This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About dromanelli
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About dromanelli
10-14-2022
16Posts
4Likes
0Solutions
Oct 14, 2022Last Visited
User
Activity
User
Profile
Latest posts by dromanelli
| Subject | Views | Posted |
|---|---|---|
| 1112 | 10-12-2022 10:42 AM | |
| 1186 | 10-12-2022 06:47 AM | |
| 1953 | 07-21-2021 02:13 PM | |
| 1469 | 01-27-2021 08:01 AM | |
| 3237 | 12-21-2020 08:22 AM | |
| 3265 | 12-21-2020 07:10 AM | |
| 3340 | 12-21-2020 06:25 AM | |
| 1365 | 12-10-2020 11:44 AM | |
| 2685 | 10-27-2020 11:02 AM | |
| 2724 | 10-27-2020 08:37 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-12-2022 10:42 AM | |
| 1 Like | 10-12-2022 06:47 AM | |
| 1 Like | 07-27-2020 07:51 AM | |
| 1 Like | 07-27-2020 10:09 AM |
User Badges
Community Statistics
| Member Since | 05-12-2020 05:47 AM |
| Date Last Visited | 10-14-2022 09:42 PM |
| Posts | 16 |
| Total Likes Received | 4 |
10-12-2022
10:42 AM
1 Kudo
Hi Jay,
So this cluster is in a colo facility. I had remote hands check the cable and they certified it was good, and also had them power cycle the backup unit. I can't perform another test for a few hours (business impact) so I will try again later and let you know how it looks post-reboot.
... View more
10-12-2022
06:47 AM
1 Kudo
Hi All,
Having a strange issue. I have a cluster of PA-850's in HA. Last night I failed over my active PA-850 to the standby 850. What happened is the backup 850 became active, and the inside and DMZ ports went green, but the outside port Eth1/1 stayed red. As such, services did not work, and I had to fail back to the primary. Has anyone ever seen this before and if so, what is the fix? I'm on 10.1.3, which is why I was failing over - trying to get onto the preferred 10.1 release.
... View more
07-21-2021
02:13 PM
Hey Guys, So Follow me on this scenario if you would: User on their corp PC behind the trusted interface of the Palo goes to their personal web-based email, opens a bad email, and downloads a file with macros in it. How do I stop that, because the stateful function of the firewall will auto-permit the return traffic (in this case, the macro file) from the internet back through the untrust interface of the firewall and back to the user. That's a problem, obviously. Is there a way to set exceptions to the stateful function? For example: "All traffic sourced from the inside is auto-permitted back through the firewall UNLESS, it contains a macro?"
... View more
- Tags:
- user blocking
01-27-2021
08:01 AM
Hi Guys, I am seeing a ton of "generic:<random-url>" hits in my threat logs under the spyware category for DNS queries from my email spam filter server out to the world. I have DNS security set up on the Palo so they are being sinkholed, but there are a ton of them, and several dozen different URL's. The spam filter uses a proprietary software so it's unlikely it is infected. I suspect the queries are being made from the URL's being placed in the emails themselves. Wondering if anyone has seen this or can explain? These can't all be malicious URL's my users are referencing in their emails can they? Here's a small example:
... View more
12-21-2020
08:22 AM
I'll have to check with the server team, but I believe we have a different certificate on every server, and our farm of servers is almost a full /24 worth of active machines, so it's just going to be a ton of overhead, not to mention getting the server guys to dedicate time to go through each server.
... View more
12-21-2020
07:10 AM
Thank you Tom. Can I just point to a trusted and valid certificate on the web from the list that appears in the Palo instead of pointing to the certs on my inside servers? Definitely can't have the users getting that Palo message or they will flood the help desk.
... View more
12-21-2020
06:25 AM
Hi All, I'm looking to subject ssl traffic to my security profiles, but to do this, I believe I am understanding that for inbound traffic from the outside, you need to import the same certificate and key from each of your protected servers on the inside network into the Palo Alto. Is that true? If so, why? I don't really understand why the Palo can't use any cert, including a self-generated one to decrypt traffic coming in from the outside, then subject it to the security profiles, and drop it if it's malicious. Why does it have to be the same cert the internal servers have?
... View more
12-10-2020
11:44 AM
Hi All, I am in the process of migrating from Lotus Notes to O365. The migration requires a ton of IP's being permitted from the outside inbound to my migration servers in my data centers. Rather than call all of those IP's, I am instead permitting any traffic from the outside inbound to these servers on application ms-office365. However, when I select that application in the security policy, it tells me there are other dependencies that it requires and it wants me to add those dependent applications to the rule (i.e. web-browsing, ssl). So here's my question: If I add those dependent applications, does that mean that ANY inbound source can hit my local migration servers on web-browsing and ssl, or is it somehow still restricted to ONLY ms-office365 sources?
... View more
10-27-2020
11:02 AM
That worked. Thank you so much.
... View more
10-27-2020
08:37 AM
Hi Raji, We are using PBF. So you're saying I would need to write in a rule for my client IP port 22 and 10443 and insert it into the PBR negates?
... View more
10-27-2020
07:23 AM
Hi All, I am running a PA-850 in my data center. All of our internet-destined traffic goes into a catchall VPN and goes off to a cloud security company called Zscaler for processing before it goes onto the internet. However, for the IP of my machine, I do not want TCP ports 22 and 10443 going to Zscaler. I want any TCP 22 or TCP 10443 traffic sourced from my IP to go out the direct internet circuit (on a translated IP, as you'll see below) and not go into any VPN. However, when I set the NAT statement in the Palo to accomplish that, it completely breaks my internet connectivity. The only way I can get it back is to either break out ALL traffic sourced from my PC (not just 22 and 10443), or remove the attempt to break out 22 and 10443 from the Zscaler VPN. Below are the rules. If I disable them, BAM!, internet is back. I don't understand why. Any help is appreciated.
... View more
07-27-2020
07:51 AM
1 Kudo
Thanks very much. When does your book come out by the way? I'd like to get a hard cover copy. Is that a good book for Palo beginners? I'm Cisco-seasoned but Palo Green.
... View more
07-27-2020
07:01 AM
I do, yes. See below: What I tried to do before posting was place the following, but it ended up breaking traffic, so I disabled it. After looking at your screenshot, I think I see why. I have the action set to Forward instead of no-pbf: So in theory, if I change that to no-pbf, this should accomplish what I need right?
... View more
07-27-2020
06:27 AM
Hi, Thanks for your reply. So I actually tried the PBF first before coming here and unfortunately that broke other traffic, so I reverted it. I am willing to look into the static routes. Below is my route table: So right now I just have a single outbound route to my ISP gateway out Ethernet1/1. The Zscaler tunnels are not explicitly called in my route table. It just takes the default route and gets dumped into the VPN. The interfaces for those are tunnel.1 (primary) and tunnel.2 (backup). Is there a way I can reconfigure these routes to add a Zscaler default route and a general internet default route?
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks