About networkadmin

networkadmin · ‎06-12-2017

Curiously our 3020 running 7.1.7 has absolutel crapped itself today. It could be coincidence but it's been fine for the past six months. We're on 708-4066 as of now.

networkadmin · ‎05-30-2017

I meant to post this link https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-Cipher-suite-enforcement-in-decryption-rules/ta-p/74291 I guess I'm not sure how a decryption profile interacts to force the traffic to something that can be decrypted.

networkadmin · ‎05-30-2017

We're on 7.1.x and use SSL decryption on traffic coming in to sites we host. Is there a way to force the SSL traffic to a (strong) cipher suite(s) that the PAN can decrypt please? I found this KB but I'm not entirely clear if this lets you mandate only cipher suites that can be decrypted? https://live.paloaltonetworks.com/t5/Configuration-Articles/PAN-OS-Supported-ciphers/ta-p/71969 Thank you 🙂

networkadmin · ‎02-17-2017

Right now all we have is our PAN

networkadmin · ‎02-16-2017

So far I'm using MineMeld to pull Dshield and Spamhaus feeds to use to block inbound connections to our internet facing servers. Whilst there are loads of miners I'd love to know which ones people have found "safe" enough to use on production inbound and outbound traffic/rules and how much of an impact it's had - with 70 or so miners to choose from I simply can't test them all 🙂

networkadmin · ‎10-31-2016

Does anyone have a definitive list of which applications are required for 365 hosted Skype for Business to work please? I'm using MineMeld to product a dynamic block list of the 365 Skype for Business IP ranges published by Microsoft and I've settled on simply allowing any application to that IP range (which to be fair isn't a huge concern to me) as it's not clear exactly which applications are required.

networkadmin · ‎10-28-2016

@Brandon_Wertz wrote: I'm getting confused by what you're saying you're trying to do and how you're creating a policy to accomplish that. You said you created a security policy with ANY source / dest / application. That uses service http/https. What I'm curious about is are you using a custom URL object within the security policy on the "services" tab, or are you using a URL profile with the custom URL object you're referring to? Since you've got an any / any /any rule it's natural for the other traffic to match this rule. It's only until the domain matching occurs that traffic would transition to a different rule in your firewall. All that other "random stuff" you reference is occurring over ports 80 and 443 so it initially matches. Thanks for the reply and hopefully this will clarify. I'm adding the URL category to the Service/URL category tab on the security policy rule.

networkadmin · ‎10-28-2016

@Brandon_Wertz wrote: @networkadmin wrote: ...if I add a URL category and create a rule at the top of my ruleset that allow source "any" to destination "any" with service-http, service-https and application "any", and add the URL category that contans the domains above, I seem to see a lot of matches that I wouldn't expect to, as if other traffic is hitting them. Feels like I've overlooked something daft... thanks! How are you "adding the URL categpry?" Are you adding it in the security policy or in a URL profile? Trying on the security policy as if I try adding on a URL profile it would have the effect of blocking everything else.

networkadmin · ‎10-26-2016

Thanks but that doesn't work, I guess Sophos Central isn't quite the same app. Using the URL filter on a rule that only applies to my own PC I'm seeing Dropbox and other random stuff match the rule. Tbh I didn't expect that something that on paper looks so simple would prove so difficult for a Palo Alto box.

networkadmin · ‎10-21-2016

PANOS 7.0.4 and I'm struggling to do something that feels basic 🙂 I need to allow anything on the LAN access to *.sophos.com *.sophosupd.com *.sophosupd.net *.sophosxl.net ocsp2.globalsign.com crl.globalsign.com as per https://community.sophos.com/kb/en-us/121936 Right now we use captive portal but of course machines might try to update when nobody is logged in on them. I can't add "address" objects for entire domains (can I?!) and if I add a URL category and create a rule at the top of my ruleset that allow source "any" to destination "any" with service-http, service-https and application "any", and add the URL category that contans the domains above, I seem to see a lot of matches that I wouldn't expect to, as if other traffic is hitting them. Feels like I've overlooked something daft... thanks!

networkadmin · ‎08-22-2016

We're running a regular User-ID agent against our DCs. 99% of the time things are fine but we're getting calls from random people that every so often they're suddenly getting prompted to authentiate by the captive portal on the PAN and we cannot understand why as they are connected to the network, typically wired, and are using domain resources with absolutely zero issue - it just seems to happen randomly. We're on PANOS 7.0.8 and the 7.0.x User ID agent (can't recall/check the exact version right now). Where do I begin? 🙂

networkadmin · ‎08-17-2016

We have a 3020 running 7.0.8 and are experimenting with MineMeld. As soon as we get close to 5k IPs on the combined EBLs we get an error on a EBL refresh that it's been truncated as it's over the limit. Palo Alto's own KB suggests that on an entry level PA-200 there is a limit of 50k items on all EBLs combined. https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-and-Limitations/ta-p/58795 Support are telling me that the limit on 3020 is 5k which doesn't seem to make sense as a) why would a 200 support more than a 3020 and b) what's the point of something like minmeld if you can only have 5000 IPs? Any clarification would be great.

networkadmin · ‎08-03-2016

Thanks, one concern/query I do have is how people are using minemeld given there seems to be total of 50,000 entries maximum across all EBLs? I don't know the count on the ProofPoint feed for example but I could imagine things being quite large. Also (and I'm hoping to speak to ProofPoint) does anyone know if there is masses more on their commercial feed than the open source one? I ask as I believe the ET Pro subscription inclues a ton of suricata/snort rules which we cannot use with our PAN, so essentially the only piece we'd be using is the EBL content via minemeld. Thanks

networkadmin · ‎08-03-2016

I've been experimenting with MineMeld and have to say I love it so far. I was browsing the list of feeds and looked at the ProofPoint ET Pro feed and I wondered if anyone knows how this feed works? I got pricing and it's quite reasonable, but I'm not 100% clear how it integrates and can be integrated with Palo Alto, does anyone know? Be interested in any views on the most effective inbound blocklists?

networkadmin · ‎07-31-2016

OK thanks, is there any easy and supported way to combine everything across a single physical link between the switch and the PAN? Essentially I would have: L3 interface/subinterface between PAN and switch L2 interface to inspect I'm guessing L2 and L3 cannot be mixed on the same physical interfacel which makes sense and hopefully the topology will be changing fairly soon to accomodate this so we don't need to be doing it at all.

networkadmin · ‎07-30-2016

@jvalentine wrote: A v-wire requires exactly two physical interfaces. What you're asking for can be accomplished using a single L2 interface on the firewall and enabling vlan tag rewrite. In essence you are bridging two vlans together. Thanks, bit confused now as you said it requires two physical interfaces then suggested it can be done with one? 🙂 If it needs 2 in order to be supported so be it, just frustrating when it's using NICs and all going into the same switch...

networkadmin · ‎07-30-2016

Right now we use a standard vwire with 2 physical interfaces. We're about to make some hardware changes that means that the vwire input and output will be from/to the same physical switch. If I have to use 2 interfaces then on that switch I'll just be using two untagged ports from/to the appropriate VLANs on the switch. But do I have to use 2 physical interfaces? Is it possible to use a single physical interface with subinterfaces (I think that's the magic word?) so the input and output are simply tagged across the one physical link? Apologies if my terminology is way off here, but hopefully I've explained it well enough, if any clarification is needed please just ask 🙂

networkadmin · ‎07-28-2016

Thanks Brandon, tbh it's a dog of a badly worded article but if 50k is the magic number that's all I need to know 🙂

networkadmin · ‎07-27-2016

Thanks, but that article doesn't make sense unless I'm totally misreading it. When running PAN-OS 7.0.x on a PA-200, it can have: A maximum of 10 External Block Lists A maximum of 50000 IPs in all external lists combined. (1 list with 50000 IPs or 10 Lists with 5000 IPs both are supported) OK so a PA200 can have 1 list with 50,000 IP's that's great but: Hardware Maximum Address Entries PA-200 PA-500 2500 PA-3020 5000 PA-3050 PA-3060 PA-5020 10000 PA-5050 40000 PA-5060 PA-7050 80000 So a PA3020 can only have 5000 entries whilst that table also states that a PA200 can only have 2500 entries. Some of the reputation feeds out there can be 20k entries and it's hard to believe that a PA200 could use that but a PA3020 could not.

networkadmin · ‎07-27-2016

I've been experimenting with MineMeld and love it - brilliant product 🙂 That said, I'm struggling to get a clear idea what the size limit is of each blocklist. https://live.paloaltonetworks.com/t5/Learning-Articles/How-are-Dynamic-Block-List-Entries-Counted-on-the-Firewall/ta-p/62068 suggests even a PA200 can handle a list with 50k entries but in the same article it suggests a PA3020 has a limit of just 5k entries. What is the limit please? For exampel the Alienvault reputation feed is approximately 16k entries. Thanks 🙂

networkadmin · ‎05-10-2016

Yes, but weird but in the logs there are several data filtering entries for the .exe that show "web-browsing" as the application, then it shows "google-update" and has downloaded. All are on port 80 which is still a little unusual.

networkadmin · ‎05-10-2016

How have people done this in practise? We would like to prompt people so they have to choose "continue" to download PE executable files. I know this only applies to "web-browsing" but when I test this, a Google Chrome update shows as "web-browsing" and isn't interactive so the user doesn't get the prompt to continue, nor does the update download. Seems a very nice feature in practise but curious how people have tuned it not to cause problems.

networkadmin · ‎04-11-2016

I'm being daft, rule 2 was "browser based" so it would include QUIC but the URL filter on that rule wouldn't apply as it's UDP traffic is my assumption?

networkadmin · ‎04-08-2016

I had two firewall rules in the following order: Any Internal > Any External > Any Application > Service TCP 80/443 Any Internal > Any External > Application filter "web browsing" > Service "App Default" With a "decrypt" profile on web based email which is allowed by the URL filtering profile on the first rule, but blocked by the second rule. If I open my browser on my PC and go to Gmail with both rules in place, I look at my Gmail in the browser, and it is not using the PAN certs, and in the PAN logs I see the traffic is not decrypted, and the app shows as QUIC and is allowed using the second rule. If I change the second rule to: Any Internal > Any External > Application filter "web browsing" > Service TCP 80/443 And repeat the Gmail test, now Gmail shows the PAN certificate and in the PAN logs the traffic is decrypted and is allowed using the first rule. In the initial scenario, why didn't the first rule apply? I'm using 7.0.6 Thanks

networkadmin · ‎04-04-2016

Seeing quite a lot of this for various sites/traffic which is undoubtedly legitimate. Is it appropriate that it flags so high? I'm not entirely comfortable simply excluding it but it's alerting so much it's almost "boy who cried wolf".

networkadmin · ‎03-10-2016

Thanks Luciano, so what I did was get both boxes on the same revision of all updates, then as you say simply exported and imported and then committed the config and it took it first time with no complaining or anything. So right now the new box is sitting in the rack waiting for a window to cut across - seemed remarkably easy 🙂

networkadmin · ‎03-08-2016

@reaper wrote: you should be able to simply export and import the configuration and be up and running in minutes one of the few caveats would be if FIPS mode is enabled or the master key has been changed, in which case appropriate steps need to be taken to get the PA-3020 in the same operational mode before moving config, but other than that there should be no issues Thanks, had a chat with an SE today who suggested the same, albeit Palo Alto seem very careful to use words like "should" rather than saying it will work. The rough plan as of now is to setup the new 3020 using the management interface as if it's a brand new unit, so we'll activate licenses and update PANOS to the same as the 500, and ensure we have updates, then I'll pull the config across and see what happens when I hit commit. Given the interfaces will match up I'm reasonably hopeful it'll go OK, just be nice if there was a bit firmer response from Palo Alto on what is/isn't officially recognised 🙂

networkadmin · ‎03-07-2016

We have a 500 that we're replacing with a 3020 which arrived today. Should I need to do anything to migrate the config across other than an export and import of the running config? I know some things like ports will clearly need addressing but in terms of getting the base config across is there anything I need to be particularly aware of please?

networkadmin · ‎12-04-2015

We currently use Wildfire on "PE Executable" filetypes on our PA-500. I'm interested in using it against Office documents and PDFs as those are clearly a major threat vector. Thing is, whatever model of Palo Alto I look at, they all seem to show low WildFire limits which makes me question how they cope with things like SMTP where there may be lots of emails with attachments passing through the firewall? PA-500 10 files/minute PA-3020 50 files/minute PA-7050 100 files/minute This just doesn't seem like much given how many emails might be flowing so I'm wondering if I've missed something fundamental?

networkadmin · ‎10-23-2015

I have a ton of entries in my spyware logs for DNS attempts to nsatc.net Some digging suggests this is a site run by Microsoft related to Windows Updates. False positive?

Date Registered	‎02-12-2010 10:34 AM
Date Last Visited	‎09-16-2017 04:35 PM
Total Messages Posted	245
Total Likes Received	16

Online Status	Offline
Date Last Visited	‎09-16-2017 04:35 PM

Enterprise

Prisma

Cortex

About networkadmin