About CRHC

CRHC · ‎08-30-2017

We are also experiencing many issues with 729 and connections related PACS images and interface engines. Removing Threat, resolves all issues.

CRHC · ‎08-26-2016

Hello, For several years, we have been blocking URL content classifed as "web-advertisements" within PANDB. This has been extremely successful in stopping malicious ads from comprimising systems. More and more websites are now disallowing access to content based on any active "ad blocking" solutions. These sites now present the user with a message stating they will not provide content with Ad blockers in place. Since the control is at the PAN level, the user has no control. White-listing is not an option as the ad content does not come from "nytimes.com". And white-listing *.lotsofads.com defeats the reason for blocking web advertising. Has anyone come across any inventive methods to continue blocking web advertisements at the PAN level and have the websites that "check" still work? Thanks! Mike

CRHC · ‎10-22-2015

We too are seeing numerous hits for .xls and .doc files starting this morning. They are at this time all legitimate files.

CRHC · ‎09-15-2014

Hello, Is the recommendation to be on version 2.x of the GP client prior to upgrading from 5.x to 6.x? Thanks! Mike

CRHC · ‎08-01-2014

Hello, Most of the "Dynamic DNS" sites are categorized as Computer and Internet Info (PANDB). On occasion a device will get infected because of a Dynamic DNS redirect to a malicious site. The initial URL connection is through one of the DDNS sites. Because we allow "Computer and Internet Info", the connection is allowed to the final (malicious) destination. Besides hunting down every DDNS service and creating a custom URL block list - are there any solutions to better control these redirects? Thanks! Cheers, Mike

CRHC · ‎10-23-2013

Hello, Is anyone else seeing a large amount of events based on the newly released signature - Oracle Java SE Remote Java Runtime Environment Remote Code Execution Vulnerability(36166) for legitimate user traffic? Have been seeing events all day since the threat content update for this week. I have not heard of any complaints as of yet. But the event is triggering when clients are logged into one of our clinical portal pages (utilizing Java). Mike

CRHC · ‎09-16-2013

Upgraded our 3050 pair 2 weeks ago and have not heard of any issues with VPN yet. Will keep monitoring now. Resources appear in good shape. Thanks!

CRHC · ‎06-13-2013

We recently did a hardware refresh - replacing our 2050s with 3050s. Our commits were also close to 10 minutes on the 2050s. They are now about 10 seconds on the 3050s. Cheers, Mike

CRHC · ‎06-05-2013

Hello, Does "not-resolved" status have the same indication within PANDB? Thanks! Mike

CRHC · ‎05-09-2013

Hello, No decryption enabled at this time. That does make sense about the 443 not working within "web-browsing". I had assumed the APP-ID for the Global-Protect would contain the ports/signatures to allow Application Default to function. I will lock it down by specific ports for the apps. Mike

CRHC · ‎05-09-2013

Hello, Our XenApp farm IP range is dynamic and the servers could spin up on any number of IPs within a couple of segments. Does a TS Agent entry for every single possible IP need to be added on the PAN device, or can I configure it to look at a subnet range? My attempts at using subnets have not worked, but single IP entries do work. Thanks! Mikes

CRHC · ‎04-29-2013

Hello, I have a Global Protect Portal setup which works properly with a policy set for the App-IDs of "SSL", "Web-Browsing" and "PANOS-Global-Protect" and "any" Service. If I set service to "Application-default" - the portal login page no longer displays. The logs then show that SSL (443) was "Allowed" and Web-Browsing (443) is "Deny". Is there a particular reason that using the "application-default" with the APP-ID access policy for Global Protect, would not work? Thanks! Cheers, Mike

CRHC · ‎04-08-2013

It appears my resolution was that in my file blocking profile only had "download" for the direction. Modifying to "both" looks to have done the trick.

CRHC · ‎04-02-2013

Besides a few business systems that have FTP needs - we block ftp unless you are a "domain" authenticated IT person. Initially we found a few domain or local system accounts that had a business need to FTP (and those we made accommodations for), but overall it was successful very early on. Provided most everyone in your environment logs into the domain - using AD users and groups within the rules works very slick. We also setup a daily report showing FTP usage, to keep an eye on IT usage and DLP. And we include Threat/AV/URL/Wildfire to the ftp allow rule. Initially we setup the rule in logging only for a few months to get a handle of who/what/when was happening for FTP. Cheers, Mike

CRHC · ‎03-19-2013

We switched back in January. Our experience has been positive thus far. We have had perhaps half a dozen reclassification requests to date. A slight increase then with BC. However, reclassification requests with PAN support have been more accommodating. It was hit or miss if BC took our suggested category change. The reclassification request turn-around is still around 24-48 hours. We have always had a temporary "white list" rule to accommodate high priority websites while waiting for reclassification. Our environment (healthcare) is not as sensitive for waiting the 2 days - it works within our SLA to the client. We have seen a decrease in reclassification requests lately. I feel the solution is maturing at a quick pace. I did URL load speed tests with BC and PANDB and page loads have a slight edge with PANDB - but not enough to be a wow factor and it wasn't always an increase depending on site. My one hurdle was that some of the categories differed slightly then BC. For instance "questionable" (which we were blocking). We had to adjust some of our URL profiles based on the changes in definition Palo and BC have for categories. But it was nothing we couldn't tweak. The selling point for PANDB to us was not having a large DB to download every day (closer "real time" URL updates now) and that with Palo's threat feeds and Wildfire - we get the benefit of faster URL updates to categories such as "malware" (enhanced protection). The integration that PANDB adds to the devices should only get stronger is my assumption. URL classification is always a tricky solution. I feel PANDB has been a good switch for us. Cheers, Mike

CRHC · ‎03-19-2013

Want to add that if adding the bidirectional zone would be beneficial - it concerns me to add "external" source to "internal" destination in this case. How big a concern is that in this particular setup? We are NAT'd behind the external interface. Thanks.

CRHC · ‎03-18-2013

Hello, I currently have a security rule that blocks the downloads of ".exe" files from the "unknown" URL category (which sits above my general Internet/WildFire Forward rule). It works extremely well in dropping a huge amount of the garbage out there. However, occasionally the garbage makes it past that rule and sends up a WildFire event. Again, Deny rule comes before the WildFire forward. I noticed from the WildFire alert that in the cases of communication which appears to bypass the deny rule - the source and destination are actually reversed to what the rule is set. Instead of my user being the source - it is now the destination. Should my rule to deny the .exe also include a bidirectional zone? Current Deny .exe rule Source Zone - Internal Destination Zone - External Application - Web-Browsing URL Category - "Unknown" (PANDB) Profile - "DenyEXE" File blocking profile for .exe/download/block Should my zones be a bidirectional setup to block anything that is coming inbound? I had hoped the user session would keep state of that? Should the File Blocking profile be both upload and download? Thanks! Mike

CRHC · ‎12-11-2012

Hello, I could not find any documentation on this inquiry. Is it possible in 5.0.x to get the Wildfire aggregation logs from all my PAN devices to the Pano log Monitor for central reporting? Thanks! Mike

CRHC · ‎12-04-2012

I have seen some hits on this. Not too many. 7 Unique Attacker IPs in the last 7 days.

CRHC · ‎11-19-2012

Hello, What we did was deny excutable downloads from any website that falls into the "unknown" catagory of Brightcloud. The only exception is that if you are an authenticated IT person - you are allowed to download (as many vendor sites are not always classified - or download servers can't be classifed). This has reduced our infection rate of workstations by approx 75% (at least our infection alerts). It has been a huge success for us - with very few false positives. Once in a while we have to add a user to the allow rule as a business site is considered "unknown". Typically it is temporary access. What we found is that most of the big download sites (such as Microsoft and Adobe) are classified and still work. I built a report that tells me the daily blocks. This allows me to see when a download site is no longer classified or if someone is tyring to download a file and I can follow up with them if it's business related. Does this describe what you are interested in setting up? Cheers, Mike

CRHC · ‎11-07-2012

Experienced same issues here. 4.1.8H3 resolved the group issue for us. Have not tried 4.1.9 yet as hotfix 3 got us going again.

CRHC · ‎10-01-2012

Confirmed on PA5020 that removing the "doman" entry in Kerberos resolved login issue on 4.1.8.

CRHC · ‎05-11-2012

Also seeing the same high count of events. Not all events are stemming from workstations that have Firefox installed. -mike

CRHC · ‎02-21-2012

Thank you for the update from your end as well. I updated to the latest version a few minutes ago and no change. Events still showing up. Antivirus version 684-937 (2012/02/20)

CRHC · ‎02-21-2012

Hello, Starting from what appears to be right after pattern update 683-936 was committed - we began receiving a very substantial amount of alerts from multiple internal "victims" for this Trojan. I am still investigating this internally. Has anyone else had a large amount of activity on this signature starting recently? Looking to verify if this is a false positive or not. Other AV protection layers are not reporting this type of activity. Thanks. Name: JS/Trojan.redirector.cay ID: 250007 Severity: Description: This signature detected JS/Trojan.redirector.cay

CRHC · ‎01-23-2012

Same issue here (4.0.8). Modify any object in the "Objects" tab - and the corresponding policy does not get the change (commit fails with "device: failed to find address....."). Process is to then go hunt down where the object is used - delete it and then re-add back to the policy. - mike

CRHC · ‎01-17-2012

I am seeing similiar effects (4.1.1). I noticed today that an auto scheduled AV download was at 30% for more than a week now. Which must of been effecting the threat content download from starting. URL updates are up to date though. The particular date of over a week ago was also when I found the AV download stuck the first time. After killing the job - I can perform a manual download/install. Seems to happen during the auto scheduled download. Cheers, Mike

CRHC · ‎10-26-2011

Forgot to ask. If we were running the SSL decryption - would that provide a sort of failover back to straight SSL - for the application object blocking? Or is the application objects independent of decryption? Thanks!

CRHC · ‎10-26-2011

Thank you Graham! That is a great explanation - appreciate it. Now I have a better explanation to tell our compliance folks. I did place a request to have it looked at. Didn't make it in this week's content update - but will watch for it in a future update. Cheers, Mike

CRHC · ‎10-24-2011

Hello, We have for some time now blocked the use of Dropbox (as an app) and only allow a few users access, based on a domain group. Over last couple of weeks have noticed activity where non allowed users are able to access the application. In my initial investigation, it appears the sessions are not falling into the "dropbox" application object - but rather straight "SSL". Still investigating. I have placed a request with App Research Center to verify if DropBox changed their signatures. Curious if anyone has seen this also or if known by support. Thanks! Mike

Date Registered	‎01-18-2010 11:15 AM
Date Last Visited	‎01-17-2020 11:42 AM
Total Messages Posted	100
Total Likes Received	12

Online Status	Offline
Date Last Visited	‎01-17-2020 11:42 AM

Strata

Prisma

Cortex

About CRHC