About Stevenjwilliams83

Stevenjwilliams83 · ‎05-12-2020

I am new to this API stuff and I am trying to use postman to get just basic objects out of my palo. Just something as simple as "https://192.168.81.50/restapi/9.0/Objects/Addresses" the return I get it cannot get any response. I setup my api key in authentication portion of postman and selected to be added to header and I just cant get anything to work so any help would be great.

Stevenjwilliams83 · ‎05-01-2020

Still no dice on this one. I am not sure what the issue is really.

Stevenjwilliams83 · ‎05-01-2020

Looks like this may be the issue: https://community.sophos.com/products/xg-firewall/sfos-eap/sfos-v18-early-access-program/f/feedback-and-issues/117248/ssl-tls-inspection-breaks-python-pip Seems pypi uses their own certs and not operating system certs. Also sees adding that URL is not the end all be all. I will have to probably do some wiresharking to figure all the sites out.

Stevenjwilliams83 · ‎05-01-2020

I can browse to the site fine. The firewall allows it because I can do it when no SSL decrypt policy is enabled. What am I looking for in the cert to see what the issue is?

Stevenjwilliams83 · ‎04-30-2020

I have added the URL to the exception list with no luck. Any suggestions? C:\Users\Steven Williams\AppData\Local\Programs\Python\Python38>pip install Flask-SQLAlchemy WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/ Could not fetch URL https://pypi.org/simple/flask-sqlalchemy/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/flask-sqlalchemy/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))) - skipping ERROR: Could not find a version that satisfies the requirement Flask-SQLAlchemy (from versions: none) ERROR: No matching distribution found for Flask-SQLAlchemy Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))) - skipping C:\Users\Steven Williams\AppData\Local\Programs\Python\Python38>

Stevenjwilliams83 · ‎03-05-2020

Anyone have issues with FB messenger or other chat platforms when SSL decryption is on? I see the logs say its allowed and tcp-fin but it doesn't work it just spins in a wait state on the app. when i click off my wifi and on to lte then it works fine so I know its the palo but cant seem to figure out what to exclude for ssl decrypt. I do not want to exclude *.facebook.com because that would be bad.

Stevenjwilliams83 · ‎12-01-2019

I can't seem to get the policy right for my Meraki APs to check in with the meraki cloud. I have allowed DNS, Ping, Meraki-cloud-controller using any port and allowed to *.meraki.com and *.opendns.com. Still see stuff hit my deny. Anyone know the correct combo for a policy?

Stevenjwilliams83 · ‎12-01-2019

Negative. When I check the clients they are not inheriting the DNS server IPs.

Stevenjwilliams83 · ‎11-30-2019

I have this weird issue where if my wireless clients lose connectivity to my meraki AP and then have to rejoin after the AP reboots, the DHCP server on the PA-220 stops handing out DNS servers that are inherited from the untrust port. I have all clients on my network as DHCP reservations. After they can't get DNS servers I have to reload the PA-220 and it takes forever to reboot. There is an article about setup a dummy scope, but I already have a scope so its not that. Anyone else have these issues? running code 9.0.3-h3

Stevenjwilliams83 · ‎11-21-2019

Strict Source Path - I still to this day have no idea what this option is for, what it does or doesn't do, and when to and not to use it. Not a lot of documentation on it from Palo themselves.

Stevenjwilliams83 · ‎11-12-2019

I think some of the issues I am running into is we have business units within our organizations, and now that I think of it I should have ran multi vsys for each one which would have kept their rules "segregated" But now I am trying to slam all these rules into one vsys and one large policy.

Stevenjwilliams83 · ‎11-12-2019

I get the port/services thing, Layer 7 vs Layer 3. I do not think specific source and destinations is a bad thing.

Stevenjwilliams83 · ‎11-12-2019

So I have business units within my organization. So in the ASA world I would have an ACL called BU01_access_in. This would dictate what traffic behind the interface named "BU1" can talk to. Nothing else on any other interface can talk into the interface unless allowed within the ACL. So if I want to build groups of rules based on TAGs like BU01 I would need to make sure all traffic it needs to access and all traffic that needs to access it is defined because then I would want to build a deny rule from the sources of BU1 to any and Any to BU1. So that deny would only affect that group of rules for the BU01. Palo gives you flexibility to build rules many different ways, so its hard to decide on a "best way". examples: rule 1 - Allow BU1 server network to Domain controllers (in different networks) rule 2 - Allow BU1 server network to NTP Servers (in different networks) rule 3 - Deny BU1 server network to RFC1918 rule 4 - Allow BU1 server network to Internet rule 5 - Deny BU1 server network to ANY rule 6 - Deny ANY to BU1 server network so this means that domain controllers in any other subnet beside BU1 servers wont be able to communication inbound to the server network because of the last rule. I need to deny to rfc1918 because I do not want the server subnet to talk to any subnet it shouldnt unless allowed. I need to allow an any after the rfc1918 for servers to get to internet for things like DUO MFA, Cloud based apps, etc, etc. Maybe that last rule isn't needed?

Stevenjwilliams83 · ‎11-11-2019

It seems to me that the "migration" from Cisco ASA to Palo is not apples to apples. Working in ASA for quite some time I am able to control traffic as what I allow in to the interface....So if I have 14 security zones I can control what comes into interface 5 without having to go to 13 security zones and denying the access to interface 5 from all zones. Palo uses zones, which i guess you can map to "interface security Zones" But the ability to combine rules and make them bi-directional within the same rule makes the policy less lines per say. The issue I am finding is you can use a zone for source and build a "block" of rules for all subnets within that zone and allow them to all the destinations. Then at the end of that block you can put a deny rule in there for those source subnets to any, but this doesn't stop other things and zones from accessing them since they are just denied from talking out. So this is where the Deny rule at the end of the policy comes in, but what about another "Block" of rules that needs to be locked down? I feel like you can't really deploy rules in a stepped phase. What did people do in a migration situation?

Stevenjwilliams83 · ‎10-29-2019

everything I have been reading seems to elaborate the use MFA DUO for global protect.

Stevenjwilliams83 · ‎10-29-2019

I wanted to add something here that I thought might be helpful. The recommendation is 100g of space for log exports. The larger my ruleset became the more space each log started taking. I have about 700 rules atm and I can only keep 1 log from each FW in my HA pair. If I forget to process logs (because for some reason automatic log process has never worked for me) your space fills up and you cant actually process the logs due to the fact there is not enough room. I would say 100g is a minimum but keep in mind your environment and how much traffic you have traversing the PAs.

Stevenjwilliams83 · ‎10-29-2019

Can the palo alto admin login page be configured for MFA using something like Okta or DUO?

Stevenjwilliams83 · ‎10-09-2019

Check the space on your box. df -h

Stevenjwilliams83 · ‎09-30-2019

I cannot seem to find device manager for mac...have a link for it?

Stevenjwilliams83 · ‎09-30-2019

HA!! That is the missing piece. For some reason I was thinking i didnt need to do that cause normally for a prod use I would get trusted 3rd party and wouldnt need to.

Stevenjwilliams83 · ‎09-30-2019

I have global protect gateway and portal licensing. I am testing at my home on my 220, but this going to be a request at my place of employment for sure when we roll it out. The logs are showing some errors but not sure what to look for. P7694-T11531 Sep 29 17:08:36:652833 Error( 522): Server trust evalutaion failed: 5 connection: 0x10440aff0, type: 1, host: [globalprotect.thenetworktransit.com:443], original host: [globalprotect.thenetworktransit.com], alwaysTrust: 0 session: <__NSURLSessionLocal: 0x104711e40> -[GPURLConnection session] <NSOperationQueue: 0x1047119a0>{name = 'NSOperationQueue 0x1047119a0'} identity: (null) scepIdentity: (null) connectionGroup: <OS_dispatch_group: 0x10440b120> distinguishedNames: (null) request: <NSMutableURLRequest: 0x104423e50> { URL: https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp } response: (null) responseError: (null) isHandshakeStarted: 1 trustedServerCertificates: (null) priorityIdentities: (null) serverCertificatesChain: ( "<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>", "<cert(0x10482ce00) s: IntermediateCert i: RootCert>", "<cert(0x10482d400) s: RootCert i: RootCert>" ) trustExceptionSHA256: ad:ff:f0:47:92:39:d2:db:15:29:21:ad:54:a3:bf:6c:d9:f4:48:01:d0:fe:d4:36:98:12:65:b1:20:ad:b9:ca error: Error Domain=GPURLConnectionErrorDomain Code=2 "(null)" UserInfo={ServerCert=<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>, trustChain=( { Certificate = "<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>"; Property = { type = error; value = "Root certificate is not trusted."; }; }, { Certificate = "<cert(0x10500a400) s: IntermediateCert i: RootCert>"; Property = "<null>"; }, { Certificate = "<cert(0x10500aa00) s: RootCert i: RootCert>"; Property = "<null>"; } )} connectTimeout: 5 receiveTimeout: 30 responseData(0): (null) P7694-T12803 Sep 29 17:08:36:655791 Error( 391): Connection error Error Domain=NSURLErrorDomain Code=-999 "cancelled" UserInfo={NSErrorFailingURLStringKey=https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp, NSLocalizedDescription=cancelled, NSErrorFailingURLKey=https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp} response:(null) connection: 0x10440aff0, type: 1, host: [globalprotect.thenetworktransit.com:443], original host: [globalprotect.thenetworktransit.com], alwaysTrust: 0 session: <__NSURLSessionLocal: 0x104711e40> -[GPURLConnection session] <NSOperationQueue: 0x1047119a0>{name = 'NSOperationQueue 0x1047119a0'} identity: (null) scepIdentity: (null) connectionGroup: <OS_dispatch_group: 0x10440b120> distinguishedNames: (null) request: <NSMutableURLRequest: 0x104423e50> { URL: https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp } response: (null) responseError: Error Domain=NSURLErrorDomain Code=-999 "cancelled" UserInfo={NSErrorFailingURLStringKey=https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp, NSLocalizedDescription=cancelled, NSErrorFailingURLKey=https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp} isHandshakeStarted: 1 trustedServerCertificates: (null) priorityIdentities: (null) serverCertificatesChain: ( "<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>", "<cert(0x10482ce00) s: IntermediateCert i: RootCert>", "<cert(0x10482d400) s: RootCert i: RootCert>" ) trustExceptionSHA256: ad:ff:f0:47:92:39:d2:db:15:29:21:ad:54:a3:bf:6c:d9:f4:48:01:d0:fe:d4:36:98:12:65:b1:20:ad:b9:ca error: Error Domain=GPURLConnectionErrorDomain Code=2 "(null)" UserInfo={ServerCert=<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>, trustChain=( {

Stevenjwilliams83 · ‎09-29-2019

I have a Pa220 and its using DHCP for untrust interface. I have followed about 40 documents and knowledgebases and still have no success with connecting my iphone to the palo via global protect. I am using self generated cert. I have collected the logs from the GP client but, I do not know what I am looking for to see what the issue is.

Stevenjwilliams83 · ‎09-29-2019

Is it possible to add the apps seen by the policy optimizer to an application group already created? I feel like this should be easy, but I can't seem to be able to do it. It appears you can create new app groups but cant add to current? Am I missing something?

Stevenjwilliams83 · ‎09-22-2019

How can I use dynamic DNS and SSL cert on the outside interface of the palo alto for global protect? I do not have a problem paying for something but I figured there is a way. I do not have a "server" at my home that is always on so I would need the palo alto to update the dynamic dns portion.

Stevenjwilliams83 · ‎09-22-2019

I have seen this so many times and I am wondering who you deal with it efficiently when making a rule. I see a standard port of like 443 or 8080 but with a rule that has application defined as SSL or web-browsing it doesn't hit the rule due to the application not matching. I have also see port 8080 show as application ssl. So what are the best practices for making these rules for applications incomplete or non applicable?

Stevenjwilliams83 · ‎09-19-2019

I hate having OCD sometimes because its things like this I struggle with. How are others organizing their rules? Are you grouping them by source IP? Zone? Common Apps? I have "business units" so each business unit has rules. So After each group of business unit rules there needs to be a deny for that "group" So I was starting to organize by source ip, build all the rules and then put a deny from that source to any and move on. But now I am like "But what if other sources need to access those sources but its still a rule for business unit A then it will be in another section based on a different source IP. I don't think there is a right or wrong way to do this and Yes it will be different for all, but I am just trying to get ideas to better help me.

Stevenjwilliams83 · ‎08-07-2019

Read it. Labbed it. It works. But "routing" doesn't solve LAN side requirements for hosts all the time. Not every corporation is running nexus as their core, not every corporation is stacking or using VSS. "Routing" doesnt solve a gateway problem.

Stevenjwilliams83 · ‎08-07-2019

I was just trying to understand the question of why do I think the standby node would receive traffic.

Stevenjwilliams83 · ‎08-07-2019

How do you figure? If each palo is learning each HSRP group VLAN via a routing protocol and both core switches own an SVI for that vlan, network is now connected. So OSPF will see the same subnet for a single vlan on each core switch as connected and based on ecmp will have a 50/50 shot of sending it the right node.

Stevenjwilliams83 · ‎08-07-2019

Avoid the stacking because in-service upgrades give me PTSD. No NAT because they are Core Firewalls. Would like to use ECMP but it seems to be a headache. And even with Active/Passive and HSRP there is still the issue that there is a 50 percent chance that the active firewall will send the return traffic to the standby HSRP node.

Date Registered	‎05-03-2019 12:29 PM
Date Last Visited	‎05-12-2020 02:53 PM
Total Messages Posted	70
Total Likes Received	3

Online Status	Offline
Date Last Visited	‎05-12-2020 02:53 PM

About Stevenjwilliams83

Anyone using Postman for API calls?

Re: SSL decryption issue with PIP

Re: SSL decryption issue with PIP

Re: SSL decryption issue with PIP

SSL decryption issue with PIP

Re: ECMP Strict Source Path

Palo Alto Admin Login MFA

Active/Active ECMP

Re: BGP peering on loopbacks, struggle is real

Anyone using Postman for API calls?

Re: SSL decryption issue with PIP

Re: SSL decryption issue with PIP

Re: SSL decryption issue with PIP

SSL decryption issue with PIP

SSL Decryption and Facebook Messenger and other message apps

What apps and services are used for Meraki Cloud?

Re: PA-220 DHCP with reservations

PA-220 DHCP with reservations

Re: ECMP Strict Source Path

Re: Cisco ASA to Palo Migration for ACLs

Re: Cisco ASA to Palo Migration for ACLs

Re: Cisco ASA to Palo Migration for ACLs

Cisco ASA to Palo Migration for ACLs

Re: Palo Alto Admin Login MFA

Re: Expedition server sizing

Palo Alto Admin Login MFA

Re: Incorrect User or Password from GUI

Re: Global Protect not connecting to gateway

Re: Global Protect not connecting to gateway

Re: Global Protect not connecting to gateway

Global Protect not connecting to gateway

Policy Optimizer Apps

Dynamic DNS and an SSL cert

Application incomplete or Non Applicable

Rulebase Organization and Flow

Re: Active/Active ECMP

Re: Active/Active ECMP

Re: Active/Active ECMP

Re: Active/Active ECMP

Strata

Prisma

Cortex

About Stevenjwilliams83