About rapoint_person

rapoint_person · ‎11-28-2013

I agree 100% with this one: - Improve FW UI in a way to allow creation of Rule Sections. Now the rulebase is quickly becoming very confusing. Look at the Migration Tool, that's how It's done (Thanks Albert 🙂

rapoint_person · ‎01-25-2012

Agree that a scheduler on-box would be nice. However, ssh-key auth is available from 4.1. This means that you can automate backups by adding a cron job on an external box. Simple enough.

rapoint_person · ‎01-19-2012

I'd say - look at Global Protect if you want a packaged product. If you have the skills/time you could use the API to push computer names and IP in to the PAN. Would require some development time on your end though.

rapoint_person · ‎12-15-2011

I'd have to agree. RSA keys and Certificates in general is something I'd like to see.

rapoint_person · ‎12-14-2011

CLI? set address <name> ip-netmask 1.1.1.1/32 and/or: set address-group <addressbook entry> Should be able to create a large number of set commands with an editor of your choice.

rapoint_person · ‎12-12-2011

Are we talking about virtual desktops or terminal server/citrix here? Please elaborate a bit further on the subject.

rapoint_person · ‎12-09-2011

I understand what you are saying, and I agree it would be ideal if we could use static IPs. I'm just saying that using "source users" could be a workaround in some cases. For instance allowing the SSLVPN network to manage the box, but then limiting which users actually can access to the management interface with a user based security policy. Just want share some ideas of doing things differently by taking advantage of knowing the source users.

rapoint_person · ‎12-08-2011

Why not use the fact that you are identified as a user when logging in to the VPN-Portal? If the tunnel-interface is in it's own zone you can create security rules based on source user rather than static IP's.

rapoint_person · ‎12-08-2011

Yes, I have seen that type of behavior a few times. The reason being that the agent is continuously reading the DC/Exchange logs that you point out in the agent configuration. The more complex the environment (number of users, number of polled DC's per agent) will have an impact on how much traffic that is generated. Unfortunately reading the security log is something that can consume quite a lot of bandwidth in some environments. If possible I suggest you try adding one more agent and place it closer to the remote DC/Exchange server.

rapoint_person · ‎11-23-2011

Yes, that my friend is in the manual. In the gui simply click the VR, Add the route (network/mask/gw) and commit. Thats about it.

rapoint_person · ‎11-23-2011

No, a VR holds both static and dynamic routes, (if used). Lets say your VR looks like this: Route Gateway Interface 0.0.0.0/0 195.1.2.3 eth1 192.168.20.0/24 192.168.10.5 eth2 195.1.2.1/27 eth1 192.168.10.1/24 eth2 In the example above, using anti-spoofing on the zone with eth2 as a member interface would only allow hosts from the directly connected network 192.168.10.0/24 and the nexthop network 192.168.20.0/24 as these two networks are the only ones with valid return routes. The PAN-device extracts the source IP and source interface, (source zone) when the ingress packet arrives.

rapoint_person · ‎11-23-2011

OK, thanks for the info. Hope this does change in a future release. I bet 99.9% of us using the feature in question are under the assumption that the pattern is matched against the host portion of the URL.

rapoint_person · ‎11-23-2011

Anti-spoofing is not based on any address-book or address-group entry. It is simply based on the routes you have in your VR. In other words you need to compare route tables between your Checkpoint-GW and the PAN-device.

rapoint_person · ‎11-18-2011

OK, so the wildcard in the URL-filter makes no distinction between URI-path and the host portion? Is that true in all releases?

rapoint_person · ‎11-11-2011

I never got Shrew working, (didn't put that much effort in to it either). VPNC works like a charm though. I actually prefer VPNC as it is integrated with NetworkManager (I'm on a Ubuntu box). Simply put in the following in the client: Gateway: globlaprotect.company.com Username (Most cases your LDAP/AD user account authenticating with Kerberos/LDAP) Group name: sharedusername (xauth shared user in Palo) Group Passwd: Encryption Standard NATT: Enabled xAuth enabled, IPsec enabled, Skip Ike rekey = Palo Alto side of things.

rapoint_person · ‎10-24-2011

As you have a Dynamic IP on one of the boxes I suggest you setup aggressive-mode VPN. As the PAN is using a dynamic IP it's best if the PAN inititates the tunnel.

rapoint_person · ‎10-18-2011

This shows the max configured at least: show system state filter cfg.general.max* | match nat then combine with show resource limit policies (as this command does not show the max, at least not the box I'm on)

rapoint_person · ‎09-28-2011

I agree, both tagged interfaces and ipsec/ike status for each tunnel as well as interface IP's are things I'd like to be able to poll.

rapoint_person · ‎09-27-2011

From what I heard the buffers vary between the hardware models, (no surprice there really). The WFQ ratio should be 24:1 I'm told. When the queues fill upp packets start getting dropped. This can be seen by issuing "show qos interface intname counter". Hopefully Palo will release an official document describing QoS in greater detail and differences between their hardware.

rapoint_person · ‎08-16-2011

Doesn't sound like bug. Rather speed/duplex issues. In cases involving a PAN-device and other swithes/routers many of the typical counters showing crc errors, collisions, etc never show any significant number of errors. You however can get any other number of symptoms: Some applications work, others do not, broken sessions, etc, etc Check speed/duplex on all connecting equipment

rapoint_person · ‎08-08-2011

Not any "secure" workaround as far as I know. IPsec does not allow certificates or support xauth/modecfg right now. The SSLVPN-client is for Mac/Windows. It is my understanding change is around the corner and linux users will be able to connect to the box in the near future.

rapoint_person · ‎08-08-2011

Enable user identification in the zone where you have your tunnel interface (for the SSLVPN portal) and specify the IP-pool network as well. After that you should have your SSLVPN users in ACC/Log

rapoint_person · ‎07-07-2011

Always used simple mode when setting it up this way. Hope you get it working! Cheers, /Oskar

rapoint_person · ‎07-07-2011

No issues what so ever. Have used it a couple of times. In fact, I have been forced to get it working when having a CP firewall in a large VPN-mesh. The CP had loads of small networks that would require a ridiculous amount of routes and tunnel interfaces on all the PAN devices. I'd say it wasn’t an option in that particular case. R65 versions and later (Checkpoint) work as far as I know.

rapoint_person · ‎07-07-2011

Checkpoint allows setting upp only one tunnel between ike gateways. That means there is no need to specify each and every proxy-id or worrying about having multiple tunnel interfaces with their respective routes. Simply use the default proxy-id in the PAN (0.0.0.0/0) If I remember correctly this is a setting on the "interop device" in CP.

rapoint_person · ‎06-08-2011

Have you looked in the ACC or in the URL log and verified you actually have the event logged? Did you look at the correct time frame when generating a custom report or using ACC? Start searching the URL log with something simple: (category eq adult-and-pornography).

rapoint_person · ‎05-31-2011

If you only have a "limited" number of forbidden sites, why not create apps of these sites and then use the custom apps to allow/deny access?

rapoint_person · ‎05-31-2011

With regards to size and power consumption those numbers are in the spec sheets. If the boxes are going to be clusterad (A/P) it costs two interfaces in each box. One for heartbeat, one for sync. Also rememeber management usually is configured on a dedicated interface on each box.

rapoint_person · ‎05-31-2011

Well, you are almost right Yes, the PAN-device can and must exist within the same subnet as your default gateway (Palo IP *.2 vs default gw IP *.1). No, it doesn't "listen" to all available public IP's (proxy-arp for those IPs in the public subnet). It does however proxy-arp (listen) for for those IP's where you explicitly create NAT-policies. You can create NAT-policies by having loads of IP's on your public (internet facing) interface. Another, more practical approach would be to have address book entries for both the public and private IP of the servers/hosts you wan't to NAT between. Example: OWA_Pub = 195.x.y.5/32 OWA_Priv = 10.x.y.5/32 NAT policy to access OWA could look like: From: Untrust_Zone To: Untrust_Zone From: ANY (IP) To: OWA_Pub NAT: Destination OWA_Priv Security Policy could look like: From: Untrust_Zone To: Trust_Zone From: ANY (IP) To: OWA_Pub Action: Allow

rapoint_person · ‎05-30-2011

Nice to see I'm not the only one that is complaining about: -Documentation with proper real-life scenarios/examples. Detailed explanation what different settings does and why they should be used or not. -QA has been mentioned. I agree as well. I'd like to see: -The ability to block/act on ongoing attacks directly from the session browser and log (traffic/threat). IE, block offending IP for X hours. -Better exceptions for Threats. I'd like to be able to create an exception for a particular threat in conjunction with a source and/or destination IP. -If possible, Better reporting/logging for DDoS/Zone protection. -commit timer. I'd like to be able to commit with a timer value. If a second commit hasn't been performed within the specified time, the box automaticaly reverts to the previous version. -Multiple Captive Portal "profiles" -Bulk set security profiles in CLI, (example: set rulebase security * from trust to untrust profile-setting profile ......) This helps making changes in large rulebases.

Date Registered	‎02-22-2010 05:55 AM
Date Last Visited	‎08-18-2015 09:06 AM
Total Messages Posted	61
Total Likes Received	15

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

Strata

Prisma

Cortex

About rapoint_person