LIVEcommunity - About CLIq

CLIq · ‎12-15-2020

sorry for digging out this years old threat but I have been trying to find some more detailled information on this but it seems some in depth insight of how this works is difficult to find... Of course shortly after posting this I found the technical answer: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/policy-based-forwarding/pbf/egress-path-and-symmetric-return.html So for anyone who is/was wondering how its actually done, its explained there... answered all my open questions 🙂

CLIq · ‎11-15-2020

@panguyen hope you read this at some point, the certificate the script imports to the firewall seems to not import the fullchain? at least clients are reporting errors about not trusting the certificate because of missing intermediate certificates / chain. now this doesnt pose issues under windows or even chrome or firefox but for some applications that check certificates as well or e.g. macosx this causes invalid certificate chain trust issues. am i doing something wrong or is the fullchain not imported?

CLIq · ‎10-16-2020

is a "bump" allowed? ^^

CLIq · ‎10-16-2020

from a wireshark capture, i can see that if for TLSv1.2 any other supported protocols are used, the palo sens a Server Hello with the first matching cipher and right after it sends a [RST, ACK] to the client which is originated only from the firewall, the server actually sends the certificate to the palo, so the issue seems to be between the palo and the client with PANOS 10.0.1 I should probably open a support case to look into this but I thought maybe someone has already looked into this 🙂

CLIq · ‎10-16-2020

@panguyen great work on the write-up and script! does your script import the complete certificate chain? if not by default, is there a way to do so? 🙂 by the way, the script has an issue when importing wildcard certificates, has something to do with the naming. workaround is to create the certificate as e.g. mydomain.com and add a SAN for *.mydomain.com one suggestion to the how to, would be cool to include a way without cloudflare (e.g. apache) and for both modes also mention which firewall rules need to be configured in which direction at a minimum (e.g. I used a custom url category to match the well-known acme-challenge URL for incoming traffic but only allowed the actual domain to be accessed from certain countries before i now also switched to dns_cf api)

CLIq · ‎10-14-2020

Hi, is there a way for globalprotect to only listen to a specific URL and forward all other FQDNs? I already have webservers behind the palo listening to specific SNIs and would like to keep it this way.

CLIq · ‎10-14-2020

There is nothing in the sslmgr.log and nothing but the General errors in the UI the only ciphers that seem to work with Palo decryption on TLSv1.2 and Chrome/Firefox are these two: AES256-GCM-SHA384:AES128-GCM-SHA256 all others error out even if those ciphers above are also available but not listed first (SSLHonorCipherOrder is set to off) but with these ciphers which are considered weak, i dont even get forward secrecy and therefore the rating is down to B... I wonder why the following ciphers dont work: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHCHA20-POLY1305-SHA256:CHACHA20-POLY1305-SHA256 or the ECDHE-ECDSA ones which are listed as supported but not shown in the decryption profile settings anyone have an idea or even just an idea how to troubleshoot this further?

CLIq · ‎10-12-2020

@Rene_Boehme or anyone know working ciphers for apache with TLSv1.2 and which ones work TLSv1.3?

CLIq · ‎10-10-2020

running PANOS 10.0.1, log only shows "General TLS protocol error" together with the ciphers that were used any specific debug or log i should show?

CLIq · ‎10-10-2020

I am trying to set up a TLSv1.3 AND a different TLSv1.2 webserver behind a palo firewall with ssl inbound decryption. However i seem to get a lot of ssl errors and the website does not work if specific ciphers are not listed first... For one I would like to understand why that is and even ciphers listed here have issues: https://docs.paloaltonetworks.com/compatibility-matrix/supported-cipher-suites/cipher-suites-supported-in-pan-os-10-0/cipher-suites-supported-in-pan-os-10-0-decryption.html#id11638f8b-8bc0-4189-800d-43f1567339b6 Basically, what should the apache config look like for the palo to be able to decrypt the traffic, yet still have the highest possible security as rated by https://www.ssllabs.com/ssltest/ ? I always seem to get either " This server does not support Forward Secrecy with the reference browsers. Grade capped to B." or "There is no support for secure renegotiation. Grade reduced to A-."

CLIq · ‎03-02-2020

as a further response... seems the panorama has not been designed for such a use-case as without a valid license you cannot even enter most of the configuration... was hoping that the licensing could be taken care of manually after the "automatic config restore"

CLIq · ‎02-08-2020

@reaper i dont need the gui but a network connection for this Thanks, I wanted to see if there was any possibility as I doubt the feature request will be taken into consideration as this is not meant for production... anyways, will try. Thanks

CLIq · ‎02-08-2020

@reaper Thanks but like I mentioned above, I need to do this without GUI and without network connections. I can script it and I have access to the hypervisor and console of the Panorama. so far the only option I see is to use the export as set commands (although i am not sure if a "show" will give you the complete panorama config as it does not if its in xml format) and then restore it the same way by entering those set commands... unfortunately the login prompt is **bleep**... so difficult to login with a script as you cannot know when the authdaemon is started. any comments anyone? better idea? confirm any part of my hypothesis?

CLIq · ‎02-08-2020

@reaper yes, that does not seem to show the complete configuration and cannot be used to restore panorama with a file. anyways it seems that panorama does not support something like bootstrapping... so basically I guess I am asking what the best way would be to automate backup and restore of panorama... i was thinking about using set commands but then there is the problem of not being able to detect when you are able to login... if I script it and it keeps saying invalid credentials... i cant differentiate that from actually not being able to login... has anyone even ever tried that and will the "show" with set commands actually restore the complete panorama configuration if entered on a "fresh" panorama?

CLIq · ‎02-07-2020

Thanks @jdelio but that doesnt help me unfortunately, seems more like its not possible although i dont understand why panorama does not have the same command to output the config in xml format...

Member Since	‎09-17-2019 05:25 AM
Date Last Visited
Posts	29
Total Likes Received	2

Re: When should I use "enforce symmetric return" in the PBF rules?

Re: LetsEncrypt integration

Re: SNI for GlobalProtect

Re: Inbound SSL decryption for apache2 server

Re: LetsEncrypt integration

Panorama: config output on CLI

Re: Machine-Learning -> FW does not appear under import devices and processing of traffic log fai

Re: When should I use "enforce symmetric return" in the PBF rules?

Re: LetsEncrypt integration

Re: SNI for GlobalProtect

Re: Inbound SSL decryption for apache2 server

Re: LetsEncrypt integration

SNI for GlobalProtect

Re: Inbound SSL decryption for apache2 server

Re: Inbound SSL decryption for apache2 server

Re: Inbound SSL decryption for apache2 server

Inbound SSL decryption for apache2 server

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Network Security

Cloud Security

Security Operations