ‎05-21-2014

Hello Zebit, From your NAT policies, it looks like your primary ISP is on ethernet 1/3 and the secondary is ethernet 1/4. Is this correct? I notice that your PBF policy dictates that all traffic sourced from the INTERN and DMZ zones should be forwarded out of eth1/3. Based on your description, if you are trying to use a Public IP address given to you by the secondary ISP, then your current configurations would not work. Problem #1 I'm assuming that your Office365 server's IP address is 172.32.0.3 and your ISP_1 public IP is 100.100.100.100 and ISP_2 public_IP is 200.200.200.200. You have configured the 200.200.200.200 to be NAT'd to 172.32.0.3 so that when anyone on the internet pings that public IP, it would be sent to the server's private address. (NAT Policy "ADFS Intern"). When that traffic ingresses on eth1/4 for 200.200.200.200, your secondary ISP connection, the return traffic will incorrectly egress out of eth1/3 based on the configured PBF (Internet Monitor). To fix this, you would need to configure a PBF policy with symmetric return and position it above the "Internet Monitor" policy. Basically, this would make the firewall send responses out on the same interface that the requests had come in. Here is a document that explains this concept in greater detail: How to Configure Symmetric Return Problem #2 I'm assuming the "Extern zone DMZ" security policy is the one that should permit traffic from the EXTERN zone to the DMZ zone. If that's the case, you would need to configure the source zone as EXTERN while the destination zone should be DMZ zone. Pages 15-16 of this document explain this configuration in greater detail as well: Understanding PAN-OS NAT In the future, I'd suggest that you open a case with Support to help resolve this type of issue, but let us know if the recommendations above help to solve the problem. Regards, tasonibare

tasonibare · ‎05-12-2014

Hello Elvis, You can open a case with Support to submit the captures for the application to be updated. Regards, tasonibare

tasonibare · ‎05-07-2014

Hello Vladimir, URL filtering is triggered when there is a web-browsing or SSL traffic traversing the device, regardless of what you specify in the Application section of the security policy. I would argue that it is best practice to specify web-browsing (and/or SSL) as the permitted application(s), but this only helps to lock down that security policy further; it is not a requirement for the URL filtering to be triggered. Hope this helps. tasonibare

tasonibare · ‎05-06-2014

You can get the GP agent version in any of these 3 ways: 1. GUI -> Dashboard -> General Information. Look for "GlobalProtect Client" 2. GUI -> Device -> GlobalProtect Client. Look for the version that is currently Activated 3. Run CLI command: 'show system info' and it shows up as "global-protect-client-package-version" Regards, tasonibare

tasonibare · ‎05-02-2014

Hello infotech, We have an option that allows you to point the PA firewall to a dynamic source of URLs to be blocked, and you could schedule the firewall to refresh that list as often as every hour. Here is the document: Configuring Dynamic Block List (EBL) on a Palo Alto Networks Device Let us know if this is what you're looking for. Regards, tasonibare

tasonibare · ‎05-02-2014

Hello Mohammed, I believe you can achieve this by having 2 security policies for the different sets of users, one where there's a Wildfire Forward profile and the other where there isn't. This way, you can use the same SMTP application on both policies, instead of custom applications, and still achieve the intended results by just having different file-blocking profiles on either polices. Hope this helps. Regards, tasonibare

tasonibare · ‎05-02-2014

Hello Ben, There are some applications that do not play nice when decryption is turned on, on the PA firewall. Here is a document with a list of the applications we've already identified that should be excluded from decryption: List of Applications Excluded from SSL Decryption It is possible that Cisco Jabber is one of those applications that are not yet on the list, but you could open a ticket with us to investigate this further. Regards, tasonibare

tasonibare · ‎05-02-2014

Hello WCoats, If you run the CLI command 'show routing route', you would see the explanation of the route flags used on the PA firewalls. Here is the output for your reference: > show routing route flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2 Regards, tasonibare

tasonibare · ‎05-02-2014

Hello Zach, QoS is not supported on the PA firewalls at this time which is why you are not seeing it in the Physical Interface drop down of the QoS configuration. A feature request (ID 1058) has been submitted for this but there is no ETA on when it would be fulfilled at the moment. Regards, tasonibare

tasonibare · ‎01-17-2014

Thanks for providing clarity of your purpose, and yes, what you've described sounds like it would be a good deployment. Regards, tasonibare

Member Since	‎01-22-2013 02:29 PM
Date Last Visited	13m ago
Posts	53
Total Likes Received	27

Online Status	Online
Date Last Visited	13m ago

Re: site to site vpn issue

Re: white list and captive portal

Re: HTTP Fragment Control

Re: SSL Decryption with trustwave certification(subordinate certification)

Re: Mirror traffic from tunnel interfaces to SPAN port

Re: Routing table flags

Re: Problems with Skype rule letting traffic through

Re: Unable to Perform Debug Flow

Re: Methods for creating security policies

Re: SSL Decryption and Cisco Jabber client

Re: site to site vpn issue

Re: white list and captive portal

Re: HTTP Fragment Control

Re: SSL Decryption with trustwave certification(subordinate certification)

Re: Mirror traffic from tunnel interfaces to SPAN port

Re: Making server available with NAT doesn't work

Re: Current method for requesting Application updates?

Re: Security rule for url filtering - best practices?

Re: Global Protect Client

Re: Keeping current on blocked websites

Re: Custom APP-ID for SMTP traffic

Re: SSL Decryption and Cisco Jabber client

Re: Routing table flags

Re: QoS profiles on Aggregate interfaces

Re: Route web traffic through firewall

Network Security

Cloud Security

Security Operations