About tasonibare

tasonibare · ‎11-19-2014

Hey Satish, TO add to Samir's comment, if the encaps are incrementing but the decaps remain at 0 in the > show vpn flow tunnel-id <tunnel-id> command, then it might be an issue with the zones associated with actual tunnel traffic. To understand this better, if the interface configured for IKE Gateway is Ethernet1/1 in the UNTRUST zone but the ESP packets actually travel in and out the firewall through Ethernet1/10 in the WAN zone, then that configuration would not work. Both interfaces would need to be in the same zone for the tunnel to successfully forward traffic. See VPN Tunnel Traffic Encapsulation Incrementing but no Decaps for more details on this issue. Regards, tasonibare

tasonibare · ‎11-11-2014

Hello dthibodeaux, If you go to the Policies -> Captive Portal tab, you can add a rule at the very top for URLs that you do not want to activate Captive portal for. The action of this rule would be "no-captive-portal" and this should take care of your requirement. Here is a document on configuring Captive Portal for your reference. https://live.paloaltonetworks.com/docs/DOC-1159 Regards, tasonibare

tasonibare · ‎05-26-2014

Hello KC, Have you tried posting your question in the Devcenter's discussion forum? Devcenter is dedicated to assisting with questions such as this and you might even find someone who has already implemented what you are looking to achieve, and may be able to share examples with you. The link to devcenter is DevCenter Regards, tasonibare

tasonibare · ‎05-26-2014

Hello Eugene, Yes, you can perform SSL decryption without getting any security warnings on your web browsers. These security warnings only occur in web browsers that do not already trust the Root CA that signed the subordinate certificate that's doing the decryption. Adding the Trustwave Root CA certificate to your workstations' certificate root stores, if it's not already there, would ensure that you do not get the security warnings when SSL decryption is implemented. Here are a few links that have details on importing root certificates into Chrome, IE, Firefox and pushing it into the root store of a whole domain, using AD Group Policy Objects: SSL Decryption Certificates Installing root certificate in Mozilla Firefox - WebMoney Wiki Installing root certificate in Google Chrome - WebMoney Wiki Regards, tasonibare

tasonibare · ‎05-22-2014

As mzh mentioned, this feature is not supported on the PAN at this time. A feature request (ID 1307) has been filed for this functionality and you could request that your local SE vote on it as well. Regards, tasonibare

tasonibare · ‎05-21-2014

Hello Zebit, From your NAT policies, it looks like your primary ISP is on ethernet 1/3 and the secondary is ethernet 1/4. Is this correct? I notice that your PBF policy dictates that all traffic sourced from the INTERN and DMZ zones should be forwarded out of eth1/3. Based on your description, if you are trying to use a Public IP address given to you by the secondary ISP, then your current configurations would not work. Problem #1 I'm assuming that your Office365 server's IP address is 172.32.0.3 and your ISP_1 public IP is 100.100.100.100 and ISP_2 public_IP is 200.200.200.200. You have configured the 200.200.200.200 to be NAT'd to 172.32.0.3 so that when anyone on the internet pings that public IP, it would be sent to the server's private address. (NAT Policy "ADFS Intern"). When that traffic ingresses on eth1/4 for 200.200.200.200, your secondary ISP connection, the return traffic will incorrectly egress out of eth1/3 based on the configured PBF (Internet Monitor). To fix this, you would need to configure a PBF policy with symmetric return and position it above the "Internet Monitor" policy. Basically, this would make the firewall send responses out on the same interface that the requests had come in. Here is a document that explains this concept in greater detail: How to Configure Symmetric Return Problem #2 I'm assuming the "Extern zone DMZ" security policy is the one that should permit traffic from the EXTERN zone to the DMZ zone. If that's the case, you would need to configure the source zone as EXTERN while the destination zone should be DMZ zone. Pages 15-16 of this document explain this configuration in greater detail as well: Understanding PAN-OS NAT In the future, I'd suggest that you open a case with Support to help resolve this type of issue, but let us know if the recommendations above help to solve the problem. Regards, tasonibare

tasonibare · ‎05-12-2014

Hello Elvis, You can open a case with Support to submit the captures for the application to be updated. Regards, tasonibare

tasonibare · ‎05-07-2014

Hello Vladimir, URL filtering is triggered when there is a web-browsing or SSL traffic traversing the device, regardless of what you specify in the Application section of the security policy. I would argue that it is best practice to specify web-browsing (and/or SSL) as the permitted application(s), but this only helps to lock down that security policy further; it is not a requirement for the URL filtering to be triggered. Hope this helps. tasonibare

tasonibare · ‎05-06-2014

You can get the GP agent version in any of these 3 ways: 1. GUI -> Dashboard -> General Information. Look for "GlobalProtect Client" 2. GUI -> Device -> GlobalProtect Client. Look for the version that is currently Activated 3. Run CLI command: 'show system info' and it shows up as "global-protect-client-package-version" Regards, tasonibare

tasonibare · ‎05-02-2014

Hello infotech, We have an option that allows you to point the PA firewall to a dynamic source of URLs to be blocked, and you could schedule the firewall to refresh that list as often as every hour. Here is the document: Configuring Dynamic Block List (EBL) on a Palo Alto Networks Device Let us know if this is what you're looking for. Regards, tasonibare

tasonibare · ‎05-02-2014

Hello Mohammed, I believe you can achieve this by having 2 security policies for the different sets of users, one where there's a Wildfire Forward profile and the other where there isn't. This way, you can use the same SMTP application on both policies, instead of custom applications, and still achieve the intended results by just having different file-blocking profiles on either polices. Hope this helps. Regards, tasonibare

tasonibare · ‎05-02-2014

Hello Ben, There are some applications that do not play nice when decryption is turned on, on the PA firewall. Here is a document with a list of the applications we've already identified that should be excluded from decryption: List of Applications Excluded from SSL Decryption It is possible that Cisco Jabber is one of those applications that are not yet on the list, but you could open a ticket with us to investigate this further. Regards, tasonibare

tasonibare · ‎05-02-2014

Hello WCoats, If you run the CLI command 'show routing route', you would see the explanation of the route flags used on the PA firewalls. Here is the output for your reference: > show routing route flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2 Regards, tasonibare

tasonibare · ‎05-02-2014

Hello Zach, QoS is not supported on the PA firewalls at this time which is why you are not seeing it in the Physical Interface drop down of the QoS configuration. A feature request (ID 1058) has been submitted for this but there is no ETA on when it would be fulfilled at the moment. Regards, tasonibare

tasonibare · ‎01-17-2014

Thanks for providing clarity of your purpose, and yes, what you've described sounds like it would be a good deployment. Regards, tasonibare

tasonibare · ‎01-17-2014

Excellent. Let me make a quick clarification. Though the tcp/8080 traffic is NAT'd to tcp/80 on the firewall, it would be considered as traffic destined for the firewall itself, not a proxy-session. Again, the PAN firewall is not a web proxy, so sending traffic to the firewall to proxy web browsing will just be black-holed. (Sorry I didn't make this clear at first when I talked about NAT). Since you can route traffic from the branches to the Palo using the MPLS circuit, why don't you just make the PA-500's LAN interface the default gw or next-hop for the branch networks? You should be able to achieve this with some kind of Policy Based Routing, where the traffic is still destined for your Windows TMG server (for proxy) but it is routed through the PA-500 for filtering or firewalling. Let me know if this would achieve your purpose. Regards, tasonibare

tasonibare · ‎01-17-2014

Hello cft14server, With the way things are configured right now on your branch networks, how do they route traffic to the Microsoft TMG server at the head office? Do they go through VPN tunnels or there's some sort of MPLS/Private circuit that does the routing? The reason for asking is; even though the current browser settings has the Windows server as the proxy, there's an underlying transport for those browsing sessions to get to the head office. Would you be able to leverage that router or VPN transport to connect your branches to the PA-500's LAN interface? I do not know of an explicit configuration to make an interface on the firewall a web-proxy, but we could configure NAT statements to translate tcp/8080, for instance, to tcp/80 on the firewall's interface. The traffic will still need to be routed to the PAN before the NAT would take any effect, however. Hope this helps. Regards, tasonibare

tasonibare · ‎01-03-2014

Hello hvcomputech, cmd eq edit | cmd eq commit are filters you can use while viewing the configuration logs. For the email alerts, however, there is no option to filter what configuration sub-sections are sent out... so you are correct, but those are not needed for the email alert configuration. fyi, other cmd filter options include: cmd eq set cmd eq delete cmd eq move cmd eq rename cmd eq clone cmd eq add cmd eq request Regards, tasonibare

tasonibare · ‎12-24-2013

Mark, The PA-3000 firewalls will efficiently handle your described office requirements. I can unicast you information on the capacities of the PA 3000 if you like, but your SE would be a great resource for this information as well. Also for DHCP, your method will work just fine, having DHCP pools on each configured sub-interface. Regards, tasonibare

tasonibare · ‎12-24-2013

KayvanRomaezi, There are no reported issues with flow basic debugging being broken in 4.1.13. If you are not capturing anything in your logs, try the following stesp: 1. Clear all debugging settings > debug dataplane packet-diag clear all 2. Set your filter as needed first > debug dataplane packet-diag set filter match <match_criteria> 3. Set the filter on > debug dataplane packet-diag set filter on 4. It's always helpful to turn off session offloading if your system's current condition can handle it. Check the packet rate on the device and turn session offloading on/off with the following commands: > show session info > set session offload yes | no 5. Aggregate all logs to a single file prior to running the flow basic > debug dataplane packet-diag set log log-option aggregate-to-single-file yes 6. Set flow basic logging on > debug dataplane packet-diag set log feature flow basic > debug dataplane packet-diag seg log on As always, use the flow basic debugging tool sparingly as this is very CPU intensive. Also, remember to turn session offloading back on after your troubleshooting session. Hope this helps. Regards, tasonibare

tasonibare · ‎12-24-2013

Suhaimi, Whenever there are certificate warnings with SSL websites, it means there's something about the certificate presented that the client browsers do not trust. You should be able to use the existing certificate as long as you import the cert into your firewall along with its private key, and that certificate is included in the Trusted Root CA store on your staff's workstations (if it is a root CA certificate). If the existing certificate is not a root CA cert, make sure that you also import the root CA's cert that signed that certificate into the PAN. If this step is not done, the firewall will not pass the entire certificate chain to the internal hosts and since the infomation about the root CA is missing, there would always be a warning that the cert is not trusted. Here are some documents related to this problem and how to chain a certificate with its root cert to be imported into the PAN. https://live.paloaltonetworks.com/docs/DOC-2287 https://live.paloaltonetworks.com/docs/DOC-1327 https://live.paloaltonetworks.com/docs/DOC-4289 Regards, tasonibare

tasonibare · ‎12-24-2013

yq, If you are asking about IPv6 packets encapsulated in ESP packets (protocol 50), then that is currently supported in Pan-OS 5.0. For Teredo tunneling, where IPv6 is the data within IPv4 packets, Palo Alto only recognizes this 6in4 tunnel by the protocol 41 value in the IPv4 header. We do not have a decoder for Teredo 6in4 tunnelling yet so we cannot terminate or configure this feature on the PA firewalls. We simply pass this through the firewall as IPv4 traffic but the application will read ipv6 in the session details. A feature request (ID #882) has been filed for this to be implemented and you could contact your SE to vote on this as well, for faster fulfilment of the request. Regards, tasonibare

tasonibare · ‎12-19-2013

Hello Andreas, You are correct. You do need a route on the firewall pointing the dynamic, untrust IP address towards the DMZ interface. If you are only expecting 443 traffic on this dynamic address, then you could accomplish this with just a static route. If you are expecting to receive 443 and other services on this IP address however, then you do need a PBF policy. You can still filter by application and you could use a bi-directional NAT as well. I've not encountered any problems with PBF and app filter so I cannot comment on that, but they are designed to work in harmony if configured correctly. For your last question, yes, you can translate the destination port from your untrust traffic(444) to a different port(443) using NAT. The NAT statement would look something like the following: Note that the NAT policy permits Untrust to Untrust but the security policy needs to permit Untrust to DMZ. See the following document for more information regarding NAT on the Palo Alto. https://live.paloaltonetworks.com/docs/DOC-1517 Regards, tasonibare

tasonibare · ‎12-19-2013

Idavie, There is no way to disable the GP portal without affecting the GP client. GP Agents need to contact a Portal to get information about available Gateways. You can also refer to this thread with a similar discussion. https://live.paloaltonetworks.com/message/29531#29531 Regards, tasonibare

tasonibare · ‎12-17-2013

jeffm, Your method of search is correct, but there is currently no application on the Palo Alto firewalls for WinRM, on port 5985. You can request this application be created by our engineering team through this link: http://researchcenter.paloaltonetworks.com/submit-an-application/ You could also create a custom app for immediate use in your security policies. This method would give you an immediate resolution as there's no way to determine an e.t.a. when a default application is requested from Palo Alto through the research center link above. Here's a link on how to create a custom application: https://live.paloaltonetworks.com/docs/DOC-2015 Regards, tasonibare

tasonibare · ‎12-16-2013

Hello MemphisBrothers, Most deployments choose to have separate rules for inbound and outbound traffic in order to properly log the security rule permitting the respective traffic. By doing this, you could also be more granular and selective in the traffic permitted in or out of your network. If you only need to permit the same type of traffic in and out, and don't care too much about individual control on either of the directions, then you can create one policy for both directions to minimize number of policies. Regards, tasonibare

tasonibare · ‎12-16-2013

Troy, You would need to have separate gateways configured for the different groups in the GP Portal configuration, and then in the Gateway configuration, you would restrict access to the particular users of a group using the access routes. Whatever networks you configure in the Access Route section of the Client Configuration (Gateway) are the only resources that the users in the particular group have access to. This would be a split tunnel for your users where traffic to these configured networks/servers would route through the VPN tunnel, and the rest of their regular internet traffic would go out through their traditional default gateway. Regards, tasonibare

tasonibare · ‎12-16-2013

Just to add, if you need to see DHCP negotiations, allocations and events, you can tail or less the dhcpd for this information. > tail follow yes mp-log dhcpd.log (for more information, you can also set the dhcpd to debug mode with the 'debug dhcpd global on debug' debug). P.S.: Always remember to turn off debugging when done troubleshooting so the device doesn't crash on you. Regards, tasonibre

tasonibare · ‎12-16-2013

Thanks for the clarification and sorry for the delayed response. 1. From your CP policy, you have the service set to 'default'. This would only hijack HTTP traffic and not HTTPS traffic. (Sorry I missed this in my first response). You need to enable both http and https services in the CP policy in order for the firewall to hijack both types of traffic. Furthermore, even though the firewall was not hijacking HTTPS traffic for CP, the only reason why the traffic was successful is because there's a security policy permitting SSL for 'any' or 'unknown' users. Verify that you are only permitting SSL access for known users from the Wifi zone to the internet zone. 2. If the PA interface is configured to be your DHCP server, then we do not log the DHCP negotiation in our traffic logs. These are host services and not traffic traversing the firewall's DP and that's why it doesn't get logged, or a session created for you to see in CLI. Regards, tasonibare

tasonibare · ‎12-16-2013

panos, You can combine an application filter for streaming media along with the URL category you want to block in a single security policy and then deny any traffic matching these criteria. Perhaps that would help achieve what you're looking for. Below is an example of such configuration: Regards, tasonibare

Date Registered	‎01-22-2013 02:29 PM
Date Last Visited	yesterday
Total Messages Posted	53
Total Likes Received	27

Online Status	Offline
Date Last Visited	yesterday

Strata

Prisma

Cortex

About tasonibare