About amansour

amansour · ‎02-20-2014

You can't do a client side detection in the browser as to whether or not they have it installed on that page. The way I would do this, is to have a download page which is separate, internally accessible and then you could add a HIP check (if you have that license) which says if you already have the client, put up a block page. Again, the links to the GP clients on the portal page are all you get, so having an internal page, maybe even one with LDAP auth is pretty easy to make, then on the hosted server you could allow/deny rules with the HIP check or have multi-language or whatever you want. Make sense?

amansour · ‎08-23-2013

The drop down list is populated from the LDAP server configuration. The User-ID Agent just builds the user to IP mapping. As for the drop-down list showing names, it should auto-populate with usernames even if you haven't explicitly included groups. However if you want to use Groups in policy you need to include them. If the names aren't showing up it's either the browser or the LDAP connection but the drop-down list should show usernames without groups.

amansour · ‎08-13-2013

Yeah, pretty slick answer.

amansour · ‎04-19-2013

Hey All I have the Symantec DLP 11.6 deployed with PAN in a few places. For the integration Symantec uses PCAP (SPAN or Mirror Ports to do network detection and the response is to markup the messages (ICAP and X-Forward for Web and Email) What we recommend is creating a FlexReponse (Symantec Specific) which makes an XML call can take a quick action on the user (so far this isn't fast enough to stop because we don't have a way to instantly send the user a block page or at least haven't found it). @jmahoney I think we should put a thread together like the SIEM one with a point person assigned for each DLP platform. Just like ArcSight and RSA and others put their SIEM integration and docs on the forum there should be an integration for each documented here. For Symantec Email Prevent there is no integration required, for Web Prevent this ICAP integration will likely need to be supplemented with a better FlexResponse. As for the others, without ICAP we'd need a way to call the XML quickly to do something, (Block URL is the most common). But without doing a commit. Anyway happy to work on this with you guys on it we are a CPSP and ASC and Go to Partner with Symantec DLP at least.

amansour · ‎04-18-2013

@mikand, they should have probably labelled it forward instead of proxy. SSL and SSH also misleading but proxy in our DLP case means re-write. It terminates the session and re-establishes it which can work for protocols like http, https, ftp but not all applications. Those proxy features forward traffic they don't re-write it. I think It's also why the GlobalProtect portal is only somewhere you can download the agent and not put links or content that is re-written to the internal segments like other SSL-VPNs. Also Nice Pantopia score

amansour · ‎04-18-2013

Oh yeah and for anyone wondering. PBF doesn't do it. It send routes out an egress, ICAP is different than routing in the DLP world because the DLP can mark up ICAP like it cal SPAM X-FORWARD messages. PBF Doesn't allow this so unless your DLP tool (Websense has a few articles on this) can do that then you're out of luck.

amansour · ‎04-18-2013

@jmahoney I think this will never make the roadmap. ICAP and WCCP are forwarding for proxies (HTTP/HTTPS/FTP) that's the problem. PAN does all protocols all the time, they can't proxy, there not a proxy, the developers likely cannot make this happen. I think network based DLP better get more protocols to stay relevant on the wire which is why ICAP is no good. What I do is instead you should look at a re-generator TAP. Then tools which need to see all the traffic to do their job can have multiple copies (DLP is a great example, RSA Netwitness and other recorders like Niksun too). Then everyone gets a copy and is happy. With respect to blocking (the ICAP forward) the DLP integration would likely have to create a flexible response (Symantec DLP does this) where you could send something to the XML API, like you could with a proxy filter (Websense) or MTA and SPAM filter. Each response is going to be specific to the type of block and in the PAN case I think that's an XML-API call. Anyway my two cents. Have the DLP bend the response because proxy is dead and they will be too if THEY don't adapt.

amansour · ‎03-19-2013

What PAN HW PA500? I still have almost 100% MGMT CPU, has anyone done an inline upgrade to the RAM for this?

amansour · ‎03-18-2013

Hey, I think I'm pretty close to a solution but I'm running into a problem. What I did was put a specific rule for Youtube the application. URL custom category for youtube.com to block. Then I have an allow list which takes each tokent (you tube .com /&blah education). On the response page I have an automatic redirect which takes the <url /> Field and appends the education component to it. The problem is it recursively redirects.

amansour · ‎03-11-2013

Can anyone name one or point to an old article of when this was supported? I remember an article with the Cisco VPN Client configuration being used.

amansour · ‎03-07-2013

asdf

amansour · ‎03-07-2013

It's still stateful, you'll need to either allow all VLANs to make it transparent (agnostic) or individual ones. All the firewall is always stateful if you put it inline it will still drop out of window or out of sync packets (asymmetric routing).

amansour · ‎03-07-2013

Is that a star trek reference.

amansour · ‎03-07-2013

Official product EOL and EOS dates are these posted somewhere?

amansour · ‎03-07-2013

How do we lookup the current list of desired features? And or add to it.

amansour · ‎03-07-2013

When is the official release date for 5.0.3?

amansour · ‎03-07-2013

I hear it's out next week.

amansour · ‎03-07-2013

Hey I guess my question is what is the highest measurement? Volume? Severity? Frequency? Are multiples ever shown ? The link to the ACC shows the country and apps with the threat at the bottom, even when the number shows 2 there's always one threat displayed in ACC.

amansour · ‎03-07-2013

Is there a way to send the same syslog messages to two syslog servers at the same time ?

amansour · ‎03-07-2013

Do you know if there is a way to throttle the syslog from the device. Most are licensed on an EPS scale which means throttling could help keep the volume down.

amansour · ‎03-07-2013

Should be the same as 4.1 with the fields a little different. Also you can include the groups from your RADIUS in 5.0.2

amansour · ‎03-07-2013

Wait is your avatar the one from Half-Life ?

amansour · ‎03-07-2013

You should keep the versions the same. Mutli-domain can be done with the on-box agent. As long as the polling user is the same in both directories .

amansour · ‎03-07-2013

Yes it does. You will need to check the User-to-IP mapping on the CLI to see if the users are being mapped correctly. In some cases leaving include groups and the domain on the user identification setting off don't. Just having it selected in the policy won't work.

amansour · ‎03-07-2013

Thanks, there is an application and the services are ports for TCP/UDP. I left the application as any though.

amansour · ‎03-07-2013

Thanks HITSEC.

amansour · ‎03-07-2013

Thanks is it fixed in 5.0.3? Do you mean the RAM ugprade?

amansour · ‎03-07-2013

Hi All; Just double checking if the service set to TCP and UDP would cover the Cisco "IP" on rule conversions.

amansour · ‎03-07-2013

from the community is a quick walkthrough PDF (assume you have this). Examples on DevCenter (not the community) I pulled an Excel Spreadsheet that makes calls through Macros as an example. Nice Walkthrough video technote: https://live.paloaltonetworks.com/docs/DOC-1583 You’ll find it pretty awesome in terms of correlation outside of ACC. Hope that helps, any questions reach out. Cheers;

amansour · ‎03-07-2013

CP Works fine for me on 5.0.2 I changed dp0 for other suggestions with this release and even the debugging crashed the device. We really should stop recommending it, reboot fixed it but debugging the dataplane for a packet capture on dp0 is a great way to down the box.

Date Registered	‎03-14-2011 10:29 AM
Date Last Visited	‎05-03-2019 10:45 AM
Total Messages Posted	105
Total Likes Received	8

Online Status	Offline
Date Last Visited	‎05-03-2019 10:45 AM

Strata

Prisma

Cortex

About amansour