About mcocat

mcocat · ‎03-02-2015

Not exactly. I'd prefer not to VPN at all. For example, I'd like to create a rule that allowed ANY source from the outside to my internal server on port 80, but only for certain users. I know I can create a rule and specify users, but an iphone that doesn't VPN in won't provide user-id matches to the PAN. After doing some research I believe this is an impossible task, but if anyone has some ideas I'd be interested in hearing them.

mcocat · ‎03-02-2015

Our techs often interface with Zenoss, and we have a mobile app that will let us view and interact with the alarms. The problem is we need to establish VPN access first. I also don't want to open the port for the world, and I can't allow a specific ip/range because they will be connecting from various mobile carriers. I'd like to specify an allowed user as part of the rule, but how can I ensure that mobile device will be allowed via user? Can I create a rule for certificate based authentication? Any other ideas?

mcocat · ‎02-27-2015

I don't want to grant more access than is currently available though. I want to see the true picture of what is open from the outside. I just want to bypass the scan threat that is being blocked. the threat id is 8001, not the port I am trying to access.

mcocat · ‎02-27-2015

I am looking to allow a single host on the outside to run an NMAP port scan. What can I do to allow this host to get an accurate picture from the outside without giving additional access that may skew the results? In addition I would need it to bypass vulnerability protection (TCP Scan 8001). Looking at my scan attempts I see the application type come back as Traceroute, non-applicable, lpd, dns, icmp and ssh. I am open to ideas, thank you!

mcocat · ‎02-25-2015

I feel like an idiot, but how do I sort the columns in my monitor tab? The used to be sorted by generate time, but that doesn't seem to be the case anymore.

mcocat · ‎02-13-2015

I found the issue here and the problem is now resolved. Hopefully this helps someone else if they have the same issue. GlobalProtect Gateway Certificate Error When Trying to Use GlobalProtect Agent 2.1.0

mcocat · ‎02-13-2015

Within the past couple of days I am starting to get reports from users that while trying to sign in with GlobalProtect they are receiving the following error: Gateway X.X.X.X: Server certificate verification failed No changes have been made on the PA. Any suggestions for places to start looking?

mcocat · ‎11-19-2014

That makes sense, I have a commit running now. So the fact that I was receiving alerts for the entries that didn't match a rule would mean that my default isn't configured correctly to use P-Panorama. Where can I change the default? Thanks for your help!

mcocat · ‎11-19-2014

So for my P_User Rule -Apps Allowed rule, I already have log forwarding enabled. And here is my log forwarding settings:

mcocat · ‎11-19-2014

I have enabled SNMP notifications on threats greater than or equal to severity "medium". Under monitor > threats I am seeing my alerts, but I only receive (via SNMP) some of the threats that shows up on the PA interface. Here is an example: I am only receiving SNMP alarms on the "SCAN: Host Sweeps", but not the spyware or the virus. Is this because of the rule being hit? How can I enable notifications on all of the rules?

mcocat · ‎11-18-2014

I was reviewing the following article but it didn't explain wat I am trying to do: How to Receive Email Threat Notification from the firewall I am looking to have an email notification sent out when a specific thread ID is encountered. Is this possible? It seems to me that I can only notify on medium, high, critical, etc...

mcocat · ‎10-22-2014

Wow, thank you all for the help with this. I will review the guides and advice and get this completed. I appreciate all of the help!

mcocat · ‎10-22-2014

I am looking to what I would call port address translation, but am unfamiliar with how to do it on the PA. Basically I need a public IP to route SNMP traffic to one inside address, and syslog traffic to another inside address. This will also only apply to a single host from the outside. Can someone give me high level steps to what I need to configure?

mcocat · ‎11-18-2013

I laid down a new copy of the script and it appears to be working now! I may have altered the script somewhere in my troubleshooting. Ultimately the problem was with the DHCP tools. Also, I tried setting the agent to "0" and that failed. Once I set it back to "1" it worked. It looks like "0" is for agent less and "1" is for agent-based. Thanks for the help on this!

mcocat · ‎11-18-2013

Thank you for the help. I realized my first mistake when I tried to run "nets DHCP" manually (from the server) - Since I didn't have a DHCP role or RSAT tools installed I didn't have the necessary helper DLL to run the command. I've since installed the tools and now I can run nets DHCP, and I see my MAC in the list. I added the "echo" line to my script and manually ran the script with my MAC, but I never did get an echo to the screen. Here is my latest debug after making the change. Any other suggestions? =================================================================================================================================== UID Script triggered at 11/18/2013 8:20:42 AM Capturing arguments... Script executed with arguments: "testuser" 94-94-26-E4-CD-CA Loading Exclusions... Exclusions loaded successfully DHCP Lease query for Windows Event User: testuser Calling Station ID: 94-94-26-E4-CD-CA Querying DHCP Servers: 192.168.1.66 Not machine auth event DHCP Server: dc.nscorp.local Defining scopes: 10.2.86.0 192.168.1.0 192.168.10.0 192.168.20.0 192.168.21.0 192.168.22.0 192.168.30.0 192.168.31.0 192.168.32.0 192.168.33.0 192.168.34.0 192.168.35.0 192.168.36.0 192.168.37.0 192.168.38.0 192.168.40.0 192.168.51.0 192.168.52.0 Searching DHCP leases for 949426e4cdca SCOPE: 10.2.86.0 SCOPE: 192.168.1.0 SCOPE: 192.168.10.0 SCOPE: 192.168.20.0 SCOPE: 192.168.21.0 SCOPE: 192.168.22.0 SCOPE: 192.168.30.0 SCOPE: 192.168.31.0 SCOPE: 192.168.32.0 SCOPE: 192.168.33.0 SCOPE: 192.168.34.0 SCOPE: 192.168.35.0 SCOPE: 192.168.36.0 SCOPE: 192.168.37.0 SCOPE: 192.168.38.0 SCOPE: 192.168.40.0 SCOPE: 192.168.51.0 SCOPE: 192.168.52.0 UID Script finished execution at 11/18/2013 8:21:11 AM Run-time: 29 seconds ===================================================================================================================================

Member Since	‎03-11-2013 12:55 PM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	18
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About mcocat

Re: Allow mobile phone access by userid, is this possible?

Allow mobile phone access by userid, is this possible?

Re: Allow remote host to port scan

Allow remote host to port scan

Sort columns in Monitor tab?

Re: User-ID agent, 802.1x and Windows 2008 NPS - help needed!

Re: Allow mobile phone access by userid, is this possible?

Allow mobile phone access by userid, is this possible?

Re: Allow remote host to port scan

Allow remote host to port scan

Sort columns in Monitor tab?

Re: Server Certificate Verification Failed

Server Certificate Verification Failed

Re: SNMP notifications - some missing?

Re: SNMP notifications - some missing?

SNMP notifications - some missing?

Email notification based on threat ID?

Re: Basic noobie question.

Basic noobie question.

Re: User-ID agent, 802.1x and Windows 2008 NPS - help needed!

Re: User-ID agent, 802.1x and Windows 2008 NPS - help needed!

Network Security

Cloud Security

Security Operations

About mcocat