About RonaldGo

thanks for this tip...  i'll look into it and see where it leads... ... View more

We deployed PANOS 5.0.0 on a PA2020 recently and noticed that that the management CPU utilization suddenly spiked from a regular 10-15% to a regular 60-75% when the system is not being updated...   prior to 5.0.0, CPU utilization only spikes whenever there are updates to the definitions... hopefully, this won't become a problem...  - ron ... View more

hi well, "attack continues" as in the PA console shows that the attack keeps going on and the "action" shows "block-ip" for the next few hours until i notice it and block the connection at the router...   and each attempt does reach the server under attack. the strange thing is this is part of the vultnerabilities profile and it does work for blocking MS-RDP brute force attacks...  but not SMB and FTP brute force attacks...  ... View more

oops... you're right...  :smileyblush: but the problem still remains that the PA firewall appliance claims it has the "block ip" action for the type "vulnerability"; name "FTP:login brute force attempt"; from zone "untrust"; to zone "trust"; to port "21"; application "ftp"; severity "high", yet the attack continues on until i manually block the attacker's IP on the router itself (Cisco : deny ip host "attacker"...) whereas for MS-RDP brute-force attacks, when the console reports block-ip, the attack does actually stop for the next hour... rgds, ronald ... View more

hi Chris unfortunately, no joy at my side on this particular issue...  i can see that "block-ip" works for the MS-RDP brute force attack, but not for the FTP or SMB brute force attack... it's very strange... but my guess is that the "block ip" blocks only TCP and not not UDP... and that's why it does not properly stop the FTP or SMB attacks as these 2 have a UDP side to their protocol...  just a working theory...  so, it's probable that your vulnerability also has a UDP component to the attack and that's probably why your PA doesn't block it entirely... my only problem is that paloaltonetworks does not entertain "problem reports" directly from end-users like me and requires me to go through my vendor...  quite frustrating... good luck and hope you can get a solution... rgds, ronald ... View more

hi it does block ip for the other brute force attacks, but somehow for smb and ftp, it doesn't work... it shows that the action is "block ip"... but the attacks just continue on... ok, i'll request a support ticket and hope this can be resolved...  it's not a show-stopper...but it certainly is an irritation and a mystery... thanks! ronald ... View more

hi the block ip doesn't seem to work for ftp... what i've seen on my system is an ip doing brute force ftp login attempt and the "action" shows "block-ip"... but the attack continues on until i login to our router and block that ip on the router instead. just this morning, i had 56,000+ sessions of such brute force ftp login attempts from 3 ip addresses...  does the PA "block ip" only stop the tcp session?  I'm just guessing here, but it may be because ftp and smb are more udp based? thanks! ronald ... View more

hi it seems block-ip doesn't work for SMB or FTP attacks...  when PA detects the brute-force attack, it shows "block-ip" but the attacks continue almost endlessly until i block it on the router (before PA)... is there any workaround for this? thanks! ronald ... View more

thanks!  it seems to work well...  🙂 what i did was clone the "strict" policy and added the exceptions and set them to "block-ip" for 3600 (1 hour)...  i assume that the rest of the "strict" policy still applies but the exceptions would take over when they are met? i mean, like if the brute-force RDP is seen, it would block-ip instead of just "drop-all=packets"...  but if the PA2020 sees a remote stack overflow, it would still "drop-all-packets"... rgds, - ron ... View more

hi tettema where can i find the black-hole configuration?  or is it only from CLI?  I'm using the latest PAN-OS 4.1.0 on a PA2020...  and I get tons of brute-force attempts on various servers behind the PA2020...  oh, my PA2020 is running in transparent (vwire) mode.... thanks! - ron ... View more

hi, it's probably in "policy based routing" or rather "policy based forwarding"... ronald ... View more

hi Kelly thanks! I have defined and activated port 12 as an L3 port with a private ip address in the same subnet as one of our internal networks...  it's plugged into the LAN switch that the "trust" side of the vwire is on...  and this L3 interface (port 12) has been added to the virtual router allong with the tunnel interface...  i can't add any of the vwire or other interfaces into the vrouter though... i sshed into the PA and tried pinging any of the internal addresses and it doesn't work... but pinging external addresses work (which is connecting through the management ip's network) probably easier to illustrate my settings: routerA - 201.126.211.69/26 & 192.168.200.69/24 connected to vwireA on port1 of PA2020 routerB - 201.126.222.69/27 & 192.168.31.1/24 connected to vwireB on port3 of PA20202 routerC - dynamicDSL & 192.168.32.1/24 connected to vwireC on port5 of PA2020 LANSwitch - connected to ports 2,4,6,12 of PA2020 PA2020 port 12 - define L3 with ip 192.168.200.1/24 (and i want to add another internal ip address 192.168.33.247/24 for another internal subnet), assigned to default vr & L3 trust zone tunnel - no ip address assigned to default vr & L3 trust zone L3 trust zone - contains only eth12 & tunnel default vr - contains only eth 12 & tunnel and routes 0.0.0.0/0 to 192.168.200.1 rgds, - ron ... View more

hi i'm a bit lost here...  i can understand the need to ensure the next hop for traffic but i can't find out where in PANOS to set the rule/policy for L2 traffic our PA2020 is set in a very very liberal setting with 3 sets of vwires (1, 3, 5 are connected to routers to internet defined as 'unrust'; 2, 4, 6 are connected to internal switch defined as 'trust') and all traffic are allowed both ways with only the threat protection (anti-virus, anti-spyware and vulnerability protection) protecting the traffic... the next-hop router for the vpn would be on one of the vwires...  i'm guessing that i should define a route from port 12 (where i've defined vpn and connected to the internal switch) to the ingress (untrust)... is this in the virtual router?  but the two L2 zones don't have any ip addresses assigned... thanks in advance...  i know it's quite a confusing and probably a poor design... just trying to put some convvenient access mechanism into our network... - ron ... View more

hi... something very weird... my setup: PA2020 with 3 vwires (ports 1&2, 3&4, 5&6) connecting 3 routers (on ports 1, 3, and 5) to the network switch (on ports 2, 4, and 6) and management ip set with 1 internal ip. i activated 1 of the other spare ports and gave it 2 ip addresses for the vpn.  i can ping both addresses from the LAN but not from any of the routers...  and i can't ping from PA to the routers or any of the additional LAN except the subnet that the management ip is on... what could i be missing?  route? thanks! - ron ... View more