About nextgenhappines

Hi,   I ran into the same issue about 2 months ago.  I restarted the userid process on one of my UserID box and that addressed the issue, that pair was using content update older than 8507.    After that I upgraded all the UserID redist firewall newer content (>8507),  I don't have that same issue again.     Can you check if the firewall content release version is newer than 8507?   (12/21/2021; updated 1/13/2022) A certificate used by PAN-OS software to authenticate to the WildFire Private Cloud appliance (WF-500) and URL Filtering Private Cloud appliances (M-500 and M-600 in Private URL Filtering Cloud mode) and that impacts User-ID redistribution expired on December 31, 2021. We released Emergency Content release version 8507 on December 21, 2021, to update this certificate so that PAN-OS appliances can authenticate to these private cloud appliances. Immediate action is required for all of your PAN-OS appliances that use either the WF-500 WildFire Private Cloud appliance or the M-500 or M600 appliances in Private URL Filtering Cloud mode. UPDATE: User-ID redistribution is also impacted and requires that you complete additional steps before you are able to utilize the renewed certificate. If you have not already done so, you must update your appliances to Content release version 8507 or a later version to ensure that these appliances (including hardware firewalls, VM-Series virtual firewalls, and CN-Series container firewalls) will continue or again connect to WF-500 and URL Filtering private cloud appliances. Please refer to the customer advisory for detailed information about utilizing your renewed certificate.   ... View more

@simsim    The pro is easy to setup to allow remote access to your network using RDP.. The con is without sufficient protection and monitoring in place (ie MFA, patch system, log monitoring), once the hacker gains access via RDP.  The damage that can cause is unlimited.     E   ... View more

Let's see, once I am able to RDP login to a host which is part of the AD.  The opportunity is endless.     I can start by following these steps which I just finish #2,   Reconnaissance Initial intrusion into the network Establish a backdoor into the network Obtain user credentials Install various utilities Privilege escalation/ lateral movement/ data exfiltration Maintain persistence Google "pass the hash" , "windows privilege escalation"      or I just drop a ransomware on the file servers to lock all the user data , etc. etc... ... View more

Let me understand your question,   Allow anyone from Internet able to connect to a system listen on Remote Desktop protocol on your network?    Is that what you are asking?   1.  How update is the system patch level? 2.  There could be a chance of non-publicly disclosure bugs on RDP can use a backdoor (also known as 0 days attack, which I disagree with that term). 3.  How is the password complexity and length?  Does it require multi factor authentication?   Is it a client cert based login authentication? 4.  If I am able to login to that host,  is that system part of Corp Active Directory?  How secured is the AD admin accounts? and more and more...     ... View more

thanks!  let's us know if the change helps! ... View more