Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About Jafar_Hussain
About Jafar_Hussain
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
4 weeks ago
137Posts
4Likes
7Solutions
Aug 25, 2020Last Visited
User
Activity
User
Profile
Latest posts by Jafar_Hussain
| Subject | Views | Posted |
|---|---|---|
| 278 | 08-20-2020 03:48 AM | |
| 307 | 08-20-2020 12:54 AM | |
| 356 | 08-19-2020 01:19 PM | |
| 375 | 08-19-2020 12:57 PM | |
| 242 | 08-17-2020 11:53 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 | 04-23-2020 04:08 AM | |
| 1 | 04-04-2020 12:57 PM | |
| 1 | 10-29-2019 04:11 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 |
User Badges
Public Statistics
| Date Registered | 10-15-2019 11:13 AM |
| Date Last Visited | 4 weeks ago |
| Total Messages Posted | 137 |
| Total Likes Received | 4 |
08-20-2020
03:48 AM
@BPry I want to add one more point, i have analyzed the counter again and found the below value:- Number of ssl sessions can't be decrypted because of out of resources proxy_l2hdr_extended 13 1 info proxy pktpro apart from this 9 other SSL inbound policy is working perfectly.
... View more
08-20-2020
12:54 AM
@BPry I analyze the packet capture and found below:- 1 - Paloalto only support limited Elliptic curves which are received by server hello:- bu in this packet capture i am not able to find any Elliptic curve detail. Supported elliptic details are below:- P-192 (secp192r1) P-224 (secp224r1) P-256 (secp256r1) P-384 (secp384r1) P-521 (secp521r1) https://docs.paloaltonetworks.com/compatibility-matrix/supported-cipher-suites/cipher-suites-supported-in-pan-os-8-1/cipher-suites-supported-in-pan-os-8-1-decryption 2 - I have gone through the below documents and found the extension: extended_master_secret is same for client and server hello. https://smartnets.wordpress.com/2016/11/07/palo-alto-firewalls-unable-to-decrypt-ssl-inbound-traffic/ But i am not sure what is the reason i am getting decryption error intermittently.
... View more
- Tags:
- b
08-19-2020
01:19 PM
@BPry When i login in website page the decryption showing traffic is decrypted. after login once i click any functionality like transaction the traffic is showing decrypt-error. didn't apply any decryption profile, it is none.
... View more
08-19-2020
12:57 PM
Hi Team, I am facing the issue in SSL decryption intermittently. For the transaction website. traffic flow for the SSL inspection is:- Outside user ------> Paloalto--------->Load balancer-------->Application server. In the destination NAT translation, i have given the load balancer IP. Condition A with SSL inspection:- Once we apply SSL inspection we can see the application webpage is open properly but some time transfer page was showing blank. We tried to do transactions multiple times and it was successful sometimes and sometimes stuck on-page. Condition B without SSL inspection:- Everything is working fine. Troubleshooting:- Below is the counter value:- I just found this error in counter but not able to understand what is the exact issue. Could you please give me any sugesion in this.
... View more
08-17-2020
11:53 PM
@SutareMayur Thanks for the information. appreciate your response.
... View more
08-17-2020
10:47 AM
Hello, I am getting system alerts in my firewall below is the error:- Disabled applications in vsys1: cip-ethernet-ip-disable-io cip-ethernet-ip-disable-sfc cip-ethernet-ip-enable-io cip-ethernet-ip-enable-sfc cip-ethernet-ip-read-mod-write cip-ethernet-ip-read-tag cip-ethernet-ip-read-tag-frag cip-ethernet-ip-run cip-ethernet-ip-stop cip-ethernet-ip-test-mode cip-ethernet-ip-write-tag cip-ethernet-ip-write-tag-frag dingtalk-file-transfer jandi pfcp philips-ecg retrospect-backup siemens-s7-comm-plus-download siemens-s7-comm-plus-upload. NOTE: I have checked the all application are disable in Application DB. What kind of action I need to take or can I ignore this?
... View more
08-14-2020
11:13 PM
Hello Team, Is there any way to configure static IP for VPN(Global Protect) users. Example:- I have an IP pool - 192.168.1.0/24 User A, UserB, User C Authentication profile is (Active directory) When user A will connect through the external gateway for this user IP address should be assigned - 192.168.1.10 When user B will connect through the external gateway for this user IP address should be assigned - 192.168.1.50 When user C will connect through the external gateway for this user IP address should be assigned - 192.168.1.75 The rest of the users get random IPs. Please suggest.
... View more
08-04-2020
12:05 PM
@Chris_Johnston @MP18 Yes this is a new setup. i have gone through the documents and changed the service account with ssl/tls 636 port. My LDAP, UID, DNS service route changed via data plane interface I have tried everything but still, the issue is the same.
... View more
08-03-2020
05:19 AM
Hello, I have integrated the AD with Paloalto , it is working fine and i can see the IP user mapping is correct, once i tested authentication profile I got the below error:- Once i tested the authentication by local profile it is working fine. Can anyone help me on this to reolve this issue.
... View more
07-28-2020
12:07 PM
@MP18 I took the packet capture and found the SYN packet is going towards the server but didn't get any ACK from the server side. then TCP retransmission packet has been captured.
... View more
07-28-2020
10:44 AM
@MP18 Thanks for your reply, my concern is why the firewall deny traffic once i configure the security policy-1 and given the IP address in destination, however, once i created the object for the same IP address and allow in destination all are working fine. This issue is occurring only for one IP address rest are working fine. I am not able to find out the reason.
... View more
- Tags:
- mp
07-28-2020
03:00 AM
@OtakarKlier Yes , i have checked the same , once i applied policy-1 it will bypass all the policy and heat directly to deny any-any. And i can see the traffic is dropped.
... View more
07-27-2020
11:18 AM
I have one server belongs from the DMZ zone. Example:- server ip- 2.2.2.2 source ip for VPN user - 1.1.1.1 VPN zone DMZ zone There is 2 scenerio:- policy(1) - I have created a policy like:- sourcezone- VPNzone source ip - 1.1.1.1 destination zone - DMZ zone destination IP - Create an address object for 2.2.2.2. Application - ANY services - ANY Action - Allow no security profile. Policy(2):- sourcezone- VPNzone source ip - 1.1.1.1 destination zone - DMZ zone destination IP - 2.2.2.2 Application - ANY services - ANY Action - Allow no security profile. I can access 2.2.2.2 by policy(1) but when i apply policy(2) it is not accessible why this strange behaviour i am not able to find out. once i applied policy -2 the traffic has been dropped. PAN-OS version - 9.0.9-h1
... View more
07-27-2020
11:11 AM
@MP18 Thank you. Once i uncheck the verify server identity and delete previous PAN-OS version after that i can able to download software.
... View more
07-25-2020
11:08 AM
Resolution:- Once i create a object for that IP address and allow in security policy after that it is working fine. But i am not able to find the root cause of this issue.
... View more
07-24-2020
11:57 AM
@vsys_remoPlease find the answer below:- How did you check the connectivity between the mgmt interface and the internet?- I can able to ping google.com and 8.8.8.8 through management interface. Is the connection traversing another firewall where may be tls decryption is enabled? - No decryption policy is configured. Did this suddenly stop working or was it never working? - I think, the last content update downloaded before 8 months. Do you have a dns server configured?- Yes If there is another firewall or even the same make sure the traffic is allowed and either tls decryption disabled or then the checkbox at "check update server identity". - Checkbox is checked in verify server identity.
... View more
07-24-2020
11:09 AM
Hello, When i download the PAN-OS or content update getting below error:- Troubleshooting performed from my side:- I can see all the services are running via the management plane. I checked the connectivity between the management interface and the internet it was working fine. I checked the traceroute from the firewall towards the update server of Paloalto, it was working perfectly. Then I put ip address instead of the URL in the update server. But still, the issue persists. We tried to download the dynamic updates but the same issue is happening. In the last, we restarted the management server. Can Any one suggest on this what i need to check.
... View more
07-21-2020
01:24 PM
I have tried all the possibility but still is not working. Has anyone other solution for this.
... View more
- Tags:
- ekced
07-21-2020
12:07 PM
@vsys_remo I have scheduled at midnight it not yet update in my firewall. As well as when i check the threat id 354554856 in https://threatvault.paloaltonetworks.com I could not find any signature there.
... View more
07-21-2020
11:19 AM
@hisingh Hello, Palo alto has been released a new signature Virus/Win32.WGeneric.alpvzn Name: Virus/Win32.WGeneric.alpvzn Unique Threat ID: 354554856 Antivirus version -3414-3925 update date(19/7/20) We are getting Virus alerts in the Threat log for OneDriveSetup.exe. I waited for the next signature, today new version is update - 3414-3926 update date(20/7/20) but still an issue is the same. is that false positive? how can I stop this threat alert? I have checked this application is working fine. Thank you.!!!!!!!!
... View more
07-20-2020
01:42 PM
@BPry Thanks Got it.
... View more
07-20-2020
01:41 PM
@BPry Ok i will check this. One more point i want to add. i took the packet capture with working and non-working condition. I got a drop file from the GUI( I checked in Wireshark client is sending the SYN packet but after that didnt get any response from server side) .in the non-working condition at the same time i ran the counter but didn't get any drops in CLI. below are the counter logs. This behaviour i checked with policy(2). (active)> show counter global filter packet-filter yes delta yes Global counters: Elapsed time since last sampling: 25.181 seconds name value rate severity category aspect description -------------------------------------------------------------------------------- pkt_alloc 15 0 info packet resource Packets allocated pkt_inconsist 5 0 info packet pktproc Packet buffer pointer inconsistent flow_policy_deny 5 0 drop flow session Session setup: denied by policy flow_host_pkt_xmt 10 0 info flow mgmt Packets transmitted to control plane flow_host_vardata_rate_limit_ok 10 0 info flow mgmt Host vardata not sent: rate limit ok -------------------------------------------------------------------------------- Total counters shown: 5 -------------------------------------------------------------------------------- (active)> (active)> show counter global filter packet-filter yes delta yes severity drop Global counters: Elapsed time since last sampling: 14.115 seconds -------------------------------------------------------------------------------- Total counters shown: 0 -------------------------------------------------------------------------------- (active)> show counter global filter packet-filter yes delta yes severity drop Global counters: Elapsed time since last sampling: 3.963 seconds -------------------------------------------------------------------------------- Total counters shown: 0 --------------------------------------------------------------------------------
... View more
07-20-2020
01:28 PM
@BPry It, means i need to wait for a next Antivirus signature update?
... View more
07-20-2020
01:25 PM
@BPry Thanks for your reply. Sorry for that i don't have a screenshot right now, i have given the example of IP's. i want to give the specific IP's in the destination. i can not give destination address - ANY. Once i disable policy(1) it will bypass policy(2) and heat the deny policy which i have configured at last.
... View more
07-20-2020
01:03 PM
Hello, I have one server belongs from the DMZ zone. Example:- server ip- 2.2.2.2 source ip for VPN user - 1.1.1.1 VPN zone DMZ zone There is 2 scenerio:- policy(1) - I have created a policy like:- sourcezone- VPNzone source ip - 1.1.1.1 destination zone - DMZ zone destination IP - ANY. Application - ANY services - ANY Action - Allow no security profile. Policy(2):- sourcezone- VPNzone source ip - 1.1.1.1 destination zone - DMZ zone destination IP - 2.2.2.2 Application - ANY services - ANY Action - Allow no security profile. I can access 2.2.2.2 by policy(1) but when i apply policy(2) it is not accessible in the traffic logs it is showing drop and there is no session ID. PAN-OS version - 9.0.9-h1
... View more
07-20-2020
12:36 PM
@hisingh Hello, Palo alto has been released a new signature Virus/Win32.WGeneric.alpvzn Name: Virus/Win32.WGeneric.alpvzn Unique Threat ID: 354554856 We are getting Virus alerts in the Threat log for OneDriveSetup.exe. is that false positive? how can I stop this threat alert? I have checked this application is working fine. Thank you.!!!!!!!!
... View more
07-15-2020
10:31 AM
@OtakarKlier Thanks. i have found the pattern of the signature. ( / I n d e x . p hp ? i = and & t and HT T P/1 . 1 and Cont e n t -Type : a pp l i c a ti o n/ js on) In the custom signature which condition i need to follow "And" condition "OR" condition. and for the qualifier which information i need to add.
... View more
07-14-2020
03:59 AM
@OtakarKlier @BPry I got the instruction from the gov. i need to create a custom signature for Mortiagent. They have sent some files. In the files, there is some IOC's:- 1 - Host base indicator( Which is mentioned some MD5 and SHA values) 2 - Network base indicator( Which is mentioned in some IP address list). To create a custom signature which pattern and references i need to choose ? below is the snort rule:- alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:" MoriAgent Beacon HTTP Request"; content:"/Index.php?i="; depth:200; content:"&t="; within:64; content:"HTTP/1.1"; within:64; content:"Content-Type: application/json"; within:32; content:"Content-Length: 0"; within:90; threshold:type limit,track by_src,count 1,seconds 120; sid:1000001; rev:001;) - For the IP address, i need to create an EDL to block all the IP's? Thank you in advance.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
