This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
About mikand
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Announcements
We are conducting regularly scheduled maintenance over the weekend, which could cause some downtime on LIVEcommunity. We apologize for any inconvenience.
- LIVEcommunity
- About mikand
1449Posts
491Likes
85Solutions
Last Visited
User
Activity
User
Profile
Latest posts by mikand
| Subject | Views | Posted |
|---|---|---|
| 1725 | 09-08-2016 03:58 PM | |
| 2787 | 09-07-2016 11:05 AM | |
| 2715 | 09-07-2016 11:01 AM | |
| 1033 | 09-07-2016 10:57 AM | |
| 1748 | 09-07-2016 10:37 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 09-10-2012 03:16 PM | |
| 1 Like | 06-01-2012 11:39 AM | |
| 1 Like | 04-17-2012 10:41 PM | |
| 1 Like | 02-28-2012 11:57 AM | |
| 2 Likes | 02-13-2012 11:35 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 3 Likes |
User Badges
Community Statistics
| Member Since | 03-30-2010 08:39 AM |
| Date Last Visited | |
| Posts | 1,449 |
| Total Likes Received | 491 |
09-08-2016
03:58 PM
What about the performance for IPsec vs what PA themself states in the datasheets for each model? As seen for PA-200 the actual throughput is 4-5x the numbers specified in the datasheet but what about the other models (since PA-200 is a bit odd which uses one x86 for its dataplane and no hardware offloading)?
... View more
09-07-2016
11:05 AM
I have asked in this kb but it seems like you should enable "Adjust TCP MSS" on the external physical interface to get optimal performance (and in your internal network makre sure you dont drop PMTU (path mtu discovery)): https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Improve-Performance-for-IPSec-Traffic/ta-p/53301
... View more
09-07-2016
11:01 AM
As I (currently 😉 understand it "repeat count" is a single log entry but it informs that the same event occured x number of times within 5 seconds (like lets say you get a DDoS of incoming junk, instead of log each and every session you only log a few entries but inform that this happend x number of times - basically to save mgmtplane resources but mainly logspace). Count is the number of log entries (rows) you have located.
... View more
09-07-2016
10:57 AM
I dont see why this would be an issue. Did you experience something bad when doing so?
... View more
09-07-2016
10:37 AM
Im looking for those with reallife experience from running site-to-site VPN with PA devices both pro (good) and con (bad) stuff that might float up to the surface. How is the reliability, how is the performance, how is the troubleshooting (if any) etc? For example looking at this test http://blog.webernetz.net/2016/07/26/palo-alto-vpn-speedtests/ using PA-200 it shows an average of (give or take) 198-271Mbps (depending on cipher being used) with IPsec while the datasheet for PA-200 says 50Mbps IPsec. Can you assume the same (4-5x compared to the datasheet numbers) for lets say the PA-3000 and PA-5000 (and while we are at it the PA-7000 too) series who in the datasheet says 500Mbps (PA-3000) for IPsec (that is this would actually mean it (PA-3000) would be able to handle 2-2.5Gbps of IPsec in other terms "wirespeed" on a 1Gbps full duplex uplink)? Does perhaps PA themselfs have some numbers that can be provided in this community forum or for that matter any of the forum members who might have somewhat fresh numbers mainly on the performance figures and which ciphers and PA-model you were using? Also are there any performance recommendations (when it comes to IPsec and PA) other than the obvious one to enable "Adjust TCP MSS" as described in https://live.paloaltonetworks.com/t5/Management-Articles/IPSec-and-tunneling-resource-list/ta-p/67721 ?
... View more
09-07-2016
10:08 AM
IPsec is the obvious one but lets say you have already taken care of the protection of the traffic, I failed to see if the PA devices for example supports GRE tunneling (basically for performance reasons I would just like the tunneling itself, not the encryption). If not, any of you who might know if GRE (or similar) is even on some kind of roadmap?
... View more
02-24-2016
09:11 PM
Hopefully the video will shortly arrive at https://www.youtube.com/user/TROOPERScon/videos
... View more
02-24-2016
09:10 PM
Looks like this is the case:
Command Injection in Command Line Interface, PAN-SA-2016-0002 https://securityadvisories.paloaltonetworks.com/Home/Detail/35
Unauthenticated Command Injection in Management Web Interface, PAN-SA-2016-0003 https://securityadvisories.paloaltonetworks.com/Home/Detail/36
Unauthenticated Stack Exhaustion in GlobalProtect/SSL VPN Web Interface, PAN-SA-2016-0004 https://securityadvisories.paloaltonetworks.com/Home/Detail/37
Unauthenticated Buffer Overflow in GlobalProtect/SSL VPN Web Interface, PAN-SA-2016-0005 https://securityadvisories.paloaltonetworks.com/Home/Detail/38
... View more
02-10-2016
10:32 AM
1 Kudo
I dont see anything wrong with the marketing about this speech (among others) at Troopers.
They usually have good stuff (as do Blackhat, Defcon and CCC).
Not disclosing the vulns before the speech/talk (but also only disclose those who was patched) falls into the ethical hacking code of conduct.
That is you will notify the vendor and give them reasonable amount of time to fix the vulns you have discovered. This way you can make a coordinated release of your material (poc, exploit etc) along with the vendor who now will have patches available for their customers.
In this particular case its mentioned that PAN was notified about these vulns during 2015 and I as a customer would like to know more such as which (minor)version will contain the fixes, when are these versions (assuming 6.0, 6.1, 7.0 and perhaps even 7.1 series are affected and will receive updates for this) expacted to be released and if there exists any mitigations I can apply right now?
For example if it turns out that PAN have similar backdoor to their gear as Juniper and Fortinet already got the mitigation could be to use other devices in order to protect access to mgmt-interfaces, make sure you dont expose mgmt-interfaces (such as SSH) on any dataplane interface etc...
... View more
02-10-2016
10:23 AM
I did contact the SE for PAN in Sweden but still (after a week) didnt get any reply.
So thats why I turned to the community forum since I know PAN people do hang out here aswell.
I have also contacted support@paloaltonetworks.com this morning (about 12 hours ago) but still no response that way either.
To me it looks like PAN isnt too interrested in responding to this?
... View more
02-09-2016
01:32 PM
So are there any response available from PAN regarding the topic which you can read below?
Like when are updates scheduled to be released, any mitigations you can perform before updates are available etc?
Or are they already disclosed (and fixed) over at https://securityadvisories.paloaltonetworks.com/ ?
Im thinking of:
https://www.troopers.de/events/troopers16/630_attacking_next-generation_firewalls_breaking_pan-os/
" Attacking Next-Generation Firewalls: Breaking PAN-OS
FELIX WILHELM
MARCH 16, 2016 (AT 11:30 A.M.) IN ATTACK & RESEARCH
"Next-Generation" firewalls provide functionality well beyond the traditional filtering capabilities. They offer deep protocol inspection, application identification, user based filtering, VPN functionality and more.
While this significantly increases the attack surface of these devices, little public research is available. In this talk I will present an in-depth analysis of one of the leading NGFW solutions: Palo Alto’s PAN-OS. Besides describing the overall system architecture, I will discuss and demonstrate several critical vulnerabilities in the different components that can result in a full remote compromise of the appliance. To go beyond 2015 & the pure bashing of security appliances, I’ll also present some positive insights.
All vulnerabilities in this talk were disclosed to the vendor in 2015. The vendor is providing patches. The vulnerabilities will be demonstrated live during the talk, but if there is no patch available by the time of the talk, we will not show exploit code.
FELIX WILHELM
Felix is a security researcher working for ERNW GmbH. His main interests are application security, reverse engineering and virtualization security. Felix has disclosed critical vulnerabilities in popular software such as Hyper-V, Xen, Typo3 or IBM GPFS and has presented his work at international conferences like PHDays, Hack in the Box, Infiltrate and Troopers. "
... View more
01-22-2016
02:41 PM
With PA-200 there is a command similar to:
set system setting fan-mode auto
in order to throttle the onboard fan(s) so it doesnt rev up to max rpm and stays there as it normally might do.
But this command doesnt seem to exist for the PA-500 series or am I missing somthing here?
All I could find is (output from: show system environmental):
----Fans---- Slot Description Alarm RPMs Min RPM
S0 Fan #1 Operational False True 1
S0 Fan #2 Operational False True 1
Doesnt seem to even detect a RPM, the sound can confirm the fans are operating...
... View more
11-27-2015
11:55 AM
I have previously seen a table with recommended versions for each majorversion along with each hardware.
Like 7.0.3 is not recommended by TAC due to case x, y and z. Which also means unless you use the features described by x, y or z you should be fine to update to 7.0.3.
Is that DOC publically available and what its url?
... View more
11-24-2015
03:57 PM
So ECDHE/DHE Ciphers (when doing SSL-termination) are working or not now with 6.1.8?
... View more
11-21-2015
04:15 PM
1 Kudo
You can do "repeat count" from the traffic log and generate a report with resolution of 15 minutes slots (which seems to be the lowest?) as described in https://live.paloaltonetworks.com/t5/General-Topics/Statistics-reports-on-how-much-SSL-traffic-you-got/td-p/67945/page/2 (this particular link is about the same topic but limited to SSL - in your case just remove "appid:ssl" from your report and you should get the total amount of sessions per timeslot).
Note however that I think this is number of ENDED sessions during this timeslot, not necessary number of concurrent sessions.
I guess you would need to file this as a feature request that the AAC and report engine should log number of concurrent sessions (per appid or so) and add resolution of lets say once a minute to get a more detailed "performance graph" when it comes to concurrent sessions.
Another workaround might be if the current session count can be readout through SNMP (or in worst case through RESTAPI) and then in realtime graph this - but the thing is that you shouldnt have to rely on external components, the AAC should be able to do this on its own.
... View more
Contact Me
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks