About mikand

mikand · ‎09-08-2016

What about the performance for IPsec vs what PA themself states in the datasheets for each model? As seen for PA-200 the actual throughput is 4-5x the numbers specified in the datasheet but what about the other models (since PA-200 is a bit odd which uses one x86 for its dataplane and no hardware offloading)?

mikand · ‎09-07-2016

I have asked in this kb but it seems like you should enable "Adjust TCP MSS" on the external physical interface to get optimal performance (and in your internal network makre sure you dont drop PMTU (path mtu discovery)): https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Improve-Performance-for-IPSec-Traffic/ta-p/53301

mikand · ‎09-07-2016

As I (currently 😉 understand it "repeat count" is a single log entry but it informs that the same event occured x number of times within 5 seconds (like lets say you get a DDoS of incoming junk, instead of log each and every session you only log a few entries but inform that this happend x number of times - basically to save mgmtplane resources but mainly logspace). Count is the number of log entries (rows) you have located.

mikand · ‎09-07-2016

I dont see why this would be an issue. Did you experience something bad when doing so?

mikand · ‎09-07-2016

Im looking for those with reallife experience from running site-to-site VPN with PA devices both pro (good) and con (bad) stuff that might float up to the surface. How is the reliability, how is the performance, how is the troubleshooting (if any) etc? For example looking at this test http://blog.webernetz.net/2016/07/26/palo-alto-vpn-speedtests/ using PA-200 it shows an average of (give or take) 198-271Mbps (depending on cipher being used) with IPsec while the datasheet for PA-200 says 50Mbps IPsec. Can you assume the same (4-5x compared to the datasheet numbers) for lets say the PA-3000 and PA-5000 (and while we are at it the PA-7000 too) series who in the datasheet says 500Mbps (PA-3000) for IPsec (that is this would actually mean it (PA-3000) would be able to handle 2-2.5Gbps of IPsec in other terms "wirespeed" on a 1Gbps full duplex uplink)? Does perhaps PA themselfs have some numbers that can be provided in this community forum or for that matter any of the forum members who might have somewhat fresh numbers mainly on the performance figures and which ciphers and PA-model you were using? Also are there any performance recommendations (when it comes to IPsec and PA) other than the obvious one to enable "Adjust TCP MSS" as described in https://live.paloaltonetworks.com/t5/Management-Articles/IPSec-and-tunneling-resource-list/ta-p/67721 ?

mikand · ‎09-07-2016

IPsec is the obvious one but lets say you have already taken care of the protection of the traffic, I failed to see if the PA devices for example supports GRE tunneling (basically for performance reasons I would just like the tunneling itself, not the encryption). If not, any of you who might know if GRE (or similar) is even on some kind of roadmap?

mikand · ‎02-24-2016

Hopefully the video will shortly arrive at https://www.youtube.com/user/TROOPERScon/videos

mikand · ‎02-24-2016

Looks like this is the case: Command Injection in Command Line Interface, PAN-SA-2016-0002 https://securityadvisories.paloaltonetworks.com/Home/Detail/35 Unauthenticated Command Injection in Management Web Interface, PAN-SA-2016-0003 https://securityadvisories.paloaltonetworks.com/Home/Detail/36 Unauthenticated Stack Exhaustion in GlobalProtect/SSL VPN Web Interface, PAN-SA-2016-0004 https://securityadvisories.paloaltonetworks.com/Home/Detail/37 Unauthenticated Buffer Overflow in GlobalProtect/SSL VPN Web Interface, PAN-SA-2016-0005 https://securityadvisories.paloaltonetworks.com/Home/Detail/38

mikand · ‎02-10-2016

I dont see anything wrong with the marketing about this speech (among others) at Troopers. They usually have good stuff (as do Blackhat, Defcon and CCC). Not disclosing the vulns before the speech/talk (but also only disclose those who was patched) falls into the ethical hacking code of conduct. That is you will notify the vendor and give them reasonable amount of time to fix the vulns you have discovered. This way you can make a coordinated release of your material (poc, exploit etc) along with the vendor who now will have patches available for their customers. In this particular case its mentioned that PAN was notified about these vulns during 2015 and I as a customer would like to know more such as which (minor)version will contain the fixes, when are these versions (assuming 6.0, 6.1, 7.0 and perhaps even 7.1 series are affected and will receive updates for this) expacted to be released and if there exists any mitigations I can apply right now? For example if it turns out that PAN have similar backdoor to their gear as Juniper and Fortinet already got the mitigation could be to use other devices in order to protect access to mgmt-interfaces, make sure you dont expose mgmt-interfaces (such as SSH) on any dataplane interface etc...

mikand · ‎02-10-2016

I did contact the SE for PAN in Sweden but still (after a week) didnt get any reply. So thats why I turned to the community forum since I know PAN people do hang out here aswell. I have also contacted support@paloaltonetworks.com this morning (about 12 hours ago) but still no response that way either. To me it looks like PAN isnt too interrested in responding to this?

mikand · ‎02-09-2016

So are there any response available from PAN regarding the topic which you can read below? Like when are updates scheduled to be released, any mitigations you can perform before updates are available etc? Or are they already disclosed (and fixed) over at https://securityadvisories.paloaltonetworks.com/ ? Im thinking of: https://www.troopers.de/events/troopers16/630_attacking_next-generation_firewalls_breaking_pan-os/ " Attacking Next-Generation Firewalls: Breaking PAN-OS FELIX WILHELM MARCH 16, 2016 (AT 11:30 A.M.) IN ATTACK & RESEARCH "Next-Generation" firewalls provide functionality well beyond the traditional filtering capabilities. They offer deep protocol inspection, application identification, user based filtering, VPN functionality and more. While this significantly increases the attack surface of these devices, little public research is available. In this talk I will present an in-depth analysis of one of the leading NGFW solutions: Palo Alto’s PAN-OS. Besides describing the overall system architecture, I will discuss and demonstrate several critical vulnerabilities in the different components that can result in a full remote compromise of the appliance. To go beyond 2015 & the pure bashing of security appliances, I’ll also present some positive insights. All vulnerabilities in this talk were disclosed to the vendor in 2015. The vendor is providing patches. The vulnerabilities will be demonstrated live during the talk, but if there is no patch available by the time of the talk, we will not show exploit code. FELIX WILHELM Felix is a security researcher working for ERNW GmbH. His main interests are application security, reverse engineering and virtualization security. Felix has disclosed critical vulnerabilities in popular software such as Hyper-V, Xen, Typo3 or IBM GPFS and has presented his work at international conferences like PHDays, Hack in the Box, Infiltrate and Troopers. "

mikand · ‎01-22-2016

With PA-200 there is a command similar to: set system setting fan-mode auto in order to throttle the onboard fan(s) so it doesnt rev up to max rpm and stays there as it normally might do. But this command doesnt seem to exist for the PA-500 series or am I missing somthing here? All I could find is (output from: show system environmental): ----Fans---- Slot Description Alarm RPMs Min RPM S0 Fan #1 Operational False True 1 S0 Fan #2 Operational False True 1 Doesnt seem to even detect a RPM, the sound can confirm the fans are operating...

mikand · ‎11-27-2015

I have previously seen a table with recommended versions for each majorversion along with each hardware. Like 7.0.3 is not recommended by TAC due to case x, y and z. Which also means unless you use the features described by x, y or z you should be fine to update to 7.0.3. Is that DOC publically available and what its url?

mikand · ‎11-24-2015

So ECDHE/DHE Ciphers (when doing SSL-termination) are working or not now with 6.1.8?

mikand · ‎11-21-2015

You can do "repeat count" from the traffic log and generate a report with resolution of 15 minutes slots (which seems to be the lowest?) as described in https://live.paloaltonetworks.com/t5/General-Topics/Statistics-reports-on-how-much-SSL-traffic-you-got/td-p/67945/page/2 (this particular link is about the same topic but limited to SSL - in your case just remove "appid:ssl" from your report and you should get the total amount of sessions per timeslot). Note however that I think this is number of ENDED sessions during this timeslot, not necessary number of concurrent sessions. I guess you would need to file this as a feature request that the AAC and report engine should log number of concurrent sessions (per appid or so) and add resolution of lets say once a minute to get a more detailed "performance graph" when it comes to concurrent sessions. Another workaround might be if the current session count can be readout through SNMP (or in worst case through RESTAPI) and then in realtime graph this - but the thing is that you shouldnt have to rely on external components, the AAC should be able to do this on its own.

Date Registered	‎03-30-2010 08:39 AM
Date Last Visited
Total Messages Posted	1,449
Total Likes Received	488

About mikand

Re: What is your experience of using site-to-site VPN with PA devices and how is the performance?

Re: Azure VPN Tunnel configuration MTU adjustment

Re: What the different between 'count' and 'repeat count' in the report?

Re: HA Cluster different transceiver type on each firewall

What is your experience of using site-to-site VPN with PA devices and how is the performance?

Re: Overcoming an application filter and url groups

Re: HA questions

Re: Difference between Aggregate and Classified DoS Protection

Re: ThreatID and CVE

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: Encrypted and Zipped files with virus in it

Re: What is your experience of using site-to-site VPN with PA devices and how is the performance?

Re: Azure VPN Tunnel configuration MTU adjustment

Re: What the different between 'count' and 'repeat count' in the report?

Re: HA Cluster different transceiver type on each firewall

What is your experience of using site-to-site VPN with PA devices and how is the performance?

What tunnel options do you have for site-to-site using PA devices?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Re: PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

PAN response to: Attacking Next-Generation Firewalls: Breaking PAN-OS ?

Lower fanspeed on PA-500 so it can be used close to a desktop environment (or at home)?

Re: Which version to use 7.0.3 or 6.1.8 for PA200.

Re: Experiences with PAN-OS 6.1.8 ...

Re: max session count in a month

Network Security

Cloud Security

Security Operations

About mikand