About cchristiansen

Nice blog Bushra.  You're a great CAP manager and a pleasure to work with.   -chadd ... View more

I am not sure what your goal is, so there may be a much better way to accomplish what your are trying to accomplish..  That being said, here is a link to the admin guide for 5.0: https://live.paloaltonetworks.com/servlet/JiveServlet/previewBody/4118-102-7-19329/PA-5.0_Administrators_Guide.pdf On pages 235 and 236 the "regex" rules are described.  This is not full blown regex as you are likely used to.  It is a very cut down version. Here are some "regex(s)" that I have come up with as an example.  The rules state that your data pattern "regex" must be at least 7bytes long.  This is constrained to the string you are searching for and not anything between brackets (so no tricking the system with logic (and, or, etc.).  In these examples I am keying on HTML form post data - so, uploading a file via a web form.  As you can see, the "string" here is "form-data": Any IP: .*(form\-data).*((([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))).* RFC 1918 (10/8) IP: .*(form\-data).*(([10])\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))).* RFC 1918 (172.16/12) IP: .*(form\-data).*(([172])\.((1[6-9])|(2[0-9])|(3[0-1]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))).* RFC 1918 (192.168/16) IP: .*(form\-data).*(([192])\.([168])\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))).* NOTE: For looking in email, you might use the string "subject" as a key word.  The "regex" would then look like this: Any IP: .*(subject).*((([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))\.(([0-9])|([0-9][0-9])|([1][0-9][0-9])|([2][0-5][0-5]))).* !!!WARNING!!!: This will slow down your commit times, and if you use all of these at the same time, your commit may fail.  This is because there is a limited memory space for compiling custom signatures.  The more complex the signature, the more memory the compile takes.  I tested these on a PA-200 and the commits failed for the most part.  I was able to get the smaller ones to commit and work, but again, this is not recommended. I hope this helps. -chadd. ... View more

Hello Daniel. You can use client certificates in both situations.  You do not need to push your root CA to the clients though.  What you can do is upload the CA public key to the firewall, and use that in a "Certificate Profile".  Then, you will just issue (sign) cerficates for your clients from the Microsoft server, and push them to your clients via a GPO. You can also have one client (machine) certifcation for all your clients and configure that as the "client certificate" on your portal and then give that same certificate to all your clients (GPO maybe).  Then that certificate will be checked against the one configured on the firewall to make sure they are the same cert. There is a third way as well, which would allow you to upload the public key (CA) to your firewall, and have that pushed out to all your clients, so that it is in their trusted root store.  That way, they don't get the nag message about a bad cert.  This is not needed though. Hope this helps. -chadd. ... View more