About ericgearhart

ericgearhart · ‎08-19-2014

It is confusing, because you could use untagged subinterfaces to achieve the same thing. So there's more than one way to do it, which presents confusion

ericgearhart · ‎08-18-2014

Steven - you have to add IPs to the interface in question, otherwise the interface itself won't ARP out for inbound traffic. You can put mulitple /32s on an interface. Make the first IP you add have the correct subnet mask, and have all additional IPs have a /32. We do this today, right now, in production on our PAs.

ericgearhart · ‎08-18-2014

You can put mulitple /32s on an interface. Make the first IP you add have the correct subnet mask, and have all additional IPs have a /32. We do this today, right now, in production on our PAs.

ericgearhart · ‎08-15-2014

I hate to sound like a wet blanket, but we see a lot of false positives from PA's threat signature engine. So tiwara I would suggest you be careful in "jumping the gun" and assuming the client is infected... it might just be normal Windows behavior

ericgearhart · ‎08-13-2014

slv - see FJU's response below. I totally agree with what FJU says below

ericgearhart · ‎08-13-2014

Excuse me but this is a totally bogus explanation... so what if he put service any? The whole point of App-ID is to be port agnostic, that's how the product was sold to us. The replies above make no sense to me.

ericgearhart · ‎07-18-2014

Hey PA guys, do you have a timeline on PANOS 7.0 coming out? Thanks, Eric

ericgearhart · ‎07-14-2014

hshah are you speaking with the authority of someone who works for Palo Alto Networks or are you just some random forum customer?

ericgearhart · ‎07-09-2014

Havex is still flagged as benign by the public WildFire page. Havex is listed here: https://threatvault.paloaltonetworks.com/Home/VirusDetail/2889719 But the hash shows benign, here: https://threatvault2.paloaltonetworks.com/detailreport/7933809aecb1a9d2110a6fd8a18009f2d9c58b3c7dbda770251096d4fcc18849

ericgearhart · ‎07-08-2014

I second that, I'm not saying give up either! PA2000s were part of the "first generation" of firewalls PA produced. Any company that puts out a sufficiently revolutionary product is going to have a hard time with their first release... look at the first gen iPhone for an example.

ericgearhart · ‎07-08-2014

The PA2000 series is basically an "oops" series from Palo Alto. They won't officially come out and say that, but they don't even want the pair of PA2050s we have sitting in our lab back, it's that bad. You should be yelling at your SE and getting a great deal on a PA3000 if you still have PA2000s.

ericgearhart · ‎07-02-2014

I don't have a sample of the malware, I'm just "stirring the pot" to be honest

ericgearhart · ‎07-02-2014

ericgearhart · ‎07-02-2014

Does WildFire flag a sample as malicious yet :smileylaugh:

ericgearhart · ‎07-02-2014

Interestingly enough if you click on the hash links, PA's own WildFire flags it as benign! Hmph. :smileyplain:

ericgearhart · ‎07-02-2014

Looks like Havex made it into the ThreatVault: https://threatvault.paloaltonetworks.com/Home/VirusDetail/2889719

ericgearhart · ‎07-01-2014

In my humble opinion a DMZ is still necessary because pivoting is still a tactic employed by the bad guys and pen testers. If you expose something to the Internet, assume it has vulnerabilities which would allow an attacker to get a shell on the box on the DMZ and pivot into your internal network. If you had that box 'sandboxed off' into its own zone with appropriate rules and profiles bound to it then you'd prevent pivoting.

ericgearhart · ‎06-30-2014

Thank you Steven for sharing! I'm going to go ahead and steal your idea and share it with my team 🙂

ericgearhart · ‎06-26-2014

If you get an FR let me know, I'd like to talk to my SE and vote for that FR too. Thanks, Eric

ericgearhart · ‎06-26-2014

PA really, really needs to implement Check Point's "Where used?" functionality. The backend code that determines where objects are used is already there, because if you try to delete an object that is used in the firewall rule base it won't let you, and it will prompt you as to where the object exists. That's the closest I've been able to get to "Where used?" - try to delete the object, and if it doesn't let you it will tell you where the object is used. If it does let you delete it you can just "Revert to last saved configuration"

ericgearhart · ‎06-25-2014

Oh yea wow, gotcha. What the heck PANOS is this? I'm avoiding the 6.0 train for about a year on my side

ericgearhart · ‎06-25-2014

Maybe he named the zone on the firewall web-browsing? That would be kinda weird though

ericgearhart · ‎06-04-2014

Honestly screenshots would work... I can personally attest that I have seen PAs that I've tested pick up on Metasploit sessions, just as an aside

ericgearhart · ‎05-28-2014

Zabbix 2.2's built in SNMP interface template can walk devices too, and automatically find interfaces. You'd have to make a copy of it and modify so that it uses SNMPv3 with AES and SHA, but it should work

ericgearhart · ‎05-22-2014

Ahh I see. Ouch.

ericgearhart · ‎05-06-2014

ltosi - jay.martin's suggestion sounds like the best thing to do to me. You can even configure a "Block IP' under the Properties section of the Configuration tab, and set it to the max, 3600 seconds. Every time the user agent is seen the IP will be blocked for an hour.

ericgearhart · ‎05-06-2014

Well, that depends on what you're using to tap honestly. Are you using anything intelligent to tap, like Gigamon? We use filters in Gigamon to filter out traffic. Would it be a bad thing if you send all the traffic to the PA tap interface, and then only configure policies on the PA side concerning DNS? I suppose if/when backups run you might peg your tap interface, but that should be at night anyway, right?

ericgearhart · ‎05-06-2014

mario11584 - would you be able to build a tap interface on your PA, and tap the client traffic going to your DNS server and feed that to your PA? This is one way we have solved this problem where I work

ericgearhart · ‎05-06-2014

Andie there's a blog post here where the guy seems to have had luck with IKEv1, routed VPNs and Palo Alto... Stuff I've learnt: IPSec VPNs and IKE

ericgearhart · ‎05-06-2014

Thanks HULK, that does indeed help

Date Registered	‎04-26-2012 04:24 PM
Date Last Visited	‎08-18-2015 09:07 AM
Total Messages Posted	412
Total Likes Received	151

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

Strata

Prisma

Cortex

About ericgearhart