This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About gmoerschel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About gmoerschel
08-18-2015
19Posts
4Likes
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by gmoerschel
| Subject | Views | Posted |
|---|---|---|
| 4613 | 09-03-2013 11:59 AM | |
| 2134 | 05-28-2013 08:33 AM | |
| 4056 | 08-10-2012 11:59 AM | |
| 3709 | 02-22-2012 06:16 AM | |
| 6611 | 01-26-2012 09:09 AM | |
| 1294 | 06-08-2011 08:44 AM | |
| 1992 | 05-05-2011 02:22 PM | |
| 2075 | 04-12-2011 11:06 AM | |
| 2514 | 04-12-2011 06:54 AM | |
| 4056 | 03-23-2011 12:52 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 09-13-2010 10:50 AM | |
| 1 Like | 09-30-2010 06:04 AM | |
| 1 Like | 05-28-2013 08:33 AM | |
| 1 Like | 01-04-2011 05:26 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes |
User Badges
Community Statistics
| Member Since | 02-26-2010 05:26 AM |
| Date Last Visited | 08-18-2015 09:06 AM |
| Posts | 19 |
| Total Likes Received | 4 |
05-28-2013
08:33 AM
1 Kudo
I agree. It would be nice to be able to assign a URL to a category for internal purposes rather than a single generic white list.
... View more
08-10-2012
11:59 AM
If you check out jblum.2's answer higher in the thread, that is the way I do it.
... View more
02-22-2012
06:16 AM
See notes in original thread that you must go to 4.1.0 first which is the basis for that code train. 4.1.2 includes modifications to the base code.
... View more
01-26-2012
09:09 AM
The following change log may be useful to all of you wondering how an upgrade goes in an HA active-passive pair. It would be nice if PAN support were to put this into a tech note. Each step is essentially a check or an observation from top to bottom. 2050 Firewall Upgrade 4.07 to 4.1.2 Log: Pre download of PAN-OS 4.1.0 and 4.1.2 to both units No commits pending firewalls shows HA is in synch Same version of dynamic updates are installed on both units Backup configs from both and export them On PAN2 (the current passive), suspend the unit via GUI:device/ha/suspend @ 9:17 am PAN2 upgrade to 4.1.0 starting @ 9:18am PAN2 reboot @ 9:22 PAN2 back up at 9:25 and auto com until 9:38. PAN2 comes up as non-functional state. Note that the unit will not be able to log you in for several minutes as the upgrade process is happening. PAN2 Started 4.1.0 to 4.1.2 upgrade at 9:40 PAN2 reboot at 9:44 PAN2 back up at 9:50 and auto com until 9:53. PAN2 comes up as non-functional state. Because 4.1.x HA is not compatible with 4.0.x HA there is no way to make the newly upgrade firewall the active. The older fw code must be suspended first and then the new fw is made functional which then brings it into the active state. Because of this limitation, the sessions going through the active will sever when it is suspended. Detail below: do quickly PAN1 from cli: request high-availability state suspend NOTE: active sessions will sever when active becomes suspended do quickly PAN2 from cli: request high-availability state functional PAN2 immediately becomes active. loss of 14 pings PAN1 upgrade to 4.1.0 starting @ 10:56am PAN2 (not PAN1!!) redefined pre-emption to 98 to be favored over PAN1 so that PAN1 does not become active upon reboot into initial 4.1.0 install. PAN1 reboot @ 11:04 PAN1 back up at 11:10 and auto com until 11:20 PAN1 state shows as "initial" after auto com completes PAN1 Started 4.1.0 to 4.1.2 upgrade at 11:23 PAN1 state transitioned to passive while 4.1.2 upgrade was running PAN1 reboot at 11:27 PAN1 back up at 11:32 and auto com until 11:35. PAN1 comes up as passive. HA dashboard widgets on both sides show no errors and states are synched. PAN2 pre-emption number set back to 101 then PAN2 was suspended. At this point an auto com job started running on PAN2 after PAN1 became active. This job took about 1 minute. This may be a synch check. PAN2 commit config (to set back preemption value to 101) PAN2 "request high-availability state functional" and state then becomes passive Process completed at 11:43 am Post upgrade items to do: Download GlobalProtect client Activate GlobalProtect client Enable user ID on outside zone per error message (probably a Global Protect requirement) Ensure User-ID agent reconnects Test GlobalProtect upgrade and function
... View more
06-08-2011
08:44 AM
Has anyone developed a PAN-specific security audit standard that can be used for verifying the efficacy of PAN firewalls as a firewall / IPS control? If so, can you share? Thanks
... View more
05-05-2011
02:22 PM
In a 4.02 firewall pair, if I have both virtual wires and a Layer 3 config, it seems that I would want to use "auto" instead of "shutdown" (under Device Tab > HA > Active Passive Configuration) because that's better for a Layer 3 situation and path monitoring. But does this mean that I would have a forwarding loop since the vwires would stay up on both boxes? Do I have to implement Spanning tree between the switches before and after the PA boxes to prevent this looping or is there a PA mechanism to control this? How do both network types live together in an HA pair?
... View more
04-12-2011
11:06 AM
When URL reports are generated via Panorama, does Panorama query each firewall individually for its data in order to build the output? I take it that URL logs are streamed to Panorama in contrast to traffic data.
... View more
04-12-2011
06:54 AM
ncampagna says that "Content-ID and App-ID will be used to process IPv6 traffic if the IPv6 firewalling setting is configured." That's fine but if the app is "Teredo" (IPv6 within IPv4 udp/3544), will a PAN 3.1x box treat Teredo as IPv4 traffic and dig into the packet past the embedded (tunneled) IPv6 header to see if there is malware or a disallowed app within the payload of the tunneled frame?
... View more
03-23-2011
12:52 PM
Very nice. I like the structure. Care to share that base template? Thanks
... View more
03-08-2011
10:07 AM
Is this the only command that needs to be issued in Panorama to convert and download the Brightcloud categories? Or is it like the firewalls where you activate Brightcloud then do a second step to download the database from Brightcloud.
... View more
01-04-2011
05:26 AM
1 Kudo
Is there a document or recommended approach that has been written down that provides a starting point for people building a policy from scratch or when converting from a legacy firewall? I'm referring to recommended approaches for building policy based on least privilege for apps instead of port and protocol. For example, let's say you place apps into 2 or 3 categories such as OK, maybe, and definitely not. Then as apps are identified flowing through they can be placed into the OK category if they are needed by the business. Someone in the past must have grouped the top 10 or 15 legitimate biz apps together into a chunk then implemented as a policy line. Essentially I'm looking for a doc that is entitled something like, "Building policy PAN style when you're used to Cisco ASA (or Juniper or checkpoint)." Thanks
... View more
10-04-2010
07:20 AM
There are several sigs described as "HTTP SQL Injection" (30514, 33338, 33340, 33305, and maybe others) that are server-side mediums with a default alert. What are these signatures looking for? Atypical SQL statements that indicate an attempt to get more from a database than one might normally need? More info in the description would be helpful.
... View more
09-30-2010
06:04 AM
1 Kudo
You block the page with a standard or custom message page that essentially says "disallowed." Or you can use a "continue" mechanism that indicates that the user understands they are supposed to go to the URL but can if they really want to but that the action is logged. Or you can override the request by having the user input an administrative password. Though this last item probably isn't really practical for production networks.
... View more
09-13-2010
10:50 AM
1 Kudo
I asked the same thing. Am waiting...
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks