About scottsander

I'm trying to create a miner that generates a list of TOR exit nodes for consumption by PAN-OS in an EDL. I found the "blutmagie.tor_exit_nodes" prototype and built a graph. My graph uses stdlib.aggregatorIPv4Generic for the processor node and stdlib.feedHCGreen for the output node. It does generate a list of IPs at the resulting URL, but it's... odd. The prototype uses the following URL: torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv. As you can see, this is a CSV file. I checked the file and it's just a list of individual IPv4 addresses, one per line. However, when MineMeld builds the EDL, it shows up like this:   102.165.54.56-102.165.54.56 103.194.170.223-103.194.170.223 103.208.220.122-103.208.220.122 103.208.220.226-103.208.220.226 103.234.220.195-103.234.220.195 103.234.220.197-103.234.220.197 103.236.201.110-103.236.201.110 etc.   As you can see it's generating output with ranges, where each range contains a single IP address. Even more, the ranges don't seem to be generating correctly. See this:   109.70.100.10-109.70.100.10 109.70.100.2-109.70.100.2 109.70.100.3-109.70.100.3 109.70.100.4-109.70.100.4 109.70.100.5-109.70.100.5 109.70.100.6-109.70.100.6 109.70.100.7-109.70.100.7 109.70.100.8-109.70.100.8 109.70.100.9-109.70.100.9   Shouldn't that be just.... 109.70.100.2-109.70.100.10 ...?   If it's not going to build real ranges, I'd just prefer it to be lists of single IP addresses, but I can't figure out how best to approach this. I'm a MineMeld novice, and I can't figure out where the code is that generates the output indicated here.   Pointers would be very welcome. ... View more

We've noticed that LACP doesn't work consistently and properly for Aggregate Ethernet interfaces between Palo Alto Networks firewalls (all running PAN-OS 8.0.6-h3) and Cisco ACI 3.1 switch hardware.  On the PAN-OS side, I've got LACP set to active mode, slow transmission, no fast failover.  On the Cisco ACI side, it doesn't work when set to LACP "active".  It says it isn't getting LACP PDUs.  It has to be set to LACP "on" for it to work correctly and consistently.   Does this mean that Palo Alto Networks doesn't have a proper implemenation of LACP active in PAN-OS 8.0.6-h3?  Just curious. ... View more

I am trying to configure GlobalProtect (hereafter: "GP") TLS VPN on a PA-3050 running PAN-OS 8.0.6-h3. I am working with a GP client version 4.0.5.   I have successfully configured GP so that I am able to connect when using a self-signed certificate in the SSL/TLS Service Profile used on both the GP Portal and Gateway configuration; however, when I try to switch the SSL/TLS Service Profile in use to one that uses a certificate signed by our trusted internal certificate authority, I recieve the following error after authenticating:   "Gateway <external gateway name*>: The server certificate is invalid. Please contact your IT administrator."   * This is the name of the external gateway configured in the GP Portal on the Agent tab, not the name of the GP Gateway on the Gateways section of the Network | GlobalProtect setup.   We do not have any sort of client certificate authentication configured.   Regarding the internal CA-signed certificate... I used a certificate template that we use for web servers.  The internal CA's root certificate is already marked as a trusted root CA certificate on the PAN NGFWs as well as all of our workstations and servers, including the client machine I am testing with.  When I visit the GP Portal web page, the web browser shows the Portal's server certificate as trusted; I do not see any sort of certificate warning (which I do when I use the self-signed certificate instead).   My assumption is that it has something to do with the marked capabilities of the internal-CA-signed certificate vs. the self-signed certificate.   The self signed certificate has the following attibutes on the Key Usage property:  Digital Signature, Key Encipherment, Data Encipherment, and Key Agreement (b8).  It has the following attributes on the Enhanced Key Usage property: Server Authentication (1.3.6.1.5.5.7.3.1), Client Authentication (1.3.6.1.5.5.7.3.2), and IP security end system (1.3.6.1.5.5.7.3.5). My internal-CA-signed certificate has the following Key Usage attributes:  Digital Signature, Key Encipherment (a0).  It has the following Enhanced Key Usage attributes: Server Authentication (1.3.6.1.5.5.7.3.1).   Clearly, my internal-CA-signed certificate is configured to be allowed for a more limited set of uses and capabilities that the self-signed certificate generated by the PAN NGFW itself.  I'm not against configuring a special certificate template on our internal CA in order to add additional capabilities to a cert for use by the PAN NGFW for the purpose of GP Portal/Gateway server configuration, but I want to know what capabilities are required.   Or, if there is something else I should check, please let me know.     ... View more

We have a phishing response procedure which includes obtaining target links in phishing emails and putting them in a custom URL category filter (called "Custom-Phising") in PAN-OS.   Due to the volume, I was thinking about using an EDL instead.  I think this might simplify the process a little bit but not in a major way.  Then I was thinking about taking it even further and feeding a phishing email sample into some sort of automation that automatically parses out the target links and puts them into the EDL. That would really speed up and simplify the process. Does anyone know of any tools or scripts that are already built that do this, or has anyone come up with a good way to do something like what I'm trying to do?   I know that PAN has the "phishing" URL category, but that's too slow for our needs.  We are trying to prevent acces literally within a minute of a phishing email being received.  Also, yes, I'm aware that there is the potential for a DOS if a phishing email contains links to valid sites.  But I'd like to at least kick the tires. ... View more