About JTR

Hello, guys~ One of my customer want to know whether the Pan block web shell or shell script. In my opinion, there's no ips which can block those attacks 100%. Threat prevention of the PA is signature base also, which means if it detects well-known web shell, it might block it. If not, it can't. It's sure that web shell is based on web server application vulnerability or miss configuration. So the basic method to block those attack is secure cording or secure configuration of the web server. But I need to tell the customer the exact information about PA's function. Please don't mention custom signature, there's not so much customer who can make custom signature :smileygrin: Thank you very much. ... View more

Hello, Guys, I have one question. First below is the packet flow from "Packet Flow.pdf" document. According to this document ... In the red square, before PA make session table, it checks packet's ip and port (like the legacy L4 firewall), and then after the session created, it check Content, APP-ID. So I made this rule(URL Block). According to packet flow.pdf, 'URL Block' rule should check packet's ip and port first and then should block those packet. >> Am I right? That means that the packet would never go Contents-ID, and APP-ID process. And URL filtering happens in Content ID process. According to the document ,the session should never be created. But in my lab test, it worked fine as the rule made (It worked like as if I used URL filtering profile. If I use URL filtering profile, the action should be 'allow' in security rule, and 'block that category' in url filtering profile.) I just wondering, then what's the difference between in Security policy and Security Profile URL filtering. And I want to hear your opinion. It would be very appreciated if you point out what's my mis-understading. Thank you very much. ... View more

Hi Guys According to document , if there's destination NAT , there'll be second routing lookup to decide outbound zone & interface. But I'm very confused when there's routing and PBF together, In the second routing lookup, how does PBF rule work? Does PBF work based on Pre-NAT destination address or Post-NAT destination address? According to document at the second lookup process works based on POST-NAT destination address, that means if the routing table works fine, it should follow routing table lookup result. But in my customers networks it doesn't look like that.. Using PBF and U-Turn NAT together is really kind of a mess. Thank you very much. ... View more

Hello guys I'm trying to block some traffic originated from other country. PAN can block those traffics with its source address and regional info. But what if they use some kind of proxy(like ultra surf) to disguise its original source ip and change its ip to domestic ip , and what if they use ssl proxy? If that ssl server is in my country, its source ip will be change to domestic one. PAN can block proxy application originated from its internal network, but it seems hard to block proxied traffic originated from out side area. Do you have any solution for this? Thank you very much. :smileygrin: ... View more