About kfindlen

kfindlen · ‎10-24-2014

Using a custom signature to override the application identification performed by the firewall is limited to when the traffic is identified as only a base application which has a decoder. Some examples of base applications with decoders: web-browsing (http context) ssl ftp dns smtp .. and others.. You can find the decoder list current as of content 424 in the Custom Application Signatures document on page 7. What this means in practice is that a session which is identified as one of the apps listed above can utilize custom signatures to further identify the traffic. In your case, o nce the firewall identifies the application as skype there is no decoder being utilized on the session, so custom signatures would not be applied. The custom signature can not override the built-in signatures for other applications which only have a dependency on one of these base apps (skype has a dependency on ssl). Like others have mentioned, I believe your only option is to utilize URL filtering to not apply the skype block when the URL matches "manager.skype.com", or explicitly allow any traffic to that URL.

kfindlen · ‎09-30-2014

Is your upstream Sonicwall performing SSL decryption? The connection between the firewall and the PAN-DB servers is not compatible with SSL decryption.

kfindlen · ‎09-26-2014

The default action is defined by Palo Alto Networks on a per-threat basis as either alert or block. Every vulnerability has a "block" behavior. Some block behaviors send a reset to the server or client, or in this case, both. For this example the default action is block, and the block behavior is reset-both. Even though the action being taken is block, the threat log will show the block behavior that was used to terminate the session under the action column. Quick edit: If you want to change the "block" behavior for a threat, you must configure an exception.

kfindlen · ‎09-18-2014

Finally found a build of DodgeChrome with some google-fu and did some testing. Traffic generated by this client is identified as unknown-tcp by the firewall, not web-browsing. If you block unknown-tcp the client will be unable to transfer data. Custom signatures will not be possible for this because the string you are looking for is less than 7 bytes, and with the session identified as unknown-tcp you can not utilize HTTP contexts for pattern matching.

kfindlen · ‎09-15-2014

Are you expecting that the traffic will never reach the Edge firewall because of the deny policy on the Core, and therefore you should not even see a session on the Edge? Are the Core and Edge firewalls different vsys on the same physical device?

kfindlen · ‎08-18-2014

There is an app, opera-mini, which will detect the Opera Mini browser. Opera mini operates by using a proxy server over SSL to retrieve all content. Enabling SSL decryption will break the connection so layer 7 inspection of this traffic is not possible. To block access just create a security policy with the opera-mini application and set the action to deny. This application also covers the desktop Opera browser when used in the offroad mode.

kfindlen · ‎06-19-2014

This is not correct. The file will be uploaded to the WildFire service if the MD5/SHA256 hash has not been previously analyzed. The process is the same for all supported file types.

kfindlen · ‎03-31-2014

An application group would be the best way to accomplish this. You can create the application group from the CLI with the "set application-group <name> [ app1 app2 .. ]" command. admin@pan# set application-group Test [ facebook gmail web-browsing ssl ] [edit] admin@pan# show application-group Test set application-group Test [ facebook gmail web-browsing ssl ] Each application should be listed with a space as a delimiter. Once created here the application group will be visible on the web UI and can be used in a security policy for the application criteria. Hope that helps.

kfindlen · ‎10-31-2013

In the vast majority of cases restarting the device server or management server will not cause any impacts on traffic passing through the dataplane. These two processes are major parts of the management plane processing on the device. The management server is the core process that is used to run the CLI, web UI, work with the configuration files, and perform most operations on the management plane through other processes. The device server is used for communication between the MP and DP. It's main job is to push configurations to the DP during the commit process and also service some requests coming from the DP such as URL categorization. It might be best to schedule the restarts during a maintenance window to minimize impact.

kfindlen · ‎10-31-2013

Why would you need the original MAC address? When the device is in HA it will never source traffic from the non-HA interface MAC address. The only way to determine the non-HA MAC is to disable HA. The non-HA value is not stored in the configuration or system state in any way, it is simply derived from the device serial number.

kfindlen · ‎10-15-2013

Here is the correct call to modify the phash value of an administrator. http:// <firewall>/api/?type=config&action=set&key=<key>&xpath=/config/mgt-config/users/entry[@name='username']&element=<phash>password</phash> Replace the <firewall>, <key>, username, and password attributes to appropriate values. Once the call is made you should be able to see the changed value via the get API call but the change will not take effect until a commit is completed. You can also use an API call to generate the password hash. http:// <firewall>/api/?type=op&cmd=<request><password-hash><username>user</username><password>password</password></password-hash></request>

kfindlen · ‎10-14-2013

Are you using an iPhone 5 or 5s? I have tested X-Auth with IOS7 on the iPhone 5 and I have not seen any issues on both Wifi and LTE connections.

kfindlen · ‎10-11-2013

These errors indicate connectivity issues to the configured DNS servers. Has there been any events which may have caused a loss of connectivity between the firewall and those IPs?

kfindlen · ‎10-11-2013

There is no capability through the web UI to bulk edit policies. The only way I have seen is to either create SET commands via the CLI to update all of the policies, or export the XML, manually edit to add the profiles and then import it back to the device.

kfindlen · ‎09-04-2013

The low session limit is caused by not having a VM series license installed. When the VM does not have a license installed a small amount of sessions are allowed for initial configuration and testing purposes. Once a valid VM series license is applied the appropriate session limits will be enforced based on the capacity of the license. Verify on the Device tab -> Licenses that an auth code has been applied. There was an issue in PAN-OS 5.0.0 where a VM series without a license applied would not allow any sessions to be created at all. This issue was fixed in a later maintenance release.

kfindlen · ‎08-13-2013

This type of request should be directed to Sales. I'm not aware of a specific process to transfer individual licenses between devices, but anything to do with purchasing new licenses for a device is handled by the Sales group. Like Harsha mentioned, support only has a process for transferring licenses between devices during an RMA.

kfindlen · ‎08-07-2013

Is the user being utilized to authenticate to the API a superuser? A non-superuser account will cause the password hash to be removed from the output.

kfindlen · ‎08-06-2013

One option would be to export the URL logs via syslog to an external SIEM or other product which can produce more detailed reports. Syslog would be the best way to export this data from the device. For enhancements to reporting on the Palo Alto itself, I would suggest working with your Palo Alto Networks Sales Engineer about your requirements and possibly getting a feature request submitted.

kfindlen · ‎07-11-2013

The "Group Member" value in the group mapping profile should not set to the group name. This value should be set to the attribute returned by the LDAP server that identifies a member of the group. In the screenshot it looks like this attribute is "uniqueMember". If you expand the uniqueMember attribute in your browser what attribute name is listed for each user? The attribute name used for each user that is a member of the group should be used as the "Group Member" value. The search filter for the Group Objects should also be set to "objectClass=groupOfUniqueNames". With the current search filters the firewall is going to query without a filter to get a list of users and groups configured. To configure the User Objects search filter you should query a user from the LDAP server and see what objectClass is returned which is unique to a user, then configure that as the User Objects search filter with "objectClass=xx"

kfindlen · ‎06-25-2013

The CPU output from the TOP command can not be used to determine dataplane load. The pan_task processes are always at 100% CPU utilization as they are the individual software processes which perform packet processing on the dataplane. As others have stated, you should use output from "show running resource-monitor" on the CLI to determine the true dataplane load. This command is also run and logged to the dp-monitor.log files on the dataplane so you can look at historical utilization as well. In the output from this command on a 2050 you will see 4 individual cores listed, 0-3. The pan_task processes shown in the top output correspond to cores 1-3 listed in this output. On other platforms you will find a pan_task process is running for each core beyond core 0.

kfindlen · ‎06-21-2013

You can use the "request password-hash" command on the CLI of the firewall to generate these. admin@lab-firewall> request password-hash username user password test1234 $1$tjlcdrco$q/rIosAGEBWJQtFeRy9AX0

kfindlen · ‎06-19-2013

As panos linked to, HA functionality on the VM series firewalls is limited to what is referred to as HA-lite. This active/passive mode supports configuration sync between two devices, but not session sync so in the event of a failover all sessions would need to re-established. The recommended HA configuration is a pair of VM firewalls with HA configured for active/passive. Utilizing vMotion should work as well since it keeps the VM state and moves it between hosts, but it may be slower to failover than an active/passive pair of devices.

kfindlen · ‎06-19-2013

Direct integration with an external UPS is not currently supported in PAN-OS. I would suggest contacting your local SE to file a feature request if this is a requirement in your environment.

kfindlen · ‎06-10-2013

When utilizing the agentless User-ID on PAN-OS 5.0 and above a LDAP group mapping profile must be configured in order for the firewall to resolve FQDN domain names to the Netbios equivalent. When the LDAP server profile and group mapping settings are configured the firewall will query some LDAP attributes in the configuration schema to resolve the Netbios name configured on the domain controller. The external, standalone agent behaves similarly but uses a different mechanism on the local machine to resolve the domain's Netbios name.

kfindlen · ‎06-06-2013

panos is correct. This is not currently supported.

kfindlen · ‎05-28-2013

When you create a custom application you can also specify the default ports that the application will use. When you create or modify a custom application navigate to the Advanced tab and under the Defaults section you can define the default port definitions. When the security policy is defined with the custom application, and service is set to application-default, the firewall will use the application's defined default ports. Hope this helps.

kfindlen · ‎05-28-2013

I would think that a domain account being used for RDP would need to be excluded as well or the agent would think a new user logged in and would update the mappings as needed. The agent is simply looking for particular events hitting the security log on the domain controller. If the client machine authenticates a remote support session (or any other non-interactive login) in the same way that a normal login would be processed then the Agent has no way to differentiate between the two. The only capability the Agent has is to exclude specific usernames that are not being used for a normal user login so service accounts don't cause the active user's mapping to be overwritten.

kfindlen · ‎05-27-2013

The hotspot-shield application has dependencies on both the web-browsing and ssl applications. As the session transitions between applications it could match different policies, which could in turn apply a different set of security profiles. If the traffic flow from this particular client was legitimate web-browsing instead of hotspot-shield, which security policy would it hit? Does that policy have URL filtering applied? It is possible that the first few packets after the TCP handshake hit a different policy which has URL filtering enabled. Shortly after the URL is sent by the client and is logged, the application transitions to the hotspot-shield application and it's associated security policy. If you can reproduce this URL log behavior on a test machine a good test would be to create a security policy for that source IP for web-browsing and ssl without any profiles enabled. If creating that test policy stops the logs from generating for that particular client then the scenario I describe above is the likely cause and would be expected behavior.

kfindlen · ‎05-27-2013

If a system account performs an authentication to the AD server then the user mapping will change. You can configure the Agent to ignore specific user accounts on the domain by configuring the ignore list. If the ignore list was configured for the "administrator" account in this case, the Agent would not create a mapping for that account whenever it authenticates. See document: https://live.paloaltonetworks.com/docs/DOC-2893

kfindlen · ‎05-23-2013

The Remote Desktop protocol is encrypted so granular control over specific functions within the session is not possible from the firewall. You will need to utilize group policies on the server side machine to disallow drive mapping from the client.

Date Registered	‎02-09-2012 05:00 PM
Date Last Visited	3 weeks ago
Total Messages Posted	177
Total Likes Received	41

Online Status	Offline
Date Last Visited	3 weeks ago

Strata

Prisma

Cortex

About kfindlen