About blacksan

blacksan · ‎07-30-2011

I notice that there is no example or detail descriptions for configuration of SNMPv3. Here is my configuration which works but I never got the include/exclude mask to work. If someone else have an example or recommendations please upload. set deviceconfig system snmp-setting access-setting version v3 views <snmpview> view <snmpview-oid> oid <OID like 1.3.6.1.2> set deviceconfig system snmp-setting access-setting version v3 views <snmpview> view <snmpview-oid> option include set deviceconfig system snmp-setting access-setting version v3 users <snmpuser> authpwd <password> set deviceconfig system snmp-setting access-setting version v3 users <snmpuser> privpwd <password> set deviceconfig system snmp-setting access-setting version v3 users <snmpuser> view <snmpview> set shared log-settings snmptrap snmp-traps version v3 snmpserver local manager <SNMP Server like 192.168.1.1> set shared log-settings snmptrap snmp-traps version v3 snmpserver local engineid <EngID like 0x01020304050607> set shared log-settings snmptrap snmp-traps version v3 snmpserver local authpwd <password> set shared log-settings snmptrap snmp-traps version v3 snmpserver local privpwd <password> set shared log-settings snmptrap snmp-traps version v3 snmpserver local <snmpuser>

blacksan · ‎07-18-2011

Use plug-ins to test the website like HTTPWatch or Fiddler to verify that the URL/ACL matches what is needed for the website. When I go to: https://www.stockbrokers.barclays.co.uk/idv/Login1.asp?category=&usecase=login&popup=& I see these websites as part of the Main page "Get Request": https://rd.clickshift.com/js/convert.js https://switch.atdmt.com/action/0w1sto_BARXlogin_1 https://barclays.touchclarity.com/c?siteID=406&ts=1311003466750&ccID=BST_Login_RHS_Top&log=no&location=https%3A%2F%2Fwww.stockbrokers.barclays.co.uk%2Fidv%2FLogin1.asp%3Fcategory%3D%26usecase%3Dlogin%26popup%3D%26&tagv=5.3&tz=-240&r=empty&title=Barclays%20Stockbrokers&cd=32&ah=870&aw=1440&sh=900&sw=1440&pd=undefined https://statse.webtrendslive.com/dcsiiriph10000golxgl12j01_5y5u/wtid.js https://statse.webtrendslive.com/dcsiiriph10000golxgl12j01_5y5u/dcs.gif?&dcsdat=1311003469046&dcssip=www.stockbrokers.barclays.co.uk&dcsuri=/idv/Login1.asp&dcsqry=%3Fcategory=%26usecase=login%26popup=%26&WT.co_f=71.22.216.247-1568811280.30164320&WT.vtid=71.22.216.247-1568811280.30164320&WT.vtvs=1311003471421&WT.vt_f_tlv=0&WT.sp=BarclaysStockbrokers&WT.tz=-4&WT.bh=11&WT.ul=en-us&WT.cd=32&WT.sr=1440x900&WT.jo=Yes&WT.ti=Barclays%20Stockbrokers&WT.js=Yes&WT.jv=1.3&WT.ct=lan&WT.hp=0&WT.bs=1419x100&WT.fv=10.0&WT.slv=Unknown&WT.tv=8.6.2&WT.dl=0&WT.ssl=1&WT.es=www.stockbrokers.barclays.co.uk/idv/Login1.asp&WT.vt_f_tlh=0&WT.vt_f_d=1&WT.vt_f_s=1&WT.vt_f_a=1&WT.vt_f=1

blacksan · ‎03-29-2011

Need to create a rule above the PBF for the Security Appliance to avoid the loop. Source Zone / I.f.: ethernet 1/3 Source Address: 10.2.43.20 Source User: any Destination Address: any Application: any Service: any Action: no-PBF

blacksan · ‎01-26-2011

if you like XML format, then use the Checkpoint Config Wizard (CPConfigWiz). This will take your SmartCenter config and make a XML version. Now the data (Objects, FW Rules, NAT Rules) are easy to move around. Just remember to create NAT rules in the PA for all of the objects with Automatic NAT in the Checkpoint. You can grab the Config Wizard from support.checkpoint.com

blacksan · ‎01-20-2011

Setup a Capture Portal with Authenticates against Cisco ACS for those users. Then create a rule which allows those users (once Authenticated) to access the systems via telnet. The only requirement is that the users must go somewhere via Internet Browser to validate themselves. or use the SSL VPN function and encrypt that telnet traffic

blacksan · ‎12-21-2010

If you are trying to sync all three Authentication section to the same User ID/PW (Admin, SSLVPN, Capture Portal) plus the User-ID Agent for the Policy then you will need to use a external database like Active Directory. So here are the steps if using the PAN-Agent. #1 - Install / Configure the PAN-Agent - This will give you the ability to select user and group in this format: DOMAIN\USER. #2 - Configure a LDAP Profile - Make sure you fill in the "Domain" section to match the "DOMAIN" -- this will only work if you have only a simple single domain structure. #3 - Create a Authentication Profile for Admins - Select the users which will be allowed to log into the PA #4 - Create a Authentication Profile for SSL VPN - Select the users / groups which can log into the SSL VPN #5 - Create a Authentication Profile for Capture Portal - I find it easy to choise "All" for users #6 - Creat a Administrator which matches the Domain Account so you can assign a Admin role it that user #7 - Edit Device / Setup and add the Authentication Profile for Administrators #8 - Create a SSL VPN and policy #9 - Create a Portal Capture Rule #10 - Commit and test.

blacksan · ‎11-11-2010

Not a big fan of this because it shows your real IP Address on the Internet but you can turn on X-Forward Header on the ISA Server and PA-500. ISA does not perform this function without a plug-in from Winfrasoft or Trustlist. You will need to CLI into the PA-500 and perform the following: set deviceconfig setting ctd x-forwarded-for yes Just make sure the ISA is sending the X-Forward in the correct format: X-Forwarded-For: client1, proxy1, proxy2

blacksan · ‎09-22-2010

You are not alone. Most Companies are waiting for a secured way of accessing the Corp Net. Apple decided to stay old school by using PPTP and only Cisco IPSEC. F5 Firepass - Nope Juniper SA - Beta Testing Foritnet Fortigate - via PPTP, the App only supports web portal Cisco ASA - via IPSEC and soon SSL VPN Citrix SSL VPN - App supports Citrix XenApp. Microsoft - via PPTP Checkpoint - R71 (Mobile Blade) / Early Release OpenVPN - JailBreak version only Nortel Contivity - PPTP NetMotion - Nope

blacksan · ‎09-21-2010

The Admin, SSL VPN and Capture Portal uses the same Authentication Profile (LDAP/RADIUS) instead of the Pan-Agent LDAP (Novell/Active Directory) Follow the same directions on how to setup LDAP profile for Capture profile or SSL VPN. The biggest issue I had with the LDAP profile with that it does not work with Pan-Agent user structure (Domain\User) like the RADIUS profile. So you will need to manually add user accounts instead of using Pan-agent setup. .

blacksan · ‎09-20-2010

make sure you are running PA 3.1+ to see the Policy Base Forwarding. (PBF) which is a simply version of Policy Base Routing (PBR).

blacksan · ‎09-16-2010

Here is the full package you can copy / paste for CLI then make modifications in the Web Console. I am not a fan on add App-ID when I do the migration but it is not that hard if you know the protocol. Since I don't know if "mail service" is only SMTP or the full array of mail protocols, I am including all services. I don't know if your NetScreen includes an Outbound rule for your mail server. set service POP3-Service protocol tcp 110 set service SSL-POP3-Service protocol tcp 995 set service SMTP-Service protocol tcp 25 set service SSMTP-Service protocol tcp 465 set service IMAP-Service protocol tcp 143 set service IMAP4-SSL-Service protocol tcp 585 set service IMAPS-Service protocol tcp 993 set group service Mail-Services add POP3-Service set group service Mail-Services add SSL-POP3-Service set group service Mail-Services add SMTP-Service set group service Mail-Services add SSMTP-Service set group service Mail-Services add IMAP-Service set group service Mail-Services add IMAP4-SSL-Service set group service Mail-Services add IMAPS-Service set address "Mail-NAT" ip-netmask 210.24.x.x set address "Mail-Real" ip-netmask 146.168.y.y set rulebase security rules "Inbound Mail" from Untrust to Trust set rulebase security rules "Inbound Mail" source Any set rulebase security rules "Inbound Mail" destination Mail-NAT set rulebase security rules "Inbound Mail" destination Mail-Real - I only add this for troubleshooting because sometimes I have to add multiple source zones. set rulebase security rules "Inbound Mail" service Mail-Services set rulebase security rules "Inbound Mail" action allow set rulebase security rules "Inbound Mail" log-end yes set rulebase security rules "Inbound Mail" profile-setting group Security_Profile_AV_AS_VA set rulebase security rules "Inbound Mail" application any set rulebase nat rules "Inbound Mail NAT" from Untrust to Untrust set rulebase nat rules "Inbound Mail NAT" source any set rulebase nat rules "Inbound Mail NAT" destination Mail-NAT set rulebase nat rules "Inbound Mail NAT" service any set rulebase nat rules "Inbound Mail NAT" destination-translation translated-address 146.168.y.y set rulebase nat rules "Outbound Mail NAT" from Trust to Untrust set rulebase nat rules "Outbound Mail NAT" source Mail-Real set rulebase nat rules "Outbound Mail NAT" destination any set rulebase nat rules "Outbound Mail NAT" service any set rulebase nat rules "Outbound Mail NAT" source-translation static-ip translated-address 210.24.x.x

blacksan · ‎09-10-2010

Any thoughts on adding this URL Filter feature to the Palo Alto? It would be nice to have start blocking websites based on their overall reputation.

blacksan · ‎09-10-2010

Palo Alto Web site > Support > Threat Database drop down and select Virus. I was just there looking for the same thing.

blacksan · ‎09-09-2010

try this: Create a isolate vlan (port access) on your cisco switch assign three ports to that vlan Plug the Router Plug PA-1 - untrust side Plug PA-2 - untrust side assign two ports on your cisco switch for the main routing Plug PA-1 - trust side Plug PA-2 - trust side Verify these Cisco port settings: switch port fast no cdp fix the speed if possible (1000/Full) If you require trunk for multiple vlans then you will need a dedicated switch between the router and the PA pair.

blacksan · ‎08-26-2010

why not use a URL Filter with youtube.com?

blacksan · ‎06-23-2010

ok, how about reverse the question. LDAP Authentication vs RADIUS Authentication. Under Radius, we have the option to add the domain so we can use the PAN-Agent information for authentication & policy. Do we have the same options under LDAP hidden somewhere?

blacksan · ‎06-10-2010

When I deployed VeriSign OTP in the past (years ago), they provided a UA software which listen for RADIUS calls. If the new "cloud" version uses RADIUS then the answer is yes. Just expect to put your OTP+PIN in the password section on the SSL VPN.

blacksan · ‎04-25-2010

Click on the tab on the very top of the SSL VPN window - Client settings. FireFox loves to hide the top browser bar section.

blacksan · ‎04-09-2010

How can I remove the Domain information from the User information? Domain/UserID to just UserID. I notice that I am getting this information from the PAN-Agent and the Terminal-Agent. Reason: I am also using LDAP Authentication for SSL-VPN/Admin which does not use the Domain information so I have to add the user account manually to to the Allow-List on the Authentication Profile instead of using the information from the PAN-Agent User list.

blacksan · ‎03-26-2010

OK, I thought it was already available in 3.0 with RADIUS Authentication profile for SSL VPN users. When I saw the 3.1 release supporting RSA SecureID, I thought that means Palo Alt added the sdconf.rec. Thank you for clearing that up.

blacksan · ‎03-22-2010

Any Documentation on setting up the RSA SecureID? Both Admin Guide and CLI Guide have no details. Mostly focus on SSL VPN where we setup the sdconf.rec on the Palo Alto Device via CLI.

Date Registered	‎11-24-2009 04:38 PM
Date Last Visited	‎02-18-2019 02:21 PM
Total Messages Posted	21
Total Likes Received	6

Online Status	Offline
Date Last Visited	‎02-18-2019 02:21 PM

About blacksan

SNMP V3 Configuration

Re: issues accessing urls even though whitelisted

Re: Policy based forwarding for traffic filtering

Re: Migration from Check Point to PAN

Re: Checkpoint FW-1 Telnet Authentication - PA Alternative?

Re: VeriSign VIP Authentication Service

Re: Migration from Check Point to PAN

Re: Admin users AD authentication HELP

Re: Authentication profile not found for the user (localdb)

Re: NAT question

SNMP V3 Configuration

Re: issues accessing urls even though whitelisted

Re: Policy based forwarding for traffic filtering

Re: Migration from Check Point to PAN

Re: Checkpoint FW-1 Telnet Authentication - PA Alternative?

Re: Authentication profile not found for the user (localdb)

Re: PA-500 problem with ISA Proxy Server

Re: SSL VPN and iPhone OS 4.0

Re: Admin users AD authentication HELP

Re: NAT question

Re: NAT question

BrightCloud Web Reputation Service

Re: “Here you have” Virus (aka W32/VBMania@MM)

Re: High Availability with Virtual Wires?

Re: Creating Youtube App Filter

Re: PAN-Agent - Domain on User-ID

Re: VeriSign VIP Authentication Service

Re: SSL VPN- Config ERROR PAN OS 3.1

PAN-Agent - Domain on User-ID

Re: RSA SecureID on PA 3.1

RSA SecureID on PA 3.1

Strata

Prisma

Cortex

About blacksan