About ktm530russ

Well, I THOUGHT it was all working, but still having issues. I believe the answer is in using the HEX Strings, but the format is giving me fits! As long as the Pattern Matching hits for the ENTIRE DNS Request, it seems to work, (I put in ---  .*\x 69 73 63 03 6f 72 67 \x  ---) for "isc.org", which is EXACTLY 7 bytes, and it is now blocking these requests (Another DDOS URL).) So, I am trying to set up a Pattern Matching for a PORTION of a string inside a DNS request, but the rule fails to match the traffic. (per packet captures). Obfuscated, but if I put in patterns to match these: it.really.is.nt  69 74 02 72 65 61 6c 6c 79 02 69 73 02 6e 74 IT.REALLY.IS.NT  49 54 02 52 45 41 4c 4c 59 02 49 53 02 4e 54 I get matching hits on DNS requests that include ONLY that exact string, anything that prepends or appends to this does NOT hit this rule. (ie: www.it.really.is.nt, or MX1.it.really.is.nt) A couple of options I have tried (only showing the lower-case attempts, but had the upper-case also, under two Custom Applications, and two Security Rules): \x 69 74 02 72 65 61 6c 6c 79 02 69 73 02 6e 74 \x .*\x 69 74 02 72 65 61 6c 6c 79 02 69 73 02 6e 74 \x .*(\x 69 74 02 72 65 61 6c 6c 79 02 69 73 02 6e 74 \x) .*( \x 69 74 02 72 65 61 6c 6c 79 02 69 73 02 6e 74 \x ) I also tried to shorten this to just the "really.is" portion, upper and lowercase, with the same type of results (exact string match, any "extra" characters in the DNS request do not hit the rule). After I clear out my two other open Tech support cases, I am going to open a case for this issue. I am getting WAY too frustrated waiting for the 10-minute "commit" 20-30 times per day! EDIT: Another question:  WHAT are valid HEX strings for a "period"?  I have seen 02, 03, and 06 in my captures, Message was edited by: Russel Smith ... View more

Color me blind, I guess I was getting to close to the issue. (staring at the computer screen for 10 hours doesn't help.) The Hex string DID work.... AFTER I removed the double-quotations from around the string attempts... Thank you very much Greg and Takahiro !  ... View more

I am holding off on starting a support case on this, as I have one open already, and will be starting another today (first for DataPlane 100% CPU utilization, slowly getting resolved, second for Custom Application signature Pattern Matching issue, pattern not getting any "hits" on the Security Rule). It took me half a dozen "commit" to have the issue occur again (never happens when you want it to). I was running the "log tail", and below is a snip of the log. It appears that there IS an error, and eventually times out trying to sync, but then starts over and succeeds: Jun 18 09:45:07 ha_peer_send_hello(src/ha_peer.c:4547): Group 1 (HA1-MAIN): Sending hello message Hello Msg --------- flags    : 0x1 (preempt:) state    : Active (5) priority : 100 cookie   : 7596 num tlvs : 2   Printing out 2 tlvs   TLV[1]: type 2 (CONFIG_MD5SUM); len 33; value:     37396664 63616664 36343735 30663435 39646539 37373935     36653839 66383230 00   TLV[2]: type 11 (SYSD_PEER_DOWN); len 4; value:     00000000 Jun 18 09:45:45 ha_state_monitor_hold_callback(src/ha_state.c:1936): Group 1: ending initial monitor hold; no longer ignoring link and path monitoring failures due to an HA state transition Jun 18 09:46:07 ha_state_cfg_sync_callback(src/ha_state_cfg.c:836): ha_state_cfg_sync_callback: retries: 1; insync: no Jun 18 09:46:07 ha_state_cfg_sync_start(src/ha_state_cfg.c:738): Starting config sync for group 1 Jun 18 09:46:07 ha_sysd_start_config_sync(src/ha_sysd.c:781): Sending start sync to mgmtsrvr Jun 18 09:46:07 Error: ha_sysd_mgmt_dosync_modify_callback(src/ha_sysd.c:3701): Error when trying to modify sw.mgmt.runtime.dosync Jun 18 09:46:07 Error: ha_state_cfg_dosync_fail(src/ha_state_cfg.c:387): Group 1: Config sync start failed on local mgmt srvr Jun 18 09:46:07 ha_sysd_dev_cfgsync_update(src/ha_sysd.c:1506): Set dev cfgsync to Out-of-Sync Jun 18 09:46:07 ha_state_cfg_dosync_fail(src/ha_state_cfg.c:397): Group 1: setting reason to failure for config sync when we got a dosync failure Jun 18 09:46:12 ha_state_cfg_sync_callback(src/ha_state_cfg.c:836): ha_state_cfg_sync_callback: retries: 2; insync: no Jun 18 09:46:12 ha_state_cfg_sync_start(src/ha_state_cfg.c:738): Starting config sync for group 1 Jun 18 09:46:12 ha_sysd_start_config_sync(src/ha_sysd.c:781): Sending start sync to mgmtsrvr Jun 18 09:46:12 ha_sysd_dev_cfgsync_update(src/ha_sysd.c:1506): Set dev cfgsync to Committing Jun 18 09:47:07 Error: ha_sysd_mgmt_dosync_modify_callback(src/ha_sysd.c:3701): Error when trying to modify sw.mgmt.runtime.dosync Jun 18 09:47:07 Error: ha_state_cfg_dosync_fail(src/ha_state_cfg.c:387): Group 1: Config sync start failed on local mgmt srvr Jun 18 09:47:07 ha_sysd_dev_cfgsync_update(src/ha_sysd.c:1506): Set dev cfgsync to Out-of-Sync Jun 18 09:47:07 ha_state_cfg_dosync_fail(src/ha_state_cfg.c:397): Group 1: setting reason to failure for config sync when we got a dosync failure Jun 18 09:47:13 ha_state_cfg_sync_callback(src/ha_state_cfg.c:836): ha_state_cfg_sync_callback: retries: 3; insync: no Jun 18 09:47:13 ha_state_cfg_sync_start(src/ha_state_cfg.c:738): Starting config sync for group 1 Jun 18 09:47:13 ha_sysd_start_config_sync(src/ha_sysd.c:781): Sending start sync to mgmtsrvr Jun 18 09:47:13 ha_sysd_dev_cfgsync_update(src/ha_sysd.c:1506): Set dev cfgsync to Committing Jun 18 09:47:13 Error: ha_sysd_mgmt_dosync_modify_callback(src/ha_sysd.c:3701): Error when trying to modify sw.mgmt.runtime.dosync Jun 18 09:47:13 Error: ha_state_cfg_dosync_fail(src/ha_state_cfg.c:387): Group 1: Config sync start failed on local mgmt srvr Jun 18 09:47:13 ha_sysd_dev_cfgsync_update(src/ha_sysd.c:1506): Set dev cfgsync to Out-of-Sync Jun 18 09:47:13 ha_state_cfg_dosync_fail(src/ha_state_cfg.c:397): Group 1: setting reason to failure for config sync when we got a dosync failure Jun 18 09:47:13 ha_state_cfg_sync_callback(src/ha_state_cfg.c:836): ha_state_cfg_sync_callback: retries: 4; insync: no Jun 18 09:47:13 Warning: ha_event_log(src/ha_event.c:47): HA Group 1: Running configuration not synchronized after retries Jun 18 09:47:23 Error: elog_callback(pan_elog.c:51): failed to send system log to management server: TIMEOUT Jun 18 09:48:13 Error: ha_sysd_mgmt_dosync_modify_callback(src/ha_sysd.c:3701): Error when trying to modify sw.mgmt.runtime.dosync Jun 18 09:49:58 ha_peer_recv_hello(src/ha_peer.c:4600): Group 1 (HA1-MAIN): Receiving hello message Msg Hdr ------- version : 1 groupID : 1 type    : Hello (2) token   : 0xff0f flags   : 0x1 (req:) length  : 81   Hello Msg   ---------   flags    : 0x1 (preempt:)   state    : Passive (4)   priority : 101   cookie   : 7596   num tlvs : 2     Printing out 2 tlvs     TLV[1]: type 2 (CONFIG_MD5SUM); len 33; value:       37396664 63616664 36343735 30663435 39646539 37373935       36653839 66383230 00     TLV[2]: type 11 (SYSD_PEER_DOWN); len 4; value:       00000000 Jun 18 09:49:58 ha_state_cfg_md5_set(src/ha_state_cfg.c:458): We were out of sync and now we are in sync; autocommit no; ha-sync no; panorama no; cfg-sync-off no Jun 18 09:49:58 ha_sysd_dev_cfgsync_update(src/ha_sysd.c:1506): Set dev cfgsync to In-Sync ... View more

I put in the string as shown above, (but with OUR DNS binaries) but it again did not have any hits on the Security Rule. I modified it to include: .*("\x 31 32 33 34 35 36 02 61 61 02 75 73 \x") and I am getting some weird random hits on the rule (see below). I believe they may be DNS requests on non-standard ports.(I don't have a packet capture of these hits). Still no hits on "real" DNS requests. I did note on the captures I have been taking that the first "period" (xx.123456)  actually shows up as 06 instead of 02 in the "Bytes" window of WireShark. I have tried the pattern with both options and no change. Running a commit at this time, (I really hate waiting 5-10 minutes for every commit!) removing the beginning string section, and the ".*()" encapsulation,  so it will start with "123456" (and hopefully ignore the "xx." portion). Still using "dns" as the parent application, and "dns-req-section" for the pattern match string Context. Also added Service "application-default" on the Security rule to force DNS requests to use port 53 (tcp/udp) Maybe too much at once?.... ... View more

These are some of the iterations that I have tried: xx.123456.aa.us (fails check, less than 7 characters in Pattern) xx\.123456.aa.us (creates custom application, but Security Rule never gets a hit) xx\.123456\.aa\.us (same as above) xx\.123456\.aa.us (same as above) .*(xx.123456.aa.us)  (Fails check) .*(xx\.123456.aa.us) (creates application, Security Rule never hits.) .*(xx\.123456\.aa\.us) (same as above) .*(xx\.123456\.aa.us) (same as above) Any ideas on other ways to try this? Would [Aa][Bb] be interpreted as 2 or 4 characters? ... View more

Thank you.. I will try to do this tomorrow (Tried capturing this information earlier with 2 separate commits, with no error, then did not try, and had the error pop up... That has been my luck today!) It still looks like a cosmetic or timing issue on the sync. If I am able to get the detail, I will open a case and send this up.. ... View more

I am convinced that ANY pattern matching that includes any wildcards before the 7 character minimum limit does NOT work, even with a valid pattern. I would appreciate ANYONE testing to confirm this. Set up a Custom Application that mirrors DNS, then add a pattern matching for a specific DNS pattern with few leading characters ("fs.fed.us" maybe?) apply a Security Rule with this application, then run a DNS query to your DNS servers for this domain. I believe that even with a valid application pattern, and security rule, it will NOT get any hits on the rule... then change that pattern to one that has more than 7 leading characters before any wildcard/periods, it will probably work. Both of our blocking pattern matches work, because they have over 7 characters before the first "wildcard" period, but our third rule that requires the literal backslash has NEVER worked (I believe that the one random working web DNS request was a misconfiguration elsewhere). ... View more

Thanks for the quick response and suggestions.  Ours is somewhat similar, but appears cosmetic. The device we did the 'commit' on will still be showing "synching to peer" when we get the error message. This will change to "Synchronized" on both devices after a short while. More of an irritant than an issue at this point, but wanted to know if this is just on our installation, or if it is a version issue... ... View more

I am assuming the patterns for the Malware blocking are working, as the period (.) would be found as a wildcard, so the original string would still be read correctly for these, even though the "period/wildcard" could be any character. As for our DNS domain string, I think there may be an issue with the way I set up the Custom Application, or the Security rule, as one of the configuration attempts (and I do NOT remember which one), was hitting this rule for our inbound WEB traffic requests. I am somewhat confused as this rule was cloned from the MalWare rule, and only the text of the RegEx string was changed. (and traffic allowed on the Security Rule.) The Custom Application is set up as follows: Category = "general-internet", Subcategory = "internet-utility", Technology = "client-server", Parent App = "dns" Risk = "3" Signature = Condition = "OR condition 1", Operator = "pattern-match", Context = "dns-req-section", Pattern = " ab\.cdefgh.ij.us" (This is the latest iteration I am trying, I don't really care about the "period/wildcard" issues near the end of the string at this time...) I also tried changing the Context to "unknown-req-tcp-payload" and "unknown-req-udp-payload" with no change of status. I have our Security rule set up for ANY request to EITHER of our two DNS servers, for ANY traffic, with the Custom Application for above. (again, this Security rule was cloned from the Malware Security rule, then modified for the string and allowing traffic) Any other suggestions? ... View more

The scheduled report came through email, (PDF), but still cannot download the created report from the device. Any way to have the scheduled report send in .CSV format? ... View more

Hi, I am experiencing the same issue, on a PA2020 pair, since upgrading to 5.0 (currently at 5.0.4). The reports run fine (I am running a 30 day report on "online-personal-storage") even if it takes a while. When trying to export (pdf, csv, xml) a new browser page starts, and sits, and sits, then eventually times out. I DID get ONE .pdf file that did export, one time, not sure why that worked... Scheduling the report has the same issue also, the reports do not get emailed, pulling up the reports also cannot export them to any format. I currently have 3 reports needing to be generated and distributed, clients are waiting.... Update: The Email scheduling and Scheduled reports had been cleared on the appliance, so this portion is unknown for me at this time. I have set this up to run and email, so should have another status tomorrow. One report for the above shows for April 30th, this report cannot be exported using any format. Message was edited by: Russel Smith (Clarifying Scheduling status) ... View more

Found that adding "SilverLight", and "Flash" let the .js files work, but this brings up another question: During my troubleshooting, I was looking for ANY traffic from my test laptop on the Internet (static Public IP), for all Monitoring tabs. I was able to see "Web-Browsing" on port 80, but that was the ONLY traffic seen (Allowed OR Denied) Once I added "SilverLight", on the Traffic Monitor, I am now seeing allowed traffic for "Web-Browsing" AND "SilverLight". Why is this traffic showing on the logs after allowed, but NOT showing on the logs when it should have been showing as "denied"? ... View more

We are using the 3.1 agent still, I see the "timeout" parameter for Server Sessions, but not a configurable enable/disable. Our 4.1 agent (not in use yet, but being configured), has the Server Sessions checkbox disabled. I don't see an option on the Group Mapping Settings on the PA for this either. I don't think that this is the issue, as it just started recently, and we have not updated or made changes in about a month, but your explaination helps a lot. We just need to reverse engineer to find out why the PA is clearing the mappings... "rmonvon", thanks for the input on the timeout, we already have it set to 720 minutes to cover our 8-hour work day, and the issue has random timestamps (sometimes 10-20 minutes between losing the ID, other times 3-4 hours, etc.) It is also just a handful of our 1,000+/- clients that this affects, and those also change almost every time. Most are "fixed" by locking the workstation, then logging back on, but we had one client that lost her ID 4 times in a couple of hours. I am considering disabling NETBIOS polling, but not sure how that would affect our identification process... ... View more

There is actually NO userID being detected when the failure occurs. I pulled up the Monitor/URL Filtering, and filtered on the IP address of the computer/user having issues. There was a lot of allowed activity, and it showed the IP address and the userID. At the point of failure, when they started getting blocked, the "Source User" column is empty. We have found they can regain access by locking/unlocking their workstations, or running our old "WebSenseLogon" batch file that forced an AD update of the userID/Workstation pair. Sometimes it works for a long time, other times, it works for only a few minutes or hours. The only common factor on the ones we did troubleshooting on was the URL that showed up as the first one with no userID: http.00.s.sophosxl.net/V3/(various extensions) ... View more

Not trying to hijack the thread, but this last post (variable "<threatname/>") indicates there may be OTHER "hidden" variables that can be used... It would be really nice to know what ALL the variables are to customize each block page. (also, which variables are only allowed in certain block pages, such as Anti-Virus, versus URL filtering... ... View more