About AndreasB

AndreasB · ‎03-15-2019

Hi, did anyone manage to write a custom signature to detect domain fronting? PA extracts the Host header, so in theory it should be possible to detect if the Host header is different from the URL? Alternatively, if one could log the Host header one could develop external detection logic in a SIEM. Regards, Andreas

AndreasB · ‎03-15-2013

Currently impossible with two layers of proxies and a firewall inbetween. Don't ask me why

AndreasB · ‎03-15-2013

I can't post a pcap, but here the analysis from one of the sites which failed: After analyzing this issue I think we finally found the problem. Our IDS System was dropping your HTTP packet due to a malformed XFF header. Judging from your pcap file the XFF header in the first GET is empty, while in the retransmission packets the XFF value is correctly filled with an IP address. This behavior forces our IDS to block this connection attempt as it could lead to a possible Denial of Service attack. We filed a bug report but apparently this is the expected behavior. Getting the original bug fixed by completely blanking out the XFF header should fix this issue too.

AndreasB · ‎03-15-2013

At the moment this is handled as a bug, not as a feature request. No ETA for a fix yet. A possible fix is to replace the whole line with blanks to keep the packet size. This would add a bunch of blanks to the preceding line. Should still be RFC compliant, but you never know if this will break other sites.

AndreasB · ‎03-15-2013

there is also a bug in the way PA handles such traffic: The first request with the blanked out XFF header gets denied by the destination IPS. PA then resends the packet, this time with the header present. May be that this retransmission triggers the signature.

AndreasB · ‎03-15-2013

Dear all, we are getting more and more problems with the way PA handles the X-forwarded-for header. It is very useful in getting the internal client IP in a proxy environment. OTOH, you need to clean it before it goes out so that you don't leak internal IP addresses. This cleaning creates a problem. PA only replaces the content of the header with blanks, so that it doesn't change the packet size. With this approach we are getting more and more reports from users and external web site operators about us attacking them. It looks like the empty XFF header triggers signatures on other IDS/IPS devices like: "Apache HTTP Server X-Forwarded-For Denial-of-Service". Is anybody else experiencing similar problems? Regards, Andreas

AndreasB · ‎09-06-2012

Hi Sri, thanks for the fast answer. So to summarize: - the way one defines address groups and regions is slightly different, but in the end they both contain IP address ranges - both can be used in security rules as src or dst - regions are checked for overlapping addresses, adress groups not Is my understanding correct? Regards, Andreas

AndreasB · ‎09-06-2012

I'm trying to find more details about the differences between address groups and regions. I added some regions to get a better reporting when I include src and dst countries. Initially I made a mistake of naming a region the same as an existing address group. I couldn't delete it, got the error message that this object is used in a rule. I know that in rules one can use regions also as src or dst, similar to an address group. I imported some 100+ subnets and didn't check all of them in detail and after a commit I got an error message about subnets being already defined in other regions or overlapping subnets. Did only complain about that for the regions, not for the address groups ? Is there a document available describing in more details the differences between these two object types? Regards, Andreas

AndreasB · ‎06-06-2012

Thanks for the quick answer. In my opinion it would be good to add that feature in the future. It is not always possibe to get the Malware from the infected system. Just as an example, the last report stated: Deleted itself Assuming that Palo Alto doesn't share detected Malware automatically with other A/V vendors, downloading the file would help to send a sample to the deployed A/V vendor so that they can create a signature for it. Regards, Andreas

AndreasB · ‎06-06-2012

Hi, is there a way to get hold of a file analysed by Wildfire which is categorized as Malware? Regards, Andreas

AndreasB · ‎04-12-2012

We are trying to log all URLs without having a URL Filtering license For that we created a custom URL category containing *.* *.*.* Seemed to work but when we compared the amount of log entries to the proxy logs we discovered that we only see less than half of the proxy URL logs in the PA URL log. Looking around we noticed that the option "Log Container Page only" was checked. If I understand the documentation correctly, this option would not log all URLs, only the ones matching the default content. Tonight we tried to unselect that option. It worked on Panorama, but we are not able to unselect that option on the device itself. We get an error message: License required for URL filtering to function We did not get this error message with the option to log only container pages. Is this a feature or a bug ? Regards, Andras

AndreasB · ‎02-19-2012

Looks like I need some additional help: Let me first briefly describe my setup: Internet - PAN vWire - SSG5 - SA2000 There is an incoming NAT rule forwarding traffic to port 443 directed to the SSG5 to the SA2000 I'd like to control the incoming traffic to the SA2000. The SA 2000 is used for SSL VPN (Network Connect) and Activesync from mobile devices. I loaded the certificate of the SA2000 to the PAN and started to decrypt inbound SSL traffic. Originally I allowed only ssl and activesync to the SSG5. This didn't work. When I checked the logs I saw that there was incoming web-browsing blocked to port 443 Looks like PAN first detects incoming SSL, next it sees the traffic as web-browsing and next as activesync. My policy on the PAN has application default for the incoming services. web-browsing on port 443 is blocked in this case. I ended up adding an additional rule allowing web-browsing to port 443 After that activesync and network connect worked But this is not what I want. I'd like to allow only activesync and network connect (looks like there is no appID for Juniper Network Connect BTW) Allowing web-browsing to port 443 leaves the door wide open for any sort of attacks. Second question concerning outbound SSL decryption: When I commit my config I get a warning that there is no untrust cert configured and therefore the trust cert will be used. Any hint how to generate and load an untrusted cert to be used for outbound SSL decryption? Regards, Andreas PS: I know that I probably could replace the SSG5 and SA2000 with the PAN but curently I'm missing the support for dynamic DNS.

AndreasB · ‎02-17-2012

Hi James, thanks for the quick reply. I have outbound decryption working fine in vWire. I didn't expect to get outbound decryption working in tap mode but I was hoping that it should work for inbound. Need to debug then a bit more to get it working. Regards, Andreas

AndreasB · ‎02-17-2012

Short question: Is inbound SSL decryption possible in vWire and/or Tap mode? Regards, Andreas

AndreasB · ‎01-28-2012

Dear all, we ran into a strange problem tonight. We are running PA 4.0.8 in active/active because me might encounter asymmetric routing. We have two A/A clusters in different data centers. Both clusters have the same cluster ID. The traffic is going only over one cluster by design. We checked the traffic counters on the routers and confirmed that only one site is seeing traffic, BUT, the strange thing is that I saw traffic logs in the passive DC cluster. At the same time the traffic crossing the PAs was very slow or not working at all. Could it be that somehow the session information is forwarded to another cluster if it has the same cluster ID? After disabling HA3 the problem went away and I don't see anything anymore in the traffic logs on the passive cluster. Regards, Andreas

Member Since	‎07-25-2011 04:47 PM
Date Last Visited	‎05-23-2022 05:03 PM
Posts	15
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎05-23-2022 05:03 PM

About AndreasB

How to detect domain fronting

Re: Problems with XFF cleaning

Re: Problems with XFF cleaning

Re: Problems with XFF cleaning

Re: Problems with XFF cleaning

Re: Wildfire: How to get a sample of the file?

Re: Possible solution to slow commit

How to detect domain fronting

Re: Problems with XFF cleaning

Re: Problems with XFF cleaning

Re: Problems with XFF cleaning

Re: Problems with XFF cleaning

Problems with XFF cleaning

Re: Difference between Address groups and regions ?

Difference between Address groups and regions ?

Re: Wildfire: How to get a sample of the file?

Wildfire: How to get a sample of the file?

URL logging without URL Filtering license

Re: Inbound SSL decryption in vWire and Tap mode

Re: Inbound SSL decryption in vWire and Tap mode

Inbound SSL decryption in vWire and Tap mode

PA in active-active mode and Cluster ID

Network Security

Cloud Security

Security Operations

About AndreasB