About minow

minow · ‎12-10-2019

this is the same behavior that we have and we do not use cookie authentication. there is some kind of cookie that the GP using with the SAML.. probably Azure is signing the response for some period of time, and as long as the GP client store that signed cookie and if it valid it wont prompt with authentication.....

minow · ‎11-13-2019

hey, i have a requirement from a customer for some users to always have the same ip when they connect to the VPN for example if the IP Pool for the GP clients is: 192.168.x.110 where x will be 10-15 depends on which GP GW you are connected to. i have managed to configure using specific client settings for example for user A ip pool is 192.168.10.10-192.168.10.10 the problem with this is that the client use split tunnel, and if i follow this road i will need to configure all those access routes on each client settings meaning, for adding 1 network on my lan i will need to configure it on each GP GW and on each client settings can be reached up to 100 changes for 1 network subnet. i have seen the registry key for the reserved ip address but what happen if the user connect to the PA on another site in which this ip is not relevant. i have also seen the "retrieve framed ip address attribute from authentication server" but cannot find documentation on how it works. i think it might be a solution. clients authenticating with SAML with the GP GW, so if the framed ip will be list of addresses and each GP GW will choose the i according to the "authentication server ip pool" thanks

minow · ‎03-10-2019

found this article in the meantime: https://docs.paloaltonetworks.com/panorama/8-0/panorama-admin/set-up-panorama/set-up-authentication-using-custom-certificates

minow · ‎03-10-2019

Hey, can some one put some light on the authentication & authorization of the PA to Panoram ommunication channel? from what i know is that on panorama side we must have the SN for initial communication. what happens from the point that the PA first contact panorama ? what happens on regular basics on the communication between the PA and the panorama? i know that the traffic is encrypted but with what certiciate and private keys ? is there some kind of PKI infrastructure between the panorama and the PA for that communication? is there any Keys handshake between the Panorama and PA on their first contact? can i do certificate Pinning on the PA side to prevent man in the middle attack since most of my deployments the PA communicates with panorama throught the internet sine the S2S configuration is controlled from panorama? is there any kind of "client authentication" on the SSL channel? an engineer once told me that there is some kind of "default cetificate" that is used for this channel so: 1) is it comes with the installation? 2) all customers have the same certificate with the same keys? 3) is it generated uppon panorama installation? i will appriciate any information and data regarding this thanks

minow · ‎02-18-2019

hey is there any way that i can forward the logged on user as an HTTP header for example from the PA to the backend server when i use clientless vpn, this way i can achieve that the user wont need to be re-authnticate to the backend server thanks

minow · ‎10-07-2018

hey i have tried to configure the portal to have both the Certificate profle and the OTP authentication profile, but the client is not able to authetnciate with the portal. i have tried also to access the portal using my browser, i get the certificate pop-up but than i was expected to get the login page for the GP Portal but i get nothing.. it just keeps loading and loading. thanks

minow · ‎09-02-2018

ok , i shuld test it in my lab. questions raised from the new topology now we have the cookie for authenticating with the GP GW, lets say the cooki valid for 2 hours, this means that withing those 2 hours the user can connect freely to all of the GP GWs in my infrustructure withouth re-authenticating ? does within those 2 hours the user is beeing locked out in the AD, does the GP GW checks this when a user connect to it with a cookie ? do you think i can configure the infrastructure this way: 1) use GP Portal to authenticate with certificate 2) user GP GW to authenticate with Certificate and OTP will this bring the same functionality ? for the portal the user will just need to authenticate in some way but not in interactive way. for the gateway we will bring the two factor authentication as you suggested.

minow · ‎09-02-2018

i dont think this solve the problem. the problem is "binding" the username from the first authentication to the second authentication. what you suggested is just bringing the two authentication mechanisms to the GP Portal. thanks

minow · ‎09-02-2018

hey i am configuring two factor authentication, 1) portal with certificate 2) gateway with OTP i have noticed that i can authenticate to the portal with user "A" and than on the gateay i succesfully authenticated with the OTP of user B (username & password) the question is if we can enforce the authentication to teh gateway will be with the same username as we have authenticated to the portal ? if user A the laptop got stolen and for user B the phone with the OTP got stolen an attacker can gain access to the VPN thanks

minow · ‎08-30-2018

the basic reason for the "default ports" from my knowledge is for the use in the service column. basicly even though paloalto is a Layer7 fw.. it is still a layer4 fw so when you use the "application-defaults" in the service feild on the rulebase this is what it is based on.. this just makes you create a seperate rule for web-browsing on port 443 in the rulebase since you wouldnt want to put only port 80 and 443 on the rule that all your network traffic hit on.. this will make you configure each and every port an application uses on that rule. or create aditional rule for all those application that dont use ports 80 and 443. another beuti of the "application-defaults" is that it works as you ceates a seperate rule for each application with it's default ports. for example - application A with port 8080 - application B with port 443 if application B will use port 8080 it wont hit this rule..

minow · ‎08-30-2018

not sure this is the answer because once you are decrypted you reveal the real application.. and all the other application i have notcied in paloalto has port 443.. and even facebook has 80 & 443

minow · ‎08-30-2018

i have seen a tool for the mcafee web gateay that yo ca export parts of the configuration , and likst in HTML / XML format.. so it is a half way.. with somepowershell you can do it. but the locig they have for the policyit quite complex and i dont think it can replicated to the way PA works. i think the best aproach is to take the SSL Decryption destinations from the Mcafee and maybe some of the lists.. but you will have to seat with the customer and "re-design" the policy on the PA fw.

minow · ‎08-30-2018

Hey , i just wondered why in the era that all web traffic is moving forward beeing encrypted and browsers like chrome will soon mark websites that uses HTTP protocol as "unsage" paloalto "web-browsing" application still uses in it's default ports only tcp/80 port and not also tcp/443 port? thanks

minow · ‎08-07-2018

hey is there any plane to add migration of Web Proxy's policy such as McAfee Web Gateway, Symantec Web Proxy etc etc. thanks

minow · ‎06-27-2018

found the issue with the Trimed configuration it caused by a non english charachters. i think it will be a good choice to put some "Alert" on the import stage to identify if non supported charachters exist on the imported configuration. i have imported policy from 2 different source files and it looks like i have conflicts in the rule names with the base config. the "<entry name="Rule ID 2">" and a lot more exist twice on the security poilcy, one from the base config on the first migrated FW to the PA , and one is from the new config from the currently migrated FW thanks

minow · ‎06-27-2018

hey i was on 1.0.84 after the update i am now on version 1.0.94 the merge action complete and i get a non-empty file however the PA does not accept to load the xml file since it is malformed. when opening it on notepad++ it looks like the XML structure is bad, the file is not orgenized and the end is trimed in one of the rules in the security rulebae please advise thanks

minow · ‎06-26-2018

i have tried merge the configuration "part by part" it looks like i get empty only after i merge the Polices . all other are merge fine: 1) network 2) VR 3) Objects 4) Zones how can i figure out what is the issue ? thanks

minow · ‎06-26-2018

hey i am finishing the merge stage of the configuration and than download the generated files but they contains only the following lines the "set" file is empty the "xml" file has only those lines =========================== <?xml version="1.0"?> <?xml version="1.0"?> =========================== API commands generation also files. one time i have manage to see "error" on the progress bar but nothing informative. thanks

minow · ‎06-24-2018

how do i check that the Task Manager is UP ?

minow · ‎06-24-2018

inside the project i see no devices , and the "import device" button is "grayed out"

minow · ‎06-21-2018

hey i have warnings on some of the nat rules the warning is : "NAT RulseID[4] is using an address [192.168.152.50] that is not defined in my databse action: "adding to the DB" i have an object with this IP on the objects list how do i fix this warning? thanks

minow · ‎06-20-2018

hey i added a new pa820 device to the devices section and have added the credentials for the api then when i click on the "contents" tab "retrive contents" it states that is downloading but this state is not chaning to "downloaded" as in the admi guide. where can i see logs about it ? or fix it ? thanks

minow · ‎03-03-2018

is there any plan to release an API for private plugins?

minow · ‎03-01-2018

hey i am currenlty working on migrating SRX to PA the SRX have multiple interfaces.. and each has mulitpe subinterfaces. on the Pa i am going to use 2 AE interfaces that will have all the sub interfaces of the SRX. i cannot figure out how to to this travertion on the migration tool this is an example of how it looks inside the migration tool

minow · ‎01-17-2018

thanks... for now i use browser's F12 + getting the json reply and converting the answer using powershell $Folder = "D:\temp\" $InFilename="interfaces.txt" $OutFilename="interfaces.csv" $interfaces = Get-Content -Path "$Folder$InFilename" | ConvertFrom-Json $interfaces | Export-CSV "$Folder$OutFilename" -NoTypeInformation

minow · ‎01-10-2018

hey can we add an option on the guis to export the datagrid view to excel ? this can be helpful for the stage of the communication with the customer and documentation for example aproving network/routes/object list based on this output from the raw imported configuration.

minow · ‎11-24-2017

hey Panorama 8 inroduces Plugins. does any one have information about how to create tham? i will appriciate more information about it. thanks

minow · ‎11-20-2017

you should contact your local office for this Feature Requests. what was the error messeges you have seen on the PA??

minow · ‎10-07-2017

hey i am wonerng if there is any way to configure the GP clien through windows CMD. 1) username & password 2) GP Portal address

minow · ‎06-21-2017

thanks, i was able to solve it somehow. also the command i use for the cli was wrong , i needed the "registered ip" and not the "dynamic group"

Date Registered	‎04-05-2011 05:40 AM
Date Last Visited	2 weeks ago
Total Messages Posted	162
Total Likes Received	9

Online Status	Offline
Date Last Visited	2 weeks ago

Strata

Prisma

Cortex

About minow