About choff123

choff123 · ‎07-21-2017

thanks

choff123 · ‎07-20-2017

I have to change the Log forwarding in all my rules. is there a way to do this one more than one rule at a time? Id like to do it all at once. Im on panorama 8.0.3-h4. thanks

choff123 · ‎01-06-2016

anyone else seeing a bunch of Microsoft Windows Client Service For Netware Remote Code Execution Vulnerability(30366) alert alerts, mine started an hour ago roughly.

choff123 · ‎07-03-2015

thanks ill take a look

choff123 · ‎07-02-2015

What does everyone have setup as far as 2 factor goes? I have a consultant here and we're thinking about going to the Microsoft MFA server route. Seems ok but not very flexible for things other than VPN. Any feedback on other solutions would be appreciated. I was hoping to get all external client VPN using 2 factor, next I would like to have 2 factor bound to every domain admin account. thanks

choff123 · ‎06-16-2015

thanks Vince ill check into that.

choff123 · ‎06-15-2015

thanks, i better dig deeper into this even though all the packets get dropped.

choff123 · ‎06-15-2015

Anyone else getting a lot of hits for "ASP Webshell Access" 37482? or is it just me? THREAT ALERT : high : X.X.X.X -> X.X.X.X ASP Webshell Access(37482) drop-all-packets

choff123 · ‎03-27-2015

scanned the PA webserver we use for our VPN portal with qualys ssl scanner. Got a grade of F. Suggested to disable .... Diffie-Hellman (DH) key exchange 512-bit export suites Ssl v2 and v3 how can I go about doing this?

choff123 · ‎01-29-2015

Well I get tons of suspicious domain alerts in my inbox, those are resolved from IPs. On the other hand, there was a patch for this a year or two ago that a lot of distros didn't apply. I would think PA uses a Linux branch in which they apply every security patch no matter what.

choff123 · ‎01-28-2015

Is the PA itself ok? the PAs run Linux?

choff123 · ‎01-27-2015

Just starting a thread for CVE-2015-0235. Ghost Anybody see any news from PA on this? I have not. Cheers

choff123 · ‎10-31-2014

wow, so PA cant disable sslv3 ... thats not good. I know the sig can protect but common,,,, we cant pick protocols/ciphers on an enterprise class firewall ..?? AND its based on Linux right? so PA went out of its way to make it so we cant do this?

choff123 · ‎04-08-2014

agreed, im calling to confirm 100%. this ones a doozy.

choff123 · ‎01-30-2014

part of my routine is looking for unknown-tcp and udp connections out. Love the feature. For a while ive seen a good amount of unknown-tcp connections out to yahoo.com domains. Anyone else seeing this? PA: Are you guys looking into this so I dont ahve to screen these IPs out when I do my checks. heres the ranges, they are all yahoo 206.190.37.0/24 206.190.36.0/24 98.138.243.0/24 216.39.55.0/24 98.138.49.0/24 98.136.223.0/24 67.195.146.0/24

choff123 · ‎12-12-2013

maybe that title was convoluted but i need some feedback for somethiung i have not done before. setting up a VPN but the other party says they DO NOT allow internal addreses over the VPN to their network; so i cant give them proxy IDs of 192.168.0.0 10.0.0.0 etc... it has to be an internet routable IP. So,, I dont have any proxy IDs Im using an external internet routable IP from the same range im using to setup the VPN. eg: IP for VPN: 5.5.5.5 IP for "interesting traqffic (IP i will send packets with): 5.5.5.4 I will NAT the traffic out 5.5.5.4 while the 5.5.5.5 is used for the VPN tunnel. I tried to use the same IP for both the VPN and the interesting traffic IP but the PA would not let me commit that, thats fine. Is this going to work? I ony have one chance to get this right before there is a change freeze over the holidays. thanks

choff123 · ‎10-21-2013

ok, thanks very much, ill go check that setting.

choff123 · ‎10-21-2013

I need to check the default timeout value for unmapping Active Dir Usernames to IPs. Where can I find/change this? Last Friday, I found a suspect machine on my network. I find the laptop. And its some drywaller plugged into the network using (im guessing) the username last was last bound to that IP, thus getting around all the NAC type rules I have made!! :smileyplain: thanks

choff123 · ‎10-02-2013

Im getting tons of failed to get CRL errors in my logs all of the sudden. Im not sure what I did (if anything) to cause this. Ive tried to fix it, I tried to enable "Server CRL" I did a nslookup on crl.verisign.com and I cant see any connections outbound being denied. I cannot fix this. Any sugestions on how to fix this? What is this even for? I was not aware that the firewall was downloading any CRLs, could it be part of SSL Decrypt? THe admin prior to me tries to get SSL Decrypt working but eh 4xxx serise do not support it (its broken/buggy) Any help appreciated, thanks.

choff123 · ‎10-01-2013

i have those errors and i did not have CRL enabled.

choff123 · ‎09-30-2013

ok, well, ill try harder to catch something with the counters. If I cant catch anything, ill call in, thanks for the help.

choff123 · ‎09-30-2013

thanks fo the advice. I cant see anything on the output thats helps so far ..and there was nothing in the session window, no session at all, so i guess the handshake never completes, i take it we can confirm the handshake never completes.

choff123 · ‎09-30-2013

so i did a pcap. seems the 'drop' log has a bunch of packets in it (outbound to server). So i guess they are being dropped on the way out on the initial connection attempt? the transmit log is empty so i guess my packets are not even leaving the Firewall however, if i test the fw rule from the command line everything seems fine (action allow). test security-policy-match from ZONE source <My IP> to ZONE destination <Remote IP> protocol 6 destination-port 23 also, the rule as it stands right now is very loose. @zarnia: Ill try looking at session data next, @gafrol: I dont think there is a routing issue. The client LAN hooks up to the PA, then out through the IPSec VPN on the PA, so there not much room for different routes if any at all. LAN -> PA/NAT -> IPSec VPN -> Remote Side

choff123 · ‎09-27-2013

ok, thanks, ill try that

choff123 · ‎09-27-2013

yeah, i just ended up rebooting, that was kind of a useless post, thats for the help.

choff123 · ‎09-27-2013

So im doing work on our DR site. Two diff setup scenarios are failing; NAT over a VPN and routing from one PA to another and out a VPN. I can see the rule letting the packets out so a session should start for the return trip but .. nothing. Both scenarios show Application incomplete; what are the leading causes of this? Incomplete handshake? So maybe the other side never returns an ack on the tcp handshake? Return routing does not work? Any inout would be appreciated as im running out of options. thanks

choff123 · ‎09-27-2013

My Virtual Router / Static Route interface is messed up and I cant add any routes. How do I fix this? Thanks.

choff123 · ‎09-17-2013

I have a new AD group that I made that I want to use in a PA rule. Its been 24 hours and it has not shown up. Firmware: 4.1.7 We use Radius. Maybe i should reboot the radius servers ... thanks

choff123 · ‎08-07-2013

Does anyone have any experience setting up VPNs between these two vendors producs? is this question too vague? We're considring getting sonicwall devices for remote offices but Im worried about possible compatability issues. Any feed back would be appreciated. We have a PA-4020 thanks

choff123 · ‎07-18-2013

thank you sweet lord problem solved. thanks very much for all the help. man that was a doozey. show counter global filter packet-filter yes delta yes thats one hell of a command and im going to make sure i make good use of it in the furture.

Date Registered	‎05-18-2012 01:00 PM
Date Last Visited	‎08-06-2019 04:22 PM
Total Messages Posted	87
Total Likes Received	10

Online Status	Offline
Date Last Visited	‎08-06-2019 04:22 PM

Strata

Prisma

Cortex

About choff123