About OtakarKlier

OtakarKlier

Hello, I'm sure there is a reason you have two external IP's for this? But it can be accomplished with one. Check out this article on NAT. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CllzCAC Hope it helps.

OtakarKlier

Hello, If you only have one connection to the internet just have the ISP advertise it and use static to the ISP. BGP is really used for if you want to advertise he same IP's via two different internet connections/ISP's. Hope that helps.

OtakarKlier

Hello, Any certificate generated with RSA 2048 is going to be secure. However this will not get rid of the finding with the vulnerability scanner. Hope that answers your question.

OtakarKlier

Hello, It wouldnt matter. When the ISP hands it off to the next one, the tags get striped so its really not worth the effort. If there are issues, increase bandwidth. Regards,

OtakarKlier

Hello, Are you trying to block facebook? If yes then remember that the custom URL categories work ahead of the predefined ones. Regards,

OtakarKlier

Hello, The upgrade will require a reboot, so the reboot time of your Panorama is how long it will take. Also make sure to upgrade all the devices in use including the M200 and PAN's using the best practice upgrade method. Regards,

OtakarKlier · Re: After upgrading Panorama from 8.1.12 to 9.1.2, unable to switch context

Hello, Make sure the PAN's are also running the same version of code. Regards,

OtakarKlier

Hello, Best is to get a valid cert from your PKI that is recognized by the vulnerability scanner. That way it will see it as not a self-signed certificate and hopefully when generated it was made using RSA2048 or higher. Regards,

OtakarKlier

Hello, I'm not sure since I have never donethis. However you might want to talk to Palo Alto sales team. Also get the seller to release teh serial number from their portal. Good luck.

OtakarKlier

Hello, Here are a few links that should help out. Configuring SSL Decryption: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmyCAC Implementing: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0 Troubleshooting: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgHCAS What I dis was apply it only to one user, me. Then from there slowly added additional users. I also am using user-id so I can do it by AD groups. Hope that helps.

OtakarKlier

Hello, Just export the config from the VM and import it into the Prod PAN. Regards,

OtakarKlier

Hello, Panorama does this automatically. I use a script and Windows Tasks to grab the config via the PAN's API. C:\curl\bin\curl -kG "https://<IP OR DNS>/api/?type=export&category=configuration&key=<YOUR API KEY>" > <DESTINATION PATH> Regards,

OtakarKlier

Hello, Have you tried enabling tunnel monitor? https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/vpns/site-to-site-vpn-concepts/tunnel-monitoring.html https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloYCAS Hope this helps.

OtakarKlier

Hello, It would only work for users on the inside of your network. Any QoS tags on a packet are stripped by the ISP and internet routers. So you can QoS your internal network, but nothing going over the internet. Regards,

OtakarKlier · Re: Paloalto PAN OS7.1.6 to PA 3250 8.1.13 migration

Hello, Its best if both PAN's are on the same version. That way you can just copy the config over using export xml. Or if the config is a mess, you can start over with a new config from scratch. Regards,

OtakarKlier

Hello, In your current RDP policy, does it have ms-rdp and any as the service? Maybe a snippet of the policy you are working with. Please advise,

OtakarKlier

Hello, Yes, the PAN can do this. However there are a few things you have to remember. 1. the applications the PAN knows have a list of default ports https://applipedia.paloaltonetworks.com/ So in your case the firewall is working as expected only blocking the RDP application on port 3389. Since you want top block it on all ports, you'll need to change the 'Service' to ANY. What the 'Service' is the 'Port'. If you list only the application, it will use what the PAN has builtin. Selecting ANY will block ms-rdp on all ports. Hope that helps.

OtakarKlier

Hello, You'll need someone who has the 'SuperUser' privilege to grant it to your account. Regards,

OtakarKlier

Hello, That is a good question. Perhaps someone else could jump in and help out. You can sort he session browser by start date/time, maybe that can help to narrow down your search? Regards,

OtakarKlier

Hello, Also I would suggest you offload the logs to a SIEM for longer retention and analysis purposes. Also historical data if the PAN should wipe out its logs or the unit needing to be replaced. Regards,

OtakarKlier

Hello, Not sure I understand what you mean by your question: " what is mean by current Retention = 26days ?" To clarify what I was saying, the more traffic that flows through the firewall, the more logs are generate, so more space is taken up by the logs. It's almost impossible to gauge how much retention you will get. Hope that helps.

OtakarKlier

Hello, You might want to read up on what is truly disabled via FIPS mode. Also here is an article on disabling weak ciphers. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMNPCA4 Cheers!

OtakarKlier

Hello, The length of time answer is 'it depends'. I know I'm not a fan of it as well. However it depends on the model of the PAN you are running and how much disk space was located to the logs partition. Basically more traffic = more logs = less days of retention. Regards,

OtakarKlier

Hello, While you can do something like show sessions via the cli. I prefer the GUI in this since you can just export the data as a csv and manipulate the data that way, e.g. sort by start. However I'm sure someone can chime in with proper cli commands for this. Regards,

OtakarKlier

Hello, Also take a look at the free training they offer to get your feet wet. https://paloaltonetworks.csod.com/LMS/catalog/Welcome.aspx?tab_page_id=-67&tab_id=20000157 Regards,

OtakarKlier

Hello, I also use Policy Based Forwarding to prefer the primary endpoint so that if it goes down then the PBF no longer takes effect and the Virtual router takes over. I also put OSPF on both ends with metrics so there is no weird routing loops. Hope that helps.

OtakarKlier

No worries. I can test and see how it works :). I'll report any weird behavior.

OtakarKlier

Hello, I went beyond ports and use the L7 Applications. Including the screen shot below. I also allow ping as some devices send ping to monitor tunnel status. Hope that helps.

OtakarKlier

Hello, There is something that could be sending traffic over the VPN. Outlook and email programs are the usual culprit since they are always checking and sending traffic. Make sure there is nothing running that can send traffic or looking to update, i.e. Windows Update? Hope that helps.

OtakarKlier

Thanks Reaper for the reply! Do you know of anyone who has done it and ran into issues? Just curious if there are any gotchas I should look out for.

Date Registered	‎07-17-2015 09:00 AM
Date Last Visited	Saturday
Total Messages Posted	1,806
Total Likes Received	356

Online Status	Offline
Date Last Visited	Saturday

Strata

Prisma

Cortex

About OtakarKlier