About Yasar2020

Dear Team,   Kindly share the Document for Fore scout NAC Integration with PaloAlto. ... View more

Dear Team,   I would appreciate if you could share the best practices for the following security profiles   1.Ensure a secure Vulnerability Protection Profile is applied to all security rules allowing traffic.   We are unable to enable this profile in some of the policies due to some dependencies. Please share scenarios in which we can skip this profile.   2.Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories, and threats   Due to some low and informational dependencies, we are unable to enable this profile in some of the Access Policies. Can you please let me know in which scenario we can skip this profile.   Thanks. ... View more

Dear Team,   I have enabled Zone Protection Profile for untrusted Network as below "1. Packet Based Attack Protection / Spoofed IP address disabled. Passed - Packet Based Attack Protection / Strict Source Routing enabled. Loose Source Routing enabled. Malformed enabled. Mismatched Overlapping TCP Segment disabled. Loose Source Routing Failed - Mismatched Overlapping TCP Segment"   "2. Packet Based Attack Protection > TCP/IP Drop. Set Spoofed IP address to be checked. Set Mismatched overlapping TCP segment to be checked. Under IP Option Drop, set Strict Source Routing, Loose Source Routing, and Malformed to all be checked" but facing connection drop while enabling this profile in Trusted Zone. In that case how can i enable Zone Protection profile in Trusted zone or Not needed. In this case shall i enable only below options as per the below KB Article   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVkCAK   "Some Packet Based Attack Protection recommendations on the other hand apply somewhat equally to all organizations. For example, “unknown” and “malformed” IP options are generally unwanted and can be dropped. Selecting the options to drop “mismatched overlapping TCP segments” and “remove TCP timestamp” can prevent certain evasive techniques from being successful through the firewall, and are also generally recommended for all customers. In addition, you can prevent address spoofing in security zones by enabling protection against “Spoofed IP addresses”. This will ensure only traffic with source addresses that match the firewall routing table will be permitted on ingress."     Please suggest.     ... View more

Hi Team,   I have below 2 tasks which needs to be closed from PaloAlto Level. Appreciate your quick response.   Task 1   "1.Configure SSL Forward Proxy for all traffic destined to the Internet" As per the Best Practices we have to enable ssl Decryption for Internet Traffic for that we have to push Certificate to Domain users but My case we have separate Proxy for http and HTTPs Traffic which is in DMZ Zone so we pushed only Proxy certificate to Clients. In that case Traffic going via Proxy. Kindly share the PA Recommendation whether i have to enable again for all clients with PA CA certificate or not. Kindly confirm how to fix this Task 1. Task 2   "Allow the firewall to forward decrypted content to WildFire. Note that SSL Forward-Proxy must also be enabled and configured for this setting to take effect on inside-to-outside traffic flows"   what will happen if i enable this option since i didn't enabled SSL decryption.   Kindly confirm how to fix this Task 2. ... View more

Hi Team, Palo Alto port mirroring will forward only a copy of encrypted traffic "https" after decrypting it or also can forward un-encrypted traffic "http" as well ... View more

Hi Team, How to fix mitigate  Log4j vulnerability in Palo Alto Firewall. Kindly share how can we check whether our product infected and how to overcome from this vulnerability. Thanks. ... View more

Dear Team,   Kindly share the Office 365 url or IP in order to configure the email server profile gateway.   2.Is it possible to generate report logs automatically to that email    3.What is the steps needs  to be follow in order to take PaloAlto backup Automatically     Thanks A.Yazar Arafath ... View more

Hi Team, I have below network Architecture Upstream Internet Firewalls PA 5050 Active/Standby Downstream Datacenter Deployment 5220 Active/Standby Now We have 2 VYS in DC 1 is Normal 2nd DMZ Vsys. Now i have to remove DMZ vsys to ISP can some guide how to remove vsys from datacenter 5220 to ISP 5050. ISP-PA5050-connected 5k DMZ and connected 9k for internal DC 5220 coonected 5k dmz and connected 9k as upstream and and 7k down for inside Now vwire configured from DMZ 5k to DC 5220 2 cables 2 cables connected to 9k as vwire out of 2 ports 1 is vlan 4 and another vlan 10.Here Vlan 10 is layer3 and Vlan 4 is layer2 vlan. Appreciate quick response ... View more