Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About rkoenig
About rkoenig
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
02-26-2020
05:10 PM
That is what I usually do when troubleshooting, create a rule specifically for my traffic, access the sites and then review firewall traffic to determine the application used.
... View more
05-24-2019
12:03 PM
Apparently this is a known issue.
... View more
05-10-2019
03:55 PM
Same question here but regardless of the /32 it has been working on Panorama and is still working correctly on the firewalls even with the /32 for a few years. https://live.paloaltonetworks.com/t5/General-Topics/Dispaying-object-name-in-traffic-monitoring/m-p/132812#M47126 The problem is that it stopped working and how do you resolve it or troubleshoot it?
... View more
05-10-2019
03:07 PM
Prior to an upgrade Panorama was able to resolve an IP address to the host/object name of a local address object. For some reason, the resolution has stopped working and support seems to not know what I am referring to but yet it is discussed here https://live.paloaltonetworks.com/t5/General-Topics/Dispaying-object-name-in-traffic-monitoring/m-p/132812#M47126 how do you troubleshoot it, when it stops resolving?
... View more
- Tags:
- ip address
12-20-2018
11:44 PM
Thank you, updated as soon as we could.
... View more
12-20-2018
09:02 AM
Same question, please advise.
... View more
10-19-2018
01:10 PM
Yes, fortunately the PAN automatically conducted a PCAP on the unknown-tcp packets, those have been exported and submitted to tech support as well. One interesting thing is that the byte size of the packets that were allowed were consistantly 374 bytes, the traffic that was denied and identified as "unknown-tcp" is above 374 bytes, sometimes 10.8K, most of the time 15.3K. I dont know if that contributes to the problem or not. As I mentioned below our HL7 Server Admin stated: HL7, most if not about all, messages begin with the “MSH” segment, Message Header. These files, the HGS Meditech Lab Charge files, are in an HL7 batch. The first segment is “FHS” – File Header, the BHS – Batch, then MSH and all the data. So it is a “Batched” HL7 file, first time in 20+ years of doing this that I run across a charge file like this
... View more
10-19-2018
12:54 PM
Yes, they are required to use seperate ports for each customer, the ports will be defined between the HL7 server admins at each site. Since we are in the testing phase I may go back and configure the security policy back to allow HL7, however none of the traffic is being defined as HL7, it states incomplete in the application column. As I mentioned sometimes the firewall identifies the traffic as HL7 sometimes it says incomplete, in this case it said unknown-tcp. Initially the security policy specific HL7 & application default, 99% of the traffic passed, even when the application was categorized as incomplete. It's only the traffic that was "unknown-tcp" that was getting denied. Then I tried HL7 and ANY - same problem. Then I try ANY application, ANY port - same problem. Then I created a policy to allow "unknown-tcp" I dont believe I should have to do that because a policy that allows ANY application over ANY service/port should be sufficient. Correct? Now traffic passes but I would like to get to the root of the issue thus the reason I opened a ticket and posting here to see if anyone else experienced the same or similar issue or perhaps there is a way to improve the PA firewall ability to properly detect HL7 traffic.
... View more
10-19-2018
12:18 PM
Yes, we have usually set the updates to occur through dynamic updates every wednesday. You bring up another interesting point in that some but not all of the traffic is identified as HL7. I do have a case opened, I thought I would post in the community to see if anyone else was experiencing the issue. I would love to be able to use the HL7 application for ALL traffic vs specifying ports.
... View more
10-19-2018
09:11 AM
We are standing up some new PA firewalls and have been testing with some HL7 servers. Testing has been going well until recently where "unknown-tcp" traffic gets denied. It seems that it only happens when the transfer of a specific file/message is being transferred. I spoke with our the HL7 Interface/Server guy and he shared this bit with me.. "HL7, most if not about all, messages begin with the “MSH” segment, Message Header. These files, the HGS Meditech Lab Charge files, are in an HL7 batch. The first segment is “FHS” – File Header, the BHS – Batch, then MSH and all the data. So it is a “Batched” HL7 file, first time in 20+ years of doing this that I run across a charge file like this." I got around the issue by creating a security policy allow "unknown-tcp" between the two specific servers but is that the only solution? Thoughts?
... View more
- Tags:
- HL7
07-26-2018
08:08 AM
" Yes this can be done through the API" Are there any examples of how this could be done available?
... View more
07-26-2018
08:02 AM
Hi Vinay, Thanks for responding, right now I am interested in the S2S VPN, we are in the process of moving existing connections from an ASA to a PA-5220. I am hoping that we can use Ansible for VPN in the same manner that it can be used for Sec Policies and Change Management. Using Ansible For Firewall SEC Policy Change Management Process
... View more
07-25-2018
09:17 PM
Has there been any further update for using Ansible to create S2S/B2B VPN Tunnel? Can it be done through the API?
... View more
04-21-2017
02:56 PM
Can Ansible be used to communicate to Panorama and create objects, policies etc. ?
... View more
03-13-2017
01:14 PM
Hi Luigi, that is a good question, I have tried searching for the document they sent me but have been unable to find it. I will check with McKesson support and validate if the document is public and if they provide the content in a machine readable format.
... View more
03-12-2017
05:33 PM
I apologize if this has been answered in previous posts, I've tried searching and it seems that I'm getting bit and pieces but not the whole picture.
How would I go about creating my own list of IPs and then customizing Minemeld to mine \ gather the IPs to be used in an EDL. We have McKesson products and they recently send us a PDF with a large list of IPs and URLs that need to be allowed in order for their products to function. I was thinking that in the long run it may be easier to create a custom list vs manually creating a security policy.
... View more
01-12-2017
05:17 PM
Nice job, we were experiencing the same issue. What made you decided to try external DNS servers? Is there a specific URL that is not being resolved?
... View more
11-18-2016
04:03 PM
Thanks for adding the ability to easily modify the config! Cut and paste and all done. Everything looks good so far!
... View more
10-17-2016
12:43 PM
I did thank you! I downloaded 14.04, followed the instructions and everything went rather smooth.
... View more
10-14-2016
07:01 PM
Got all the way through flawlessly, (or so it seems) thanks!
... View more
10-14-2016
03:35 PM
I apologize, I just realized I have Ubuntu Server 16.04.1, when I went to the download page 14 was no longer available.
... View more
10-14-2016
02:42 PM
During step 5 of Manually install MineMeld on Ubuntu Server 14.04 I get the following Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation:
The following packages have unmet dependencies: minemeld : Depends: librabbitmq1 but it is not installable Depends: libsnappy1 but it is not installable Depends: libleveldb1 but it is not installable rsyslog-mmnormalize : Depends: rsyslog (= 8.17.0-0adiscon2trusty1) but 8.16.0-1ubuntu3 is to be installed E: Unable to correct problems, you have held broken packages.
... View more
01-13-2016
12:11 PM
Some good info here. We are getting ready to configure some security policies and I was hoping to see how others were handling it. One of my thoughts was / is .... Well we are getting ready to implement Panorama, so I was thinking that we could setup a global rule that is application based and then a local rule that is URL based, then monitor traffic and see which way is the most effective.
... View more
06-21-2015
01:07 PM
I was wondering the same thing. (DNS Sinkhole) I'm getting ready to implement it on our firewall.
... View more
2 weeks ago
26Posts
0Likes
0Solutions
Mar 25, 2020Last Visited
User
Activity
User
Profile
Latest posts by rkoenig
| Subject | Views | Posted |
|---|---|---|
| 209 | 02-26-2020 05:10 PM | |
| 863 | 05-24-2019 12:03 PM | |
| 873 | 05-10-2019 03:55 PM | |
| 879 | 05-10-2019 03:07 PM | |
| 3388 | 12-20-2018 11:44 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 6 | |||
| 2 | |||
| 1 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 06-12-2015 11:14 PM |
| Date Last Visited | 2 weeks ago |
| Total Messages Posted | 34 |
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
