About roma

Hello, If I have a policy for example that allows application "web-browsing" and service is "port 500" - does that mean that the rule will allow if the application is either "web browsing" OR "service 500" or the rule will be allowed if the application is "web browsing" AND "service 500"? Thanks. ... View more

We have a server in our DMZ that is allowing from the internet the SSH application via our Palo Alto firewall. The server in the DMZ is very well locked down and the application on the server that facilitates the SSH session is a highly rated 3rd party application that allows vendors to connect to servers in your network. I've read and heard how safe\unsafe SSH is, but I cant find anything that makes itr seem to me any less safe than ipsec vpn or https. Any thoughts? Also, I see that the applications for SSH the security rule include: SSH SSH-Tunnel Is there a preference?   Thanks. ... View more

Hello, We have URL filtering with the PAN-DB license. If a URL is determined to be malicious, (from other URL checking websites, but not from Palo Aloto's yet, since they only categorized it as high risk and unknown at the moment). What is the best way to make sure users will be blocked from it? We are blocking the categories of hacking, malware, phishing and C&C. Do I add it to my URL filtering block list on the Palo Alto firewall? I submitted the URL to the Palo Alto website to test it and I requested a change for it to be categorized as phishing, but I received an email back that I would be notified in 24 hrs. What is the best way to make sure users will not reach a site that is malicious but PA Networks hasnt classified it as that yet? Thanks, ... View more

Hello, I have user-id enable on the trust zone and it works fine. I also have a DMZ zone and was wondering if it was ok to enable it on that zone? I know best practice is to not enable it on the outside zone, but we have many dmz to trust security policies and I would like to see in the reports some of the user accounts that are sourcing in the DMZ. Some of those DMZ servers in the DMZ are also open to the public. Any thoughts? Thanks. ... View more

Hello all, I've been receiving these vulnerability alerts, ID 40031, for some time now between two servers, (DMZ to inside), using port 80 (SOAP) and the severity level is high, but I have the action set to "alert" which is the default. I truly do not know what account is trying to use this vulnerability. In the details report it shows the "destination user" since I have user-id enable on the inside zone. These are my questions: 1. Shoud I enable user-id on the DMZ zone so I can see the user account (if even possible) that is trying to access the internal server? 2. In the detailed report it shows the "destinaion user", what does this mean specifically? Thanks. ... View more