About Josh990

Josh990 · ‎01-28-2022

Thanks for the responses all. I still believe PAN-OS should support blocking specific TLDs in a simple way; this seems like a fool proof way to greatly reduce the attack surface since we never need to visit sites using these TLDs for legitimate reasons.

Josh990 · ‎01-17-2022

Worked it out, the test pages default to http (80). Whereas the successful entries were using https (443). Therefore as expected, when not decrypted only the SNI/CN can be enforced upon. 🙂

Josh990 · ‎01-17-2022

Hi All, I noticed that the Palo Alto test pages for 'newly-registered-domains' and 'command-and-control' do not block when copied from a chat window or manually entered into a web browser. However when I directly click the link on the Palo Alto test pages for 'newly-registered-domains' and 'command-and-control' they do block. This does not appear to apply to the other categories I have tested thus far. All I had a look at the URL Filtering logs on the firewall and noticed that the mentioned allowed instances of 'newly-registered-domains' and 'command-and-control' only show as 'urlfiltering.paloaltonetworks.com/' (therefore 'low-risk' as the Category) so it's failed to identify the webpage correctly. None of these test pages are decrypted, based on the domain being 'paloaltonetworks.com' but this variable has been eliminated since some of the test pages work as expected. Please can someone else test this? Cheers

Josh990 · ‎12-09-2021

Hi All, I want to start blocking 'high risk' top level domains within PAN-OS. Has anyone else done this successfully? I presume the following should work based on PAN-OS RegEX: URL Category: *.eg/ *.ex/ etc.... Set URL Category to 'Block' within existing URL Filtering Profile. Cheers

Josh990 · ‎11-16-2021

Hi All, I'm curious to know how many of you have implemented the URL Filtering best practise, Content-ID - 'Hold client request for category lookup' feature? This feature is of particular interest to me because without this feature, the logs of other systems can be skewed if the session is initially permitted. What is the recommended setting for 'Category lookup timeout (sec)'? I presume if category resolution took >4 seconds something major must have gone wrong. Regards, Josh

Josh990 · ‎06-18-2021

Thanks @MickBall , this worked - I forgot to mark as the solution!

Josh990 · ‎06-18-2021

Yes, tested multiple times now with the above result. As soon as the service is stopped, traffic flows directly out of the local interface (even though enforce is enabled).

Josh990 · ‎06-17-2021

Hi All, I understand that this is a Microsoft related matter however I'm interested to see if anyone else has come across this issue. With Global Protect Network Enforcement in place (through the Portal Config), it is still possible for local admins to end the 'GlobalProtect service' (PanGPS.exe) Windows Task and bypass the connection enforcement control. The obvious solution here is to lock down the Private and Public Windows Firewall - I'm just curious if anyone else has come across this issue. Thanks!

Josh990 · ‎05-06-2021

Thank you - it was Microsoft all along 🙂

Josh990 · ‎04-30-2021

Hi there, I'm trying to get the seconds counter to show in NGFW Threat Monitoring CSV log exports. Currently, despite the seconds counter being displayed in the logs on the NGFW, these are not recorded in CSV exports of the logs - only the hour and minute counter is recorded. Is there an option to enable this somewhere? I can't seem to find it. Thanks

Josh990 · ‎03-10-2021

Hi All, I'm trying to forward Firewall Traffic & Threat logs (sent to Panorama by managed Firewalls using a Log Forwarding Profile set on Security Policy Rules) using a SYSLOG Server Profile configured under 'Panorama -> Server Profiles -> SYSLOG'. My thinking is that sending all logs through Panorama will be easier to manage however I cannot select the SYSLOG Server Profile created within 'Panorama -> Server Profiles -> SYSLOG.' when I create a new shared Log Forwarding Profile. Any help would be appreciated, I have read over the documentation and it references 'Device -> Server Profiles' so I assume it has to be done using a Template - therefore each Firewall send the logs to SYSLOG using the SYSLOG Server Profile, and Panorama just manages the profile under a Template.

Josh990 · ‎02-05-2021

Works fine now since upgrading to 5.2.4. Cheers

Josh990 · ‎01-29-2021

Ok, that makes sense. I'll deploy a later compatible version and test again. Thanks

Josh990 · ‎01-29-2021

Ah I think that might be the issue then, so despite the option being present in PAN-OS on the GP Portal, it won't work whatsoever for versions of Global Protect older than 5.2?

Josh990 · ‎01-28-2021

I think it's also available and working in earlier versions too - although in very old versions (e.g. <5) it doesn't work properly.

Member Since	‎03-26-2020 08:37 AM
Date Last Visited
Posts	19
Total Likes Received	2

About Josh990

Re: Block High Risk TLDs

Re: Palo Alto Test Pages - Inconsistent Results

Palo Alto Test Pages - Inconsistent Results

Block High Risk TLDs

Content-ID - Hold Client Request

Re: Palo Alto Test Pages - Inconsistent Results

Re: Panorama SYSLOG Forwarding

Re: Palo Alto Test Pages - Inconsistent Results

Re: Block High Risk TLDs

Re: Block High Risk TLDs

Re: Global Protect Enforcement Bypass

Re: Global Protect Enforcement Bypass

Re: Block High Risk TLDs

Re: Palo Alto Test Pages - Inconsistent Results

Palo Alto Test Pages - Inconsistent Results

Block High Risk TLDs

Content-ID - Hold Client Request

Re: Panorama SYSLOG Forwarding

Re: Global Protect Enforcement Bypass

Global Protect Enforcement Bypass

Re: NGFW CSV Export Question

NGFW CSV Export Question

Panorama SYSLOG Forwarding

Re: Enforcing Global Protect Connection Issue

Re: Enforcing Global Protect Connection Issue

Re: Enforcing Global Protect Connection Issue

Re: Enforcing Global Protect Connection Issue

Network Security

Cloud Security

Security Operations

About Josh990