This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
About JayGolf
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About JayGolf
06-30-2022
64Posts
19Likes
2Solutions
Jun 30, 2022Last Visited
User
Activity
User
Profile
Latest posts by JayGolf
| Subject | Views | Posted |
|---|---|---|
| 103 | 06-30-2022 01:47 PM | |
| 51 | 06-30-2022 01:31 PM | |
| 176 | 06-30-2022 08:14 AM | |
| 52 | 06-29-2022 09:41 PM | |
| 50 | 06-29-2022 09:33 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 Likes | 06-30-2022 08:14 AM | |
| 2 Likes | 06-28-2022 05:00 PM | |
| 2 Likes | 06-23-2022 07:42 AM | |
| 2 Likes | 06-16-2022 07:41 AM | |
| 1 Like | 06-15-2022 04:41 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 7 Likes | |||
| 2 Likes | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 05-23-2022 02:23 PM |
| Date Last Visited | 06-30-2022 11:24 AM |
| Posts | 64 |
| Total Likes Received | 19 |
06-30-2022
01:47 PM
Hi @MichaelMedwid ,
You can try creating a new security policy and place it above the "All URL" policy. In this policy you can reference a new URL filtering profile and emailing.
In the current setup, do you have the new profile referenced in a rule that is placed before your "ALL URL" policy? Perhaps the policy is not getting hit. Could you share more details about your config?
... View more
06-30-2022
01:31 PM
Hi @ElTocjerino ,
From my experience Credly badges are only awarded to proctored exams like the PCNSE, PSE-P, etc.
... View more
06-30-2022
08:14 AM
2 Kudos
Whether you’re new to Palo Alto Networks or you’ve been working with the Palo Alto Networks for some time, you may be curious as to how to determine which version of code to use. Choosing the "right" code is a question that comes up pretty often. It is also a question that should not be taken lightly as there are many things to consider. Community member @PMKochie asked How do you determine which "release branch" to use? on a post about recommended PAN-OS versions. Here is a process that can help assist in finding that out.
When choosing which code to download It is important to understand that a major release includes significant new features and optimizations. Determining the version to use begins with understanding which major version has the features you require in your environment. You can easily check new features pertaining to a major version through the release notes.
Once a major release has been identified, I would recommend checking out the Palo Alto Networks Software Release Guidance that is maintained by PAN support engineers. Use the link to see which release is preferred by TAC at the moment and check the Upgrade/Downgrade considerations for the major release of your choosing. When finalizing the code, it is very important to refer to the security advisories and release notes known issues. Compare these issues with your Infosec team and determine the release code for your environment.
Determining which code to use is the first step you can take to ensure you are setting up your environment for success. I hope this was helpful. If you have another method of determining which code to use please feel free to share in the comments below. Also, if you don't stick with preferred releases and find yourself using others, the community could benefit from learning about your situation and why it was best.
More Info
PAN-OS Upgrade Guide
Downgrade PAN-OS
Until Next Time,
@JayGolf
... View more
06-29-2022
09:41 PM
Hi @JoHyeonJae ,
I would look into why eth1/22 went down. Try running the following commands:
- show interface ethernet 1/22 and check for errors
- less mp-log brdagent.log to provide more details regarding port issues
Also, can you clarify the exact issue you are having please? Are you saying after finding out eth1/22 went down failover to the passive did not succeed?
... View more
06-29-2022
09:33 PM
Hi @Mishin , I've forwarded this to a team member who might be able to help. Will be in touch by tomorrow.
... View more
06-28-2022
05:00 PM
2 Kudos
Hello Cyber Elites,
This is a question from @jsalmans. He is having issues with FTP inbound decryption.
"
I've had inbound decryption set up for our FTP server for some time. We noticed an issue after updating to 10.0.8 (we're now on 10.1.5-h1 ) where people seemed to not be able to connect anymore. After investigating, it appears that in Filezilla they are actually able to connect but it looks like they aren't because a TLS error occurs and the LIST command fails. Right-clicking on the remote side and hitting Refresh several times will often eventually complete the directory listing. This is with FTPS set to "Require explicit FTP over TLS" and with the Transfer Method set to Default (which I think may be Passive). This issue appears to be intermittent and sometimes it seems to connect fine.
Further investigation also showed the following:
The TLS error mentioned above when the LIST command fails is "GnuTLS error -110: The TLS connection was non-properly terminated." followed by "Server did not properly shut down TLS connection" followed by "The data connection could not be established: ECONNABORTED - Connection Aborted" and then followed by "Failed to retrieve the directory listing". Decryption logs GUI shows "General TLS Protocol Error" when this happens.
Error showing: "Server sent unsorted certificate chain in violation of the TLS specifications" at the start of each connection attempt
Changing the Transfer Method to Active seems to make it more reliable as far as connecting without a TLS error and getting the directory listed automatically (it still complains about the certificate chain)
Even with Active set, we then sometimes get a message indicating that the connection isn't secure because the server previously was detected as supporting TLS session resumption (I'm assuming this was either working before through the Palo and now it isn't or it's because when we've tested we've connected directly to the server which supports it)
Trying another client, WinSCP also doesn't list the directory on Passive.. it works when changed to Active. I have no idea if it is getting any errors/warnings as I haven't noticed if there is a log view in that software.
Turning off the decryption rule resolves all of the issues.. the FTP connection is also a lot less verbose (in another words, when decryption is turned on there is a lot more chatting with commands/responses between the client and the firewall/server)
It looks like someone else has run into an issue like this before with Passive FTP and it was related to an issue with the content packs https://live.paloaltonetworks.com/t5/general-topics/passive-ftp/td-p/11573
Anyone else having any issues or have any experience in what I can do to resolve this?
Thanks! "
... View more
Traditional URL filtering provides risk categorization ratings of domains. The categorization of domains then allows organizations to create policies suited for their environment and deny traffic to known malicious domains. URL filtering has successfully prevented communication with known malicious threats, but the problem of undetected malicious domains still persists.
Advanced URL Filtering is a real-time cloud-based inline analysis system. This allows the ability to detect evasion, targeted attacks, and new and unknown malicious web-based attacks. Together, URL Filtering and Advanced URL Filtering provide a complete solution to withstand the web-based threat landscape.
How Does Legacy and Advanced URL Filtering Actually Work ?
The URL Filtering process begins once the firewall identifies traffic as web-browsing. When a client completes the TCP 3-way handshake, a HTTP GET is sent to the web server it wishes to connect to. At the same time, the firewall compares the URL in the HTTP GET request to the PAN-DB, URL Cache, and/or performs a dynamic lookup against the PAN-DB. During this comparison, a URL is identified to be either allowed or blocked based on the category settings set in the configuration.
The Advanced URL Filtering works in conjunction with the existing PAN-DB URL filtering solution. The Advanced URL Filtering service uses machine learning to analyze the URL in real-time. The data is used to generate a verdict that the firewall retrieves to enforce the web-access rules based on the configuration.
Advanced URL Filtering Configuration
The great news is Advanced URL Filtering is enabled through the same legacy URL Filtering profile specified in security policies. No additional configuration is needed if URL Filtering is already being utilized. URLs that are analyzed via Advanced URL Filtering show up in the log monitor as the category real-time detection, in addition to the threat type.
Compatibility
The Advanced Filtering service is available on firewalls running PAN-OS 9.0 and later with the installation of content release 8390-6607 and later.
For more details on the Advanced URL Filtering subscription, check out the following TechDocs article: Advanced URL Filtering Security Subscription.
Also check out:
Enhanced Handling of SSL/TLS Handshakes for Decrypted Traffic
Activate the Advanced URL Filtering Subscription
Feel free to share your questions, comments and ideas in the section below.
Thank you for taking time to read this blog.
Don't forget to hit the Like (thumbs up) button and to Subscribe to the LIVEcommunity Blog area.
Until next time,
JayGolf
... View more
06-22-2022
11:28 PM
Hello @zinkt101 ,
Please check out the following:
session statistics
interface throughput statistics
user-id cheat sheet
NGFW
... View more
06-22-2022
02:56 PM
Hi @ChanceMaggard ,
" PAN-OS firewall models support a maximum of 16,000 IP addresses assigned to physical or virtual Layer 3 interfaces; this maximum includes both IPv4 and IPv6 addresses."
L3 Interfaces
NGFW
... View more
06-22-2022
02:52 PM
Hi @nikoolayy1 ,
I received some info from a colleague. I f it’s an unknown app, fw will allow the traffic until ACE determines the proper enhanced App-ID
Here are a few links that were shared:
SaaS Inline
ACE App ID
Unsanctioned App
... View more
06-22-2022
02:25 PM
Hi @Alpalo ,
If you would like to remove a vsys from a managed firewall start out by deleting all the references of said vsys and commit and push. You can use this as a reference
Panorama
... View more
06-22-2022
01:54 PM
Hi @Mohammed_Yasin , are you saying SIP traffic from a source to destination is not seen, but is also being denied? Could you paste a screenshot of what you are seeing?
If you are having issues with SIP traffic, please see this link regarding SIP traffic and SIP ALG
... View more
06-16-2022
07:41 AM
2 Kudos
AIOps is a platform that leverages machine learning (ML) and analytics to automate IT operations. AIOps was first introduced with Nebula (PAN-OS 10.2); since then, Palo Alto Networks' AIOps team has been working hard to reduce complexity and human error. Check out the latest feature update that will help improve your security posture instantly!
AIOps Plugin for Panorama
The AIOps 1.0.0 plugin for Panorama provides a proactive Best Practice Analysis (BPA). Every time a local commit is triggered, Panorama will reach out to the new BPA cloud service and run a security check against the changes that are committed.
The results of the BPA against the committed changes will be displayed in a pop-up window similar to the results of local validation/commit. In an instant you can learn what needs to be improved with every configuration change.
This is only the beginning of empowering network security operations teams to become proactive with ML-powered solutions. Keep an eye out for AIOps and how the suite can help you.
AIOps Plugin for Panorama Requirements
Panorama platform
PAN-OS 10.2.1 or newer
AIOps plugin is installed
Panorama needs to have the Premium license of AIOps associated with a customer account/AIOps instance
Premium AIOps instance
Device Certificate is installed on Panorama (install the Panorama Device Certificate)
Existing Device Telemetry feature is enabled (Enable Device Telemetry)
LEARN MORE ABOUT AIOPS:
AIOps for NGFW
About AIOps
Panorama Plugins
Proactive BPA Plugin
You can also check out the AIOps and BPA resource pages on LIVEcommunity.
Feel free to share your questions, comments and ideas in the section below.
Thank you for taking time to read this blog.
Don't forget to hit the Like (thumbs up) button and to Subscribe to the LIVEcommunity Blog area.
Until next time,
JayGolf
... View more
Labels:
06-15-2022
07:46 PM
1 Kudo
Hi @tamilvanan , the ENTITY-STATE-MIB provides data for line cards, fan trays, and power supplies. However, it is currently only used for the PA-7000 and PA-5450 firewalls.
Please reach out to your local SE for assistance in submitting a feature request if this is something you require. There may be more people requiring the same thing.
Thanks.
... View more
06-15-2022
07:30 PM
Hi @Sec101 , you can add a "#" in front of text you would like to be comments.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-30-2022
11:24 AM
|
Latest Tags
- pan-os
- next-generation firewal…
- NGFW
- administration
- panorama
- url-filtering
- cloud
- strata
- Upgrade-Downgrade
- 9.0
- 9.1
- AIOps
- app-id
- authentication
- basic configuration
- Basic-configuration
- bgp
- CN-Series
- configuration
- Custom URL-Category
- dynamic routing
- hardware
- initial configuration
- ipsec
- K8s
- kvm
- licensing
- log forwarding
- machine learning
- management
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks