About lewis

lewis · ‎02-26-2016

Thanks Lucky. I understand what you are saying but I guess I am just seeing a bunch of inconsistencies. What I am observing is related to malicious smtp traffic. In my screenshots below you will see IP 87.236.215.57 in the wf submission log and a corresponding wf-virus signature in the threat log as there happens to be wf-virus sig in this case. Which has been what we have grown to expect since using wf. Also in the screenshots you will see IP 182.160.108.150 in the threat log tripping wf-virus signatures but no wf-submissions. I am fine with no wf report if a wf-virus is tripped but just the inconsistency is what has me puzzled.

lewis · ‎02-23-2016

thanks Brandon_Wertz. I guess what is confusing for me is when we have wf submissions and a wildfire-virus signature is available we typically see a 1:1 corrilation. But earlier today I noticed we had about 200 wildfire-virus signatures tripped in the threat logs but no wf submissions related to these.

lewis · ‎02-23-2016

For every wildfire-virus signature tripped in Threat logs should I expect to recieve a corresponding wildfire report in the Wildfire Submissions too? Could someone answer or point me to documentation please.

lewis · ‎02-19-2016

pankaj.kumar we have used this method to deliver reponse pages in the past but not captive portal specifically. I suspect it would work fine. We had to turn it off as it impacted one of our backend systems in unique situations that required an expensive upgrade on this backend system we were not willing to pay for at this time (nothing Palo Alto was doing wrong). However, delivering a response page without ssl decryption did work great. When users went to blocked categories on https it allowed them to get response page vs the white screen.

lewis · ‎02-19-2016

this is why you need ssl decryption in order to deliver the captive portal page or https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Serve-a-URL-Response-Page-Over-an-HTTPS-Session-Without/ta-p/55998

lewis · ‎02-18-2016

this document may be of use too https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Serve-a-URL-Response-Page-Over-an-HTTPS-Session-Without/ta-p/55998

lewis · ‎02-18-2016

you need to do ssl decryption to have it work on https

lewis · ‎02-18-2016

We experinced this too. I suspect you are sending multiple users out to the internet behind one address and if you look at the reply traffic you will see it getting dropped at the NAT ip. Our firewall team suggested the group looking to use Lifesize to get in contact with the vendor to assist with resolution.

lewis · ‎02-18-2016

apparently there is a backend issue that is being worked on. not sure when it will be corrected.

lewis · ‎02-11-2016

you will likely need to get into ssl decryption to be able to accomplish this properly.

lewis · ‎02-10-2016

Yup. In the wildfire portal all 3 of us have them set to only send notifications for malware. This had always functioned properly until about a month ago. also of note that i forgot to mention is we do not even see these notifications arriving to our spam gateway. For example admin 1 gets 45 malware WF notifications and see all 45 email notifications in spam gateway sent to admin 1, meanwhile admn 2 and admin 3 configured the same as admin 1 receive 3 malware WF notifications and no wildfire email notifications sent to admin 2 and 3 are in the spam gateway either.

lewis · ‎02-10-2016

Has anyone else experienced wildfire email notifications not being sent to all team members? Basically we have 3 team members who are all setup the same to recieve wildfire email notifications. One team member gets about 95% of the notficitions via email the other 2 team members only get 5% of the notifictions via email. This has been ongoing for about a month and a support ticket is open. Just talked to another PA customer and they are experiencing the same symptoms as us too. Seems it is a backend issue at PA. Any thoughts to help resolve this would be much appreciated WildFire

lewis · ‎02-02-2016

I just received notifaction from support indicating although the action is set to deny in the policy the actual action can be different. https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/networking-features/granular-actions-for-blocking-traffic-in-security-policy.html#13774

lewis · ‎01-25-2016

I have since logged a ticket with support and they are still investigating as a possible bug as the action should only match what the policy is set too.

lewis · ‎01-05-2016

Thanks Brandon_Wertz. I will have a look at this

lewis · ‎01-05-2016

this was a part of my initial thinking too as we do have security profiles associated to the rules. However under further invesigation the traffic in question is not associated to any threat signatures.

lewis · ‎01-04-2016

Since upgrading to 7.0.4 our traffic logs now show the action of 'reset-both' and 'deny' when the rule explicitly has been set to 'deny'. This is occuring on multiple rules since upgrading from 6.1.8. Example: we have a rule to block specific applications like bittorent, http-proxy, hola-unblocker, etc and the action is set to 'deny'. But now we see a mixture of 'deny' and or 'reset-both' for this rule. Before upgrading to 7.0.4 the action was always 'deny' as this is how the rule was setup Is this to be expected? If so is there somewhere to read the explination?

lewis · ‎12-23-2015

thanks reaper and yes 7.0.2, corrected post.

lewis · ‎12-23-2015

Could someone please post the CLI command to restart the log-receiver service for Panorama 7.0.2. Unfortunately this document does not include 7.0.

lewis · ‎09-18-2015

We experience the same...Palo Alto does not support nesting unless it has change in 7.0 and up.

lewis · ‎07-22-2015

jprovineIf I am understanding your question properly to get more granular you could create a rule that only has a vulnerability profile assigned to it and forward to your SIEM. With a custom vulnerability profile you could get granular too. I may be misinterpreting what you are looking to do and disregard if I am missing your objective.

lewis · ‎06-16-2015

Running on Server 2012, 2TB, keep logs about 6 months, logs are recorded in hour increments, compress them to keep a smaller finger print, version 9.3.3, dont remember the cost but it was a small amount

lewis · ‎06-15-2015

We use Kiwi in an Enterprise environment with no issue. We are running a 5020

lewis · ‎06-10-2015

You could create a rule leveraging CP. First create a rule in CP to the external IPs to prompt user with the CP page. Then create a security rule to allow access by source IP filter (based on static IP address or a geographic location) and by source user in a specific AD group to be able to login.

lewis · ‎06-04-2015

what browser are the users with the issues using?

lewis · ‎05-19-2015

Are you talking about trying to add a security rule in your policy? If so make sure you have added the AD group to the Group Mapping Settings under User Identification. A commit is required too and sometimes I have found it may even take a few minutes after the commit for it to available to use in a security rule.

lewis · ‎05-15-2015

I believe they have different levels of importance put on categories. For example if you submit something with the Malware category, it is typically turned around within an hour provided they agree.

lewis · ‎05-05-2015

I am seeing it categorized as Stock Advice and Tools. Maybe they revisited this one for you.

lewis · ‎05-04-2015

If you go to www.virustotal.com you can look up a url and it will have a date saying when it was last scanned and its rating against AV clients. This does not give you the reasons for its categorization nor is it inline with PA's categorization but sometimes can be beneficial when trying to understand a timeline.

lewis · ‎04-21-2015

I agree, accomplished similar blocks with this method

Date Registered	‎12-30-2011 06:22 AM
Date Last Visited
Total Messages Posted	86
Total Likes Received	18

Strata

Prisma

Cortex

About lewis