This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About eDub
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About eDub
05-01-2019
7Posts
3Likes
0Solutions
May 01, 2019Last Visited
User
Activity
User
Profile
Latest posts by eDub
| Subject | Views | Posted |
|---|---|---|
| 1688 | 07-09-2015 07:30 AM | |
| 2577 | 07-01-2015 08:50 AM | |
| 3635 | 06-26-2015 04:04 PM | |
| 3912 | 01-27-2014 10:13 AM | |
| 1868 | 05-29-2013 09:03 AM | |
| 1928 | 05-29-2013 06:42 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 07-01-2015 08:50 AM | |
| 2 Likes | 06-26-2015 04:04 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 4 Likes | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 04-22-2013 01:48 PM |
| Date Last Visited | 05-01-2019 09:38 PM |
| Posts | 7 |
| Total Likes Received | 3 |
07-09-2015
07:30 AM
Greetings, Sounds as though there are additional ports needed to receive calls from off the network phones. I'm not running Cisco VOIP so this may be of limited use to you. What I did is setup a negate policy, blocking my custom VOIP ports (defined in an application override policy) along with rtp and sip protocols, to any hosts other than my VOIP gateways. Under that policy I created a deny and log (any application and service) destined for my VOIP gateway addresses. This made it easy to expand TCP and UDP port ranges (based on what was being denied) until I got my phones working properly. The vendor docs port range recommendations were not quite correct so I had to mess around expanding port ranges a bit to get it sorted out.
... View more
07-01-2015
08:50 AM
1 Kudo
Hello Val, I'd say a lot depends on what you are doing with the Juniper firewalls and your timeline for deploying PA's in production. If your existing configuration isn't super-complex and you have a bit of time to wait for the next minor release (just-in-case as a precaution), start with 7.0. I am running 7.0 a couple of smaller firewalls (no surprises so far). I'm leaving the larger production PA's on 6.x code for now. Are you currently running SSG's or NS-??? boxes? I don't have first hand experience with Palo Alto Migration Tool 3.0. It might be worth evaluating how well it does with your Juniper firewall configs... Palo Alto Networks Migration Tool 3.0 eDub
... View more
06-26-2015
04:04 PM
2 Kudos
In the event anyone is curious- I've upgraded two PA-200's from 6.0.3 up to 7.0 (in a remote site and my science project at home). I am leaving the larger production FW's out of the mix for now until a couple of minor updates come along just to make sure I upgraded to 6.1.0, then 6.1.4 and finally to 7.0.0 on both 200's without issues. One is configured L3 trust and untrust, the other is L2 and L3 trust and L3 untrust. So far: No issues bringing my "legacy" policies over. One of the two has a VPN tunnel back to corp and it came up and appears to be working reliably (that one also has dns proxy, DHCP and a few other things setup on it). Throughput improved by >10% - particularly download speed (benchmarked with speedtest.net). Yes, I know- there are lies, darn lies and benchmarks... Overall I like the new ACC look. Not much to do with intrazone on these devices; that will sure come in handy on the bigger PA's I run at corp and colo sites when I upgrade them.
... View more
Labels:
- Labels:
-
Configuration
01-27-2014
10:13 AM
NTP reflection attacks are occurring frequently these days. The safest approach is lock down who you obtain NTP from (I do this on my border router). Short of that, the other way to approach it is create a threat exception action to block instead of alert: Name NTP Reserved Mode Denial of Service Vulnerability ID 33273 Description NTP is prone to a DoS vulnerability while parsing certain crafted NTP requests.The vulnerability is due to the lack of proper checks in the NTP request, leading to an exploitable DoS. An attacker could exploit the vulnerability by sending a crafted NTP request. A successful attack could lead to remote DoS with the privileges of the server. Severity CVE CVE-2009-3563 Bugtraq ID 37225 Vendor ID Reference http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3563
... View more
05-29-2013
09:03 AM
I figured out how to do it in the GUI ( Object > Applications, then clicking on the the app, and then selecting "customize" next to the risk number). Is there a way from the CLI ?
... View more
05-29-2013
06:42 AM
Greetings, I'm trying to sort out if there is a way in PAN OS 5 to either squelch known hosts from appearing in the ACC risk factor list (one is my web content filter, another set of hosts are my web load balancers) or reduce the risk factor for particular hosts (under application web-browsing / general-internet/internet utility/browser based for example). I know that both of these hosts push a lot of http and https and that's fine, good and useful but I don't want to see them as risk level 4 The CLI looked to be the easiest way to go however when I try something along the lines of: set application web-browsing subcategory internet-utility technology browser-based risk 1, I get "Server error : 'web-browsing' is already in use". Is there a way to accomplish what I'm after? Thanks.
... View more
Labels:
- Labels:
-
Configuration
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks