About scottsander

I'm trying to create a miner that generates a list of TOR exit nodes for consumption by PAN-OS in an EDL. I found the "blutmagie.tor_exit_nodes" prototype and built a graph. My graph uses stdlib.aggregatorIPv4Generic for the processor node and stdlib.feedHCGreen for the output node. It does generate a list of IPs at the resulting URL, but it's... odd. The prototype uses the following URL: torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv. As you can see, this is a CSV file. I checked the file and it's just a list of individual IPv4 addresses, one per line. However, when MineMeld builds the EDL, it shows up like this:   102.165.54.56-102.165.54.56 103.194.170.223-103.194.170.223 103.208.220.122-103.208.220.122 103.208.220.226-103.208.220.226 103.234.220.195-103.234.220.195 103.234.220.197-103.234.220.197 103.236.201.110-103.236.201.110 etc.   As you can see it's generating output with ranges, where each range contains a single IP address. Even more, the ranges don't seem to be generating correctly. See this:   109.70.100.10-109.70.100.10 109.70.100.2-109.70.100.2 109.70.100.3-109.70.100.3 109.70.100.4-109.70.100.4 109.70.100.5-109.70.100.5 109.70.100.6-109.70.100.6 109.70.100.7-109.70.100.7 109.70.100.8-109.70.100.8 109.70.100.9-109.70.100.9   Shouldn't that be just.... 109.70.100.2-109.70.100.10 ...?   If it's not going to build real ranges, I'd just prefer it to be lists of single IP addresses, but I can't figure out how best to approach this. I'm a MineMeld novice, and I can't figure out where the code is that generates the output indicated here.   Pointers would be very welcome. ... View more

We've noticed that LACP doesn't work consistently and properly for Aggregate Ethernet interfaces between Palo Alto Networks firewalls (all running PAN-OS 8.0.6-h3) and Cisco ACI 3.1 switch hardware.  On the PAN-OS side, I've got LACP set to active mode, slow transmission, no fast failover.  On the Cisco ACI side, it doesn't work when set to LACP "active".  It says it isn't getting LACP PDUs.  It has to be set to LACP "on" for it to work correctly and consistently.   Does this mean that Palo Alto Networks doesn't have a proper implemenation of LACP active in PAN-OS 8.0.6-h3?  Just curious. ... View more

I am trying to configure GlobalProtect (hereafter: "GP") TLS VPN on a PA-3050 running PAN-OS 8.0.6-h3. I am working with a GP client version 4.0.5.   I have successfully configured GP so that I am able to connect when using a self-signed certificate in the SSL/TLS Service Profile used on both the GP Portal and Gateway configuration; however, when I try to switch the SSL/TLS Service Profile in use to one that uses a certificate signed by our trusted internal certificate authority, I recieve the following error after authenticating:   "Gateway <external gateway name*>: The server certificate is invalid. Please contact your IT administrator."   * This is the name of the external gateway configured in the GP Portal on the Agent tab, not the name of the GP Gateway on the Gateways section of the Network | GlobalProtect setup.   We do not have any sort of client certificate authentication configured.   Regarding the internal CA-signed certificate... I used a certificate template that we use for web servers.  The internal CA's root certificate is already marked as a trusted root CA certificate on the PAN NGFWs as well as all of our workstations and servers, including the client machine I am testing with.  When I visit the GP Portal web page, the web browser shows the Portal's server certificate as trusted; I do not see any sort of certificate warning (which I do when I use the self-signed certificate instead).   My assumption is that it has something to do with the marked capabilities of the internal-CA-signed certificate vs. the self-signed certificate.   The self signed certificate has the following attibutes on the Key Usage property:  Digital Signature, Key Encipherment, Data Encipherment, and Key Agreement (b8).  It has the following attributes on the Enhanced Key Usage property: Server Authentication (1.3.6.1.5.5.7.3.1), Client Authentication (1.3.6.1.5.5.7.3.2), and IP security end system (1.3.6.1.5.5.7.3.5). My internal-CA-signed certificate has the following Key Usage attributes:  Digital Signature, Key Encipherment (a0).  It has the following Enhanced Key Usage attributes: Server Authentication (1.3.6.1.5.5.7.3.1).   Clearly, my internal-CA-signed certificate is configured to be allowed for a more limited set of uses and capabilities that the self-signed certificate generated by the PAN NGFW itself.  I'm not against configuring a special certificate template on our internal CA in order to add additional capabilities to a cert for use by the PAN NGFW for the purpose of GP Portal/Gateway server configuration, but I want to know what capabilities are required.   Or, if there is something else I should check, please let me know.     ... View more

We have a phishing response procedure which includes obtaining target links in phishing emails and putting them in a custom URL category filter (called "Custom-Phising") in PAN-OS.   Due to the volume, I was thinking about using an EDL instead.  I think this might simplify the process a little bit but not in a major way.  Then I was thinking about taking it even further and feeding a phishing email sample into some sort of automation that automatically parses out the target links and puts them into the EDL. That would really speed up and simplify the process. Does anyone know of any tools or scripts that are already built that do this, or has anyone come up with a good way to do something like what I'm trying to do?   I know that PAN has the "phishing" URL category, but that's too slow for our needs.  We are trying to prevent acces literally within a minute of a phishing email being received.  Also, yes, I'm aware that there is the potential for a DOS if a phishing email contains links to valid sites.  But I'd like to at least kick the tires. ... View more

I am aware that the only port that is associated with the web-browsing app-id is TCP/80.  Obviously, this is troublesome when you are doing TLS decryption because now the firewall is seeing web-browsing on TCP/443, which means you either have to manually specify the service port to include service-http and service-https or change application-default to any.   But there should be a third way: create a custom app-id that is the same as web-browsing but has both TCP/80 and TCP/443.    I thought I might be able to clone the web-browsing default app-id and modify the clone to include TCP/443, but it doesn't seem that is possible.  Does anyone know how I might create such an app-id? ... View more

We are moving to Office 365 Exchange Online and may use some other Office 365 services in the near future such as SharePoint Online or OneDrive for Business.   I found the FAQ "Office 365 Access Control" and have configured the requisite custom application and a security policy rule; however, since we haven't fully rolled out TLS decryption yet, I'm decrypting on a service-by-service basis as required.  This means I need to create a custom URL category object as well that represents the relevant URLs.   I have looked at Microsoft's list of Office 365 URLs and IP address ranges document.  It's a beast, with information about both the URLs as well as the target IP address ranges, protocols, and port numbers. Does anyone know of a guide anywhere that would help me get started, such as how many rules for this I will need to configure?  Or is it more common for everyone to just put all the URLs in one big custom URL category and just let people access it at any destination IP address/range? ... View more

We are discovering more and more companies are using EFSS (or just FSS) solutions like Citrix FileShare, Box, OneDrive, Google Drive, and even Dropbox to share content.  We have had a blanket deny policy for a long time so as to prevent using one of these services to store sensitive data with no ability to audit, but it is becoming clear that this is not feasible any longer.   Is there a guide anyone can point me to that allows more granular control of Box?  I've seen one written for YouTube that describes how to allow access to individual videos, and I'm hoping to find something like that for Box.   Thank you. ... View more

We have YouTube blocked in our organization and allow access for individuals to it (the entire service) based on business need and director approval via User-ID and membership in a specific AD group.   Now one arm of our organization (that has access to YouTube, of course) has decided that it is a good idea to create a YouTube channel and has asked IT to allow access for all employees to be able to access this channel.   I am trying to ascertain whether or not this is possible.  TLS decryption is a given, and we already have the capability to do that.  From what I can tell, channels do have unique URLs, but the videos hosted on a channel don't seem to have a URL that is related to the channel at all.  This would mean that we would indeed whitelist the channel but we'd also have to whitelist each individual video separately as well. Is anyone aware of a way to allow access to all videos on a single YouTube channel without having to try to maintain a list of individual YouTube video URLs too? ... View more

I'm trying to allow access to a single form on Google Docs while blocking access to all of Google Docs in general in PAN-OS 7.1.8.  I'm aware that Google Docs is an encrypted service, so here's what I've done:   Created a custom URL category called "GoogleDocs" containing the following URLs:   *.google.com/docs docs.google.com google.com/docs   I also have another custom URL category called "Whitelist" that is set to "alert" in all URL filtering security profiles.  The idea for this custom URL category is to contain any URL we want to globally allow.  I added the specific form's URL to the "Whitelist" category:   docs.google.com/forms/d/e/1FAIpQLSfC3N8s4Kbhd9heiMJrwlYJDGG5n_Nh25UOp7CdqLN8xdpqmw   Technically, the real URL also has "/viewform?embedded=true" at the end but I've left that off in the "Whitelist" URL category object.   I've created a Decryption Policy that does SSL Forward Proxy decryption on traffic from inside to outside that matches the URL category "GoogleDocs".   In my base web filtering security rule, which we call "Common-Web", the URL filtering security profile that is used on that rule has the "Whitelist" category set to "alert" (as previously mentioned) and "GoogleDocs" set to "block".  I also added the "google-docs-base" application object to ensure the rule would match.   Unfortunately, this does not seem to work.  I am receiving a URL block when I try to visit the site with the embedded Google Docs form.  The "Common-Web" rule is correctly matching, the traffic is correctly decrypted, and I am seeing the full form URL in the URL filtering logs, but the URL is being seen as part of the "GoogleDocs" URL category instead of the "Whitelist" URL category, hence the reason for the block (remember that we have the "GoogleDocs" category set to "block" in the URL filtering security profile).   How can I accomplish what I am trying to do?  What I am trying does not appear to be working as intended. ... View more