About SDorsey

SDorsey · ‎08-27-2015

Thank you for your reply. It's set to Dynamic - Superuser.

SDorsey · ‎08-27-2015

Greetings! Am troubleshooting PA authentication using RADIUS. The user is part of the appropriate AD group for the RADIUS configuration and the PA and RADIUS server are both setup for RADIUS auth. On the PA side, added an administrator and set their auth profile as the radius profile. When the user tries to login, the PA log shows: User 'userX' authentication. From: IP then another message Authorization failed for user Userx via Web from IP : Invalid role

SDorsey · ‎05-27-2015

mivaldi - just curious. Are there plans to add support for HTML docs? The number of these I am seeing are rather high on a daily basis.

SDorsey · ‎05-18-2015

Upon inspecting the Word docs within a text editor, the formatting is for sure way different.

SDorsey · ‎05-18-2015

Greetings all! I have discovered WF is not able to test some Word docs; it gives the following error: Unsupported file type: HTML document, ASCII text, with CRLF line terminators However, I am able to open these Word docs within a VM. They contain malicious macros and they are in tact. Has anyone else run into this? I haven't dug deeply yet but am wondering if they are altering the format as a method of sandbox evasion.

SDorsey · ‎04-04-2015

Greetings all! I have been tasked with configuring a persistent VPN between a VPS Linux box and a PAN firewall. I have NOT yet established which client I am going to use on the Linux host; I prefer openvpn but am keeping an open mind given the persistent requirement. The tunnel needs to always be up and should it disconnect, it needs to detect this and attempt a reconnection. Would a cronjob be a good strategy for this? I also considered IPSEC mode however the main consideration is the PAN CANNOT be configured in aggressive mode per regulatory requirements. Has anyone else done anything similar?.

SDorsey · ‎03-27-2015

After applying 6.1.3 and rebooting, this issue was resolved. Was on 6.1.0.

SDorsey · ‎03-27-2015

Thank you. The processing restarting did not fix the issue. The portal page is enabled. There were no firewall config changes. On Tuesday, everything was working as expected. On Wednesday, the client reported vpn clients could not connect. No config changes were made in this window. I will try restarting the box to see if it has any effect.

SDorsey · ‎03-26-2015

Is there a way to manually restart daemons and services in the CLI? I have a box with sslvpn configured. The sslvpn suddenly stopped working and the portal page doesn't load. I double checked the config and the traffic logs show the traffic as being allowed and no threat/url logs being matched. I would like to try restarting just the services before restarting the box.

SDorsey · ‎03-20-2015

Hey all- I tried updating a test box to 6.1.3 and encountered the error in the title. Per other threads, I tried manually downloading the latest content version and installing but it resulted in an error during install. Has anyone else encountered this with 6.1.3 yet?

SDorsey · ‎02-05-2015

I resolved this by removing the Traps agent from the ESM Server for the upgrade then reinstalled after the upgrade. This lead me onto the path of looking at the rules. I used the default rule set provided by PAN and one of them was blocking write access to the related registry keys.

SDorsey · ‎01-27-2015

I am seeing this as well. Crazy!

SDorsey · ‎01-27-2015

Greetings all- I am trying to upgrade an ESM server from 3.1.2 to 3.1.3. When I run the installer, I get the below error message. I have ensured to run it as administrator. I have even tried disabling UAC, removing the AV agent and rebooting. Thoughts?

SDorsey · ‎01-25-2015

Thanks for the information! There is no proxy at this client. I *did* have URL filtering configured to alert on all categories for the sake of this eval. I will tune this down so it only alerts on malicious categories.

SDorsey · ‎01-25-2015

Has anyone encountered any throughput issues with 6.1.1? I have NOT had any issues until Friday. Installed a PAN200 in vwire mode for a client eval / AVR. Their throughput to the internet was 44mbps before PAN. Through the PAN, it as cut down to 8mbps. Removed PAN and it went back up to 44mbps. With other PAN200s on 6.1.1, I am getting 50+ on them. In this specific scenario, it is sitting between a Barracuda WCF 410 and an ASA5510. I have placed one before between these two specific devices without issue. The MTU between all devices is the standard 1500. Thoughts?

SDorsey · ‎12-24-2014

Not me. On 6.1.1 at most of my clients and still have the issue in all browsers.

SDorsey · ‎12-02-2014

This can still cause interference as port scans are blocked by the Zone Protection profile which is configured at the zone level and not via an ACL rule.

SDorsey · ‎11-13-2014

I have not personally heard any negative feedback.

SDorsey · ‎11-10-2014

Thank you much sir!

SDorsey · ‎11-10-2014

We are a VAR so cannot speak from a personal-use side but a lot of our clients have Solutionary and have nothing but positive to say thus far.

SDorsey · ‎11-10-2014

Greetings all! I have updated several PAN firewalls to 6.1. Today, I noticed this entry on page 5 of the guide: Related Log Detail View Enhancements To make it easier to correlate log information from a session, you can now click through the related logs in the Detailed Log View without closing the window and switching views. You can switch between the URL Filtering, Threat, Traffic, and Data Filtering logs associated with a session and the Detailed Log View window will dynamically update to display pertinent information for the selected log I am not readily seeing how to do this on a 6.1 system. Can someone point me in the right direction?

SDorsey · ‎10-13-2014

Because H3 added new anti-packet-evasion techniques. NSS labs discovered they could use certain fragmentation attacks to completely bypass the PAN IPS. So H3 was released which introduces protections against these which require symmetric traffic for the PAN to be able to reassemble the fragments.

SDorsey · ‎10-13-2014

The web server was placed in a DMZ but the web server was dual homed.. i.e. the web server had two physical interfaces. One was connected to the DMZ vlan and the other was connected to the internal network vlan. So when internal workstations made a request to the web server in the DMZ, the initial request would go through the firewall to the web server.. but when the web server responded to that request, it would respond directly to the internal network since it had an interface physically connected to the internal network. So the firewall would only see traffic from the client to the server. It would not see the server to client response.

SDorsey · ‎10-13-2014

All correct. Basically with the new anti-packet-evasion protections in 605-h3, it cannot properly reassemble the fragmented packets if the traffic is asymmetric since it only sees half the traffic.

SDorsey · ‎10-13-2014

I believe Steven is correct. Also, welcome to PANOS. I used to have to manage a couple SSGs back in the day. I found it to be painful.

SDorsey · ‎10-12-2014

Agreed. I have a request in with the sysadmins to see if we can do away with the dual-homed connection altogether since this is really a design anyway.

SDorsey · ‎10-11-2014

csharma Thank you! That fixed it. Apparently the server admins thought it would be okay to dual-home the web server to the internal network.

SDorsey · ‎10-10-2014

Has anyone discovered any issues with H3? I have an odd issue and am not sure if it has to do with the layer 4 changes in the hotfix to address the evasion issues. I have upgraded 3 client sites. No issues at 2 of the sites. On the third side, I have an issue. This client has a public web site in a DMZ. The ACL allows it to be directly accessed by the internal network. After the update to H3, you can access the website just fine from across the internet. You cannot access it from the internal network. You can ping the web server just fine. The Traffic log shows Incomplete for the port 80 traffic. Downgrading back to 6.0.5 allows internal users to hit the website in the DMZ just fine.

SDorsey · ‎09-15-2014

Also, if you find legit sites which are flagged as unknown. I would certainly recommend submitting a change request so they can classify it correctly as this helps everyone else in the PAN community.

SDorsey · ‎09-15-2014

I agree that blocking unknown causes more work as a lot of legit websites are still in the unknown category. Luckily, it is easy to create whitelisting rules for this. I typically create a new URL category and white list the domains there that are blocked via unknown. From the security standpoint though, there may be a lot of malware sites classified as unknown. E.g. when I look through the logs at malware blocked, especially involving files flagged by WF, the domain is classified as unknown. So you certainly reduce the attack surface when you block unknown. You just have to keep in mind, you are committing to your users that you will whitelist the domains they need. As always, security is a balancing act. But I have blocked the unknown category for most of my clients. The first few days is when you find the most domains being blocked due to being category unknown. So you may whitelist a lot in the first few days; once you get past that period, it is pretty smooth sailing. Last note that on that. When you have the PAN do cert checking, most of the OCSP sites it calls out to are flagged as unknown. So do not block unknown for your PAN mgmt interface(s). Other than that, no issues thus far.

Date Registered	‎04-18-2012 08:18 AM
Date Last Visited	‎05-11-2018 12:34 PM
Total Messages Posted	149
Total Likes Received	20

Online Status	Offline
Date Last Visited	‎05-11-2018 12:34 PM

Strata

Prisma

Cortex

About SDorsey