About bdeschut

bdeschut · ‎09-25-2014

Try looking at some log files to get a clue to what's going wrong via the CLI: for example: tail follow yes mp-log ms.log Kind regards, Bob

bdeschut · ‎09-25-2014

Good to know that there is a signature for it, but it doesn't answer the question if the OS itself is vulnerable of not Kind regards, Bob

bdeschut · ‎04-25-2014

For documentation purposes: fixed in 6.0.2

bdeschut · ‎04-24-2014

Great! I'll upgrade and enable ssl decryption again. I'll update in a few days if the problem has been resolved.

bdeschut · ‎04-24-2014

I created a rule to allow traffic from EU to some system behind my Palo Alto. In the logs, I can see the source IP is linked with country "BE" (Belgium, Part of the EU). However, my traffic is blocked. When I add BE to the source (so together with EU), the traffic is allowed. Removed BE again to make sure and yes, the traffic is denied again. Is the expected behavior?

bdeschut · ‎04-24-2014

I have created an external block list like this: If you follow the URL http://ipecho.net/plain, it will (only) show you your public IP address. I use this object to allow incoming connections to my dynamic (DHCP) external IP. However, I have noticed that sometimes this connections fails. When I wget the URL from an internal system I get something like this: 84.x.y.27 But on my Palo Alto: admin@pa-vm> request system external-list show name dyn_ext_ip vsys1/dyn_ext_ip: Next update at: Thu Apr 24 13:00:11 2014 IPs: 84.x.y.2 Notice the last octet is NOT complete? Anyone else seeing similar behavior? Thanks!

bdeschut · ‎04-23-2014

Is it possible to view the countries that are included in the "EU" object? When new countries are added to the EU, will this object be updated via dynamic updates or by upgrading? Does anyone have experience with the accuracy of geo ip on palo alto? Kind regards

bdeschut · ‎04-15-2014

I doubt that there is a way to detect if a site is being detected.. However, what is nature of the problem? Are they having problems like in this post: Decryption: sec_error_reused_issuer_and_serial ?

bdeschut · ‎04-11-2014

Palo Alto released multiple vulnerabilities for the Heartbleed bug. New Vulnerability Signatures (3) Severity ID Attack Name CVE ID Vendor ID Default Action Minimum PAN-OS Version medium 40039 OpenSSL TLS Heartbeat Brute Force - Heartbleed CVE-2014-0160 alert 3.1.0 informational 36417 OpenSSL TLS Heartbeat Found alert 3.1.0 medium 36418 OpenSSL TLS Malformed Heartbeat Response Found - Heartbleed alert 3.1.0 Modified Vulnerability Signatures (1) Severity ID Attack Name CVE ID Vendor ID Default Action Minimum PAN-OS Version critical 36416 OpenSSL TLS Heartbeat Information Disclosure Vulnerability - Heartbleed CVE-2014-0160 reset-server 3.1.0 Are we fully protected when using the default settings? Could there be any negative impact when setting " OpenSSL TLS Malformed Heartbeat Response Found - Heartbleed" also to drop? Or any of the other? Kind regards

bdeschut · ‎04-10-2014

Palo Alto has just released threat and content version 430

bdeschut · ‎04-08-2014

Can you please specify which information you wish to see? How much traffic /sessions over this 4 month, or do you want an elaborate report showing different statistics?

bdeschut · ‎04-04-2014

Panorama makes backups (in 6.0 anyway)

bdeschut · ‎04-04-2014

6.0.1 has already been released if I am correct? Did you mean 6.0.2?

bdeschut · ‎04-01-2014

HULK Both Palo Alto I ran it on are in a lab. prb Thanks, clearing the session with "clear session all filter ..." works

bdeschut · ‎03-28-2014

admin@PA-vm> show session id 30711 | match start start time : Fri Mar 28 16:17:33 2014 admin@PA-vm> clear session id 30711 session 30711 cleared admin@PA-vm> show session id 30711 | match start start time : Fri Mar 28 16:17:33 2014 Note: session 30711 is my ssh session to one of the dataplane ports of the Palo Alto, so clearing it should disconnect me. (Just as an example, other sessions can also not be cleared from the CLI) When pressing the cross in the session browser for the session with ID 30711, the cross disappears, all information remains on the page about the session, the ssh session keeps on running and I get the same info for: admin@PA-vm> show session id 30711 | match start start time : Fri Mar 28 16:17:33 2014

bdeschut · ‎03-28-2014

Just a thought, but when I surf to http://youtube.com (or any other google service for that matter), I am redirected to https (SSL). Decryption will be needed in order to apply safe search restrictions

bdeschut · ‎03-28-2014

Running PANOS 6.0.1. I can't seem to clear a session from the CLI. Just tested on a PA-500 running 6.0.0-b42 and I have the same problem. Anyone knows if this is a bug? admin@PA-vm> show session all filter destination 212.x.x.x -------------------------------------------------------------------------------- ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port]) Vsys Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 37676 ms-lync-base ACTIVE FLOW *NS 10.123.48.19[52444]/L3-LAN/6 (84.x.x.x[49836]) vsys1 212.x.x.x[443]/L3-Internet (212.x.x.x[443]) admin@PA-vm> clear session id 37676 session 37676 cleared admin@PA-vm> show session all filter destination 212.x.x.x -------------------------------------------------------------------------------- ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port]) Vsys Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 37676 ms-lync-base ACTIVE FLOW *NS 10.123.48.19[52444]/L3-LAN/6 (84.x.x.x[49836]) vsys1 212.x.x.x[443]/L3-Internet (212.x.x.x[443]) admin@PA-vm>

bdeschut · ‎03-21-2014

You might also need SSL decryption as many video websites are presented over https

bdeschut · ‎03-21-2014

You can always use the API to inject the user-IP mapping in the Palo Alto For more info, refer to User-ID Best Practices - PAN-OS 5.0, 6.0

bdeschut · ‎03-21-2014

darren.g I've seen cases where the performance is increased (a lot) by upgrading the PANOS version. Except introducing new features, Palo Alto is also improving their code and making it more efficient

bdeschut · ‎03-19-2014

My bad, there is indeed only an upgrade kit for the PA-500 available

bdeschut · ‎03-18-2014

Can you also see the content of the DNS requests? It is possible that these are requests to resolve updates.paloaltonetworks.com, and that it keeps on trying to resolve this if it is not getting a response. The secondary firewall will also try to do updates, if it is configured to do this (Device - Dynamic updates)

bdeschut · ‎03-18-2014

panos did you get a chance to test this? Has a bug been reported for this?

bdeschut · ‎03-17-2014

Did you try to see the user-group / ip-user mappings in the CLI? Do you have a lot of groups in your AD and are you working with group-include lists? I have seen a case before where the Palo Alto failed to hit rules with user/group criteria after a policy install / content install, but this fixes itself after another policy push.. Kind regards

bdeschut · ‎03-14-2014

This is related to a lack of resources for the mgmt plane. There is an upgrade kit available if needed. This can be caused by a lot of things, a lot of User-ID that needs to be done, or even a lot of logging. If you have a few k of logs every minute then you'll notice slowness in the gui and high cpu, since it is the mgmt plane that handles all the logging. Kind regards

bdeschut · ‎03-14-2014

If you would like an app for this to be created, please submit a request via the following URL: http://researchcenter.paloaltonetworks.com/submit-an-application/ Kind regards

bdeschut · ‎02-14-2014

I just tested and was able to block gmail-base and got a application blocked page (decryption required). Blocking SMTP won't help since this is a webinterface to your mailbox. Without decryption, you just get a connection error, but gmail is unreachable nonetheless. PANOS 6.0 418 kind regards

bdeschut · ‎02-11-2014

You could also do this with syslog. Send the system logs to a syslog server, which filters out the login event and sends a formatted e-mail. By sending the system logs, you'll get a lot more than only login events.

bdeschut · ‎02-11-2014

Hey TedLin, Maybe worth a look: Re: Read ACC Risk Factor with API or SNMP. Kind regards

bdeschut · ‎02-03-2014

Has a cause been determined by support? Or did you get any useful info regarding this? Kind regards

Date Registered	‎10-19-2011 02:31 AM
Date Last Visited	‎05-05-2020 06:42 AM
Total Messages Posted	107
Total Likes Received	14

Online Status	Offline
Date Last Visited	‎05-05-2020 06:42 AM

Strata

Prisma

Cortex

About bdeschut