Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About blacksan
About blacksan
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
02-18-2019
21Posts
6Likes
2Solutions
Feb 18, 2019Last Visited
User
Activity
User
Profile
Latest posts by blacksan
| Subject | Views | Posted |
|---|---|---|
| 2855 | 07-30-2011 05:08 PM | |
| 403 | 07-18-2011 08:40 AM | |
| 1420 | 03-29-2011 08:50 PM | |
| 1138 | 01-26-2011 08:43 AM | |
| 369 | 01-20-2011 07:41 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 06-10-2010 06:44 AM | |
| 1 | 01-26-2011 08:43 AM | |
| 1 | 09-21-2010 06:40 AM | |
| 2 | 12-21-2010 01:02 PM | |
| 1 | 09-16-2010 06:56 AM |
User Badges
Public Statistics
| Date Registered | 11-24-2009 04:38 PM |
| Date Last Visited | 02-18-2019 02:21 PM |
| Total Messages Posted | 21 |
| Total Likes Received | 6 |
07-30-2011
05:08 PM
I notice that there is no example or detail descriptions for configuration of SNMPv3. Here is my configuration which works but I never got the include/exclude mask to work. If someone else have an example or recommendations please upload. set deviceconfig system snmp-setting access-setting version v3 views <snmpview> view <snmpview-oid> oid <OID like 1.3.6.1.2> set deviceconfig system snmp-setting access-setting version v3 views <snmpview> view <snmpview-oid> option include set deviceconfig system snmp-setting access-setting version v3 users <snmpuser> authpwd <password> set deviceconfig system snmp-setting access-setting version v3 users <snmpuser> privpwd <password> set deviceconfig system snmp-setting access-setting version v3 users <snmpuser> view <snmpview> set shared log-settings snmptrap snmp-traps version v3 snmpserver local manager <SNMP Server like 192.168.1.1> set shared log-settings snmptrap snmp-traps version v3 snmpserver local engineid <EngID like 0x01020304050607> set shared log-settings snmptrap snmp-traps version v3 snmpserver local authpwd <password> set shared log-settings snmptrap snmp-traps version v3 snmpserver local privpwd <password> set shared log-settings snmptrap snmp-traps version v3 snmpserver local <snmpuser>
... View more
Labels:
- Labels:
-
Configuration
-
Management
07-18-2011
08:40 AM
Use plug-ins to test the website like HTTPWatch or Fiddler to verify that the URL/ACL matches what is needed for the website. When I go to: https://www.stockbrokers.barclays.co.uk/idv/Login1.asp?category=&usecase=login&popup=& I see these websites as part of the Main page "Get Request": https://rd.clickshift.com/js/convert.js https://switch.atdmt.com/action/0w1sto_BARXlogin_1 https://barclays.touchclarity.com/c?siteID=406&ts=1311003466750&ccID=BST_Login_RHS_Top&log=no&location=https%3A%2F%2Fwww.stockbrokers.barclays.co.uk%2Fidv%2FLogin1.asp%3Fcategory%3D%26usecase%3Dlogin%26popup%3D%26&tagv=5.3&tz=-240&r=empty&title=Barclays%20Stockbrokers&cd=32&ah=870&aw=1440&sh=900&sw=1440&pd=undefined https://statse.webtrendslive.com/dcsiiriph10000golxgl12j01_5y5u/wtid.js https://statse.webtrendslive.com/dcsiiriph10000golxgl12j01_5y5u/dcs.gif?&dcsdat=1311003469046&dcssip=www.stockbrokers.barclays.co.uk&dcsuri=/idv/Login1.asp&dcsqry=%3Fcategory=%26usecase=login%26popup=%26&WT.co_f=71.22.216.247-1568811280.30164320&WT.vtid=71.22.216.247-1568811280.30164320&WT.vtvs=1311003471421&WT.vt_f_tlv=0&WT.sp=BarclaysStockbrokers&WT.tz=-4&WT.bh=11&WT.ul=en-us&WT.cd=32&WT.sr=1440x900&WT.jo=Yes&WT.ti=Barclays%20Stockbrokers&WT.js=Yes&WT.jv=1.3&WT.ct=lan&WT.hp=0&WT.bs=1419x100&WT.fv=10.0&WT.slv=Unknown&WT.tv=8.6.2&WT.dl=0&WT.ssl=1&WT.es=www.stockbrokers.barclays.co.uk/idv/Login1.asp&WT.vt_f_tlh=0&WT.vt_f_d=1&WT.vt_f_s=1&WT.vt_f_a=1&WT.vt_f=1
... View more
03-29-2011
08:50 PM
Need to create a rule above the PBF for the Security Appliance to avoid the loop. Source Zone / I.f.: ethernet 1/3 Source Address: 10.2.43.20 Source User: any Destination Address: any Application: any Service: any Action: no-PBF
... View more
01-26-2011
08:43 AM
1 Kudo
if you like XML format, then use the Checkpoint Config Wizard (CPConfigWiz). This will take your SmartCenter config and make a XML version. Now the data (Objects, FW Rules, NAT Rules) are easy to move around. Just remember to create NAT rules in the PA for all of the objects with Automatic NAT in the Checkpoint. You can grab the Config Wizard from support.checkpoint.com
... View more
01-20-2011
07:41 AM
Setup a Capture Portal with Authenticates against Cisco ACS for those users. Then create a rule which allows those users (once Authenticated) to access the systems via telnet. The only requirement is that the users must go somewhere via Internet Browser to validate themselves. or use the SSL VPN function and encrypt that telnet traffic
... View more
12-21-2010
01:02 PM
2 Kudos
If you are trying to sync all three Authentication section to the same User ID/PW (Admin, SSLVPN, Capture Portal) plus the User-ID Agent for the Policy then you will need to use a external database like Active Directory. So here are the steps if using the PAN-Agent. #1 - Install / Configure the PAN-Agent - This will give you the ability to select user and group in this format: DOMAIN\USER. #2 - Configure a LDAP Profile - Make sure you fill in the "Domain" section to match the "DOMAIN" -- this will only work if you have only a simple single domain structure. #3 - Create a Authentication Profile for Admins - Select the users which will be allowed to log into the PA #4 - Create a Authentication Profile for SSL VPN - Select the users / groups which can log into the SSL VPN #5 - Create a Authentication Profile for Capture Portal - I find it easy to choise "All" for users #6 - Creat a Administrator which matches the Domain Account so you can assign a Admin role it that user #7 - Edit Device / Setup and add the Authentication Profile for Administrators #8 - Create a SSL VPN and policy #9 - Create a Portal Capture Rule #10 - Commit and test.
... View more
11-11-2010
07:38 AM
Not a big fan of this because it shows your real IP Address on the Internet but you can turn on X-Forward Header on the ISA Server and PA-500. ISA does not perform this function without a plug-in from Winfrasoft or Trustlist. You will need to CLI into the PA-500 and perform the following: set deviceconfig setting ctd x-forwarded-for yes Just make sure the ISA is sending the X-Forward in the correct format: X-Forwarded-For: client1, proxy1, proxy2
... View more
09-22-2010
11:54 AM
You are not alone. Most Companies are waiting for a secured way of accessing the Corp Net. Apple decided to stay old school by using PPTP and only Cisco IPSEC. F5 Firepass - Nope Juniper SA - Beta Testing Foritnet Fortigate - via PPTP, the App only supports web portal Cisco ASA - via IPSEC and soon SSL VPN Citrix SSL VPN - App supports Citrix XenApp. Microsoft - via PPTP Checkpoint - R71 (Mobile Blade) / Early Release OpenVPN - JailBreak version only Nortel Contivity - PPTP NetMotion - Nope
... View more
09-21-2010
06:40 AM
1 Kudo
The Admin, SSL VPN and Capture Portal uses the same Authentication Profile (LDAP/RADIUS) instead of the Pan-Agent LDAP (Novell/Active Directory) Follow the same directions on how to setup LDAP profile for Capture profile or SSL VPN. The biggest issue I had with the LDAP profile with that it does not work with Pan-Agent user structure (Domain\User) like the RADIUS profile. So you will need to manually add user accounts instead of using Pan-agent setup. .
... View more
09-20-2010
06:44 AM
make sure you are running PA 3.1+ to see the Policy Base Forwarding. (PBF) which is a simply version of Policy Base Routing (PBR).
... View more
09-16-2010
06:56 AM
1 Kudo
Here is the full package you can copy / paste for CLI then make modifications in the Web Console. I am not a fan on add App-ID when I do the migration but it is not that hard if you know the protocol. Since I don't know if "mail service" is only SMTP or the full array of mail protocols, I am including all services. I don't know if your NetScreen includes an Outbound rule for your mail server. set service POP3-Service protocol tcp 110 set service SSL-POP3-Service protocol tcp 995 set service SMTP-Service protocol tcp 25 set service SSMTP-Service protocol tcp 465 set service IMAP-Service protocol tcp 143 set service IMAP4-SSL-Service protocol tcp 585 set service IMAPS-Service protocol tcp 993 set group service Mail-Services add POP3-Service set group service Mail-Services add SSL-POP3-Service set group service Mail-Services add SMTP-Service set group service Mail-Services add SSMTP-Service set group service Mail-Services add IMAP-Service set group service Mail-Services add IMAP4-SSL-Service set group service Mail-Services add IMAPS-Service set address "Mail-NAT" ip-netmask 210.24.x.x set address "Mail-Real" ip-netmask 146.168.y.y set rulebase security rules "Inbound Mail" from Untrust to Trust set rulebase security rules "Inbound Mail" source Any set rulebase security rules "Inbound Mail" destination Mail-NAT set rulebase security rules "Inbound Mail" destination Mail-Real - I only add this for troubleshooting because sometimes I have to add multiple source zones. set rulebase security rules "Inbound Mail" service Mail-Services set rulebase security rules "Inbound Mail" action allow set rulebase security rules "Inbound Mail" log-end yes set rulebase security rules "Inbound Mail" profile-setting group Security_Profile_AV_AS_VA set rulebase security rules "Inbound Mail" application any set rulebase nat rules "Inbound Mail NAT" from Untrust to Untrust set rulebase nat rules "Inbound Mail NAT" source any set rulebase nat rules "Inbound Mail NAT" destination Mail-NAT set rulebase nat rules "Inbound Mail NAT" service any set rulebase nat rules "Inbound Mail NAT" destination-translation translated-address 146.168.y.y set rulebase nat rules "Outbound Mail NAT" from Trust to Untrust set rulebase nat rules "Outbound Mail NAT" source Mail-Real set rulebase nat rules "Outbound Mail NAT" destination any set rulebase nat rules "Outbound Mail NAT" service any set rulebase nat rules "Outbound Mail NAT" source-translation static-ip translated-address 210.24.x.x
... View more
09-10-2010
11:40 AM
Any thoughts on adding this URL Filter feature to the Palo Alto? It would be nice to have start blocking websites based on their overall reputation.
... View more
- Tags:
- url
- url_filtering
09-10-2010
08:21 AM
Palo Alto Web site > Support > Threat Database drop down and select Virus. I was just there looking for the same thing.
... View more
09-09-2010
01:29 PM
try this: Create a isolate vlan (port access) on your cisco switch assign three ports to that vlan Plug the Router Plug PA-1 - untrust side Plug PA-2 - untrust side assign two ports on your cisco switch for the main routing Plug PA-1 - trust side Plug PA-2 - trust side Verify these Cisco port settings: switch port fast no cdp fix the speed if possible (1000/Full) If you require trunk for multiple vlans then you will need a dedicated switch between the router and the PA pair.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-18-2019
02:21 PM
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
