About VSU_ITSEC

VSU_ITSEC · ‎04-04-2016

I'd like to monitor a portion of my network on my failover PA in TAP mode. Will this affect my HA pair at all? Is it possible to set up an aggregate TAP of 2 ports? thanks in advance...

VSU_ITSEC · ‎10-12-2015

A note to all - the upgrade to 6.1.6 only worked on one of my 2 PA-5020s. The dataplane kept crashing on my primary (Dataplane is down: too many dataplane processes exited). has anyone experienced similar? Rebooting with the interfaces disconnected (all except managment and HA) did not solve.

VSU_ITSEC · ‎10-08-2015

crystal clear! thanks....

VSU_ITSEC · ‎10-08-2015

Forgive my limited knowlegde of certs, Pakumar. Are you saying that the GP config on the remote device should match what is on the cert?

VSU_ITSEC · ‎10-08-2015

Thanks, V., but PA tech support didn't sound as convincing as you ;^). I'll consider... perhaps there are others seeing this who share your experience? (holla!)

VSU_ITSEC · ‎10-07-2015

Thank you for that. How doe sthis apply to a wildcard cert?

VSU_ITSEC · ‎10-07-2015

I plan to update to PAN-OS 6.1.6 and GP 2.3.1. Currently at 6.1.0, and 2.1.1. Any suggestions or issues? Thanks in advance //moe

VSU_ITSEC · ‎05-15-2015

Does PA not do DNS lookups on URL filtering? We have an FQDN being blocked as malware, but the site can be accessed if the IP address is used. thx //moe

VSU_ITSEC · ‎03-19-2015

Anyone already have a fix for this: Our wireless environment authenticates via a Juniper UAC that logs the username/MAC addy. The IP address is then issued buy an InfoBlox server that logs MAC/IP address. I've been advised to combine the logs somehow for UserID on the PA-5020 (Software Version6.1.0). Thanks //moe

VSU_ITSEC · ‎02-09-2015

Is it possible to add system throughput info to the "System Resources" widget on the GUI dashboard? thanks //moe

VSU_ITSEC · ‎01-13-2015

I understand how to create/edit a redirect page for blocked URLs globally. How do I set up a redirect page for a group of URLs created in Objects>Custom Objects>URL Category only? Thanks //moe

VSU_ITSEC · ‎10-13-2014

I was pinging the management interface (didn't consider the inside int) and google.com while the firewall rebooted. The management came back up and i could log back into the device. the ping out to google didn't come back. I have two firewalls in HA active-pasive mode. I was updating the primary. (the secondary's inside/outside interfaces are currently not connected to switch)

VSU_ITSEC · ‎10-13-2014

What about for right now? My traffic is symetric, yet I had no traffic.

VSU_ITSEC · ‎10-13-2014

will the command disrupt traffic before the software is updated? What i'm asking is, can I do this now, and upgrade later?

VSU_ITSEC · ‎10-13-2014

We are symetric right now. Will be asymetric in a couple months.

VSU_ITSEC · ‎10-13-2014

Last month I upgraded to 6.0.4 with no issues. I upgraded my primary, then upgraded the secondary five days later. Again, no problems. When I upgraded to 6.0.5 h3 (this past weekend), the PA would not pass traffic. I returned to 6.0.4 and traffic restored. I then tried 6.0.5 and had the same problem - no traffic. I followed the same procedures as I did with the upgrade to 6.0.4. Any ideas? Thanks as always. //moe

VSU_ITSEC · ‎10-09-2014

Thanks. I found that quickly. So I can use the fiber for both HA 1 & 2, correct?

VSU_ITSEC · ‎10-08-2014

I'd like to move my HA connection from the dedicated ports to fiber ports, however I don't have the option do change the port. Am I able to do this? Do I have to disable the HA first? Lastly, will I be able to keep the remaining settings? If I am able to do this, is it advisable? I recall from training that running the HA over a network wasn't a suggested practice. Thanks as always... //moe

VSU_ITSEC · ‎09-25-2014

@PA-5020-P(active)> test url g.symcd.com g.symcd.com computer-and-internet-info (Base db) expires in 0 seconds g.symcd.com computer-and-internet-info (Cloud db) I see where you are going w/this…. So… Am I to verify each entry on my botnet report prior to taking action? Am I getting URL updates soon enough, an if not, where do I adjust? Am I placing too much ‘faith’ in the botnet report? From the botnet report: confidence Virtual System description 4 vsys1 Repeatedly visited (42) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (441) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (65) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (59) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCK7KMAoI08AAGfwI84AAACi 4 vsys1 Repeatedly visited (40) the same malicious URL acuityplatform.com/Adserver/exds?xuid=8f02281c60d856473aab5158f5ac729c 4 vsys1 Repeatedly visited (123) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (190) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (63) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLtJMAoI0gAAHjWIP0AAABR 4 vsys1 Repeatedly visited (68) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (65) the same malicious URL acuityplatform.com/Adserver/exds?xuid=ef8c5c814844f7f359896d10d97045dd 4 vsys1 Repeatedly visited (100) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36931 4 vsys1 Repeatedly visited (51) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLVhsAoI0YAACmlXH8AAACE 4 vsys1 Repeatedly visited (198) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2 4 vsys1 Repeatedly visited (39) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLTtsAoIz0AAAZPA.MAAACV 4 vsys1 Repeatedly visited (45) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36931 4 vsys1 Repeatedly visited (73) the same malicious URL acuityplatform.com/Adserver/atds?getuserid= http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID 4 vsys1 Repeatedly visited (157) the same malicious URL acuityplatform.com/Adserver/atds?getuserid= http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID 4 vsys1 Repeatedly visited (47) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLeicAoI0YAAD4Vd2cAAAAD 4 vsys1 Repeatedly visited (121) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCMOwMAoI0oAAEKePowAAADV 4 vsys1 Repeatedly visited (45) the same malicious URL acuityplatform.com/Adserver/atds?getuserid= http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID 4 vsys1 Repeatedly visited (36) the same malicious URL assets.tumblr.com/fonts/gibson/stylesheet.css?v=3 4 vsys1 Repeatedly visited (575) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (43) the same malicious URL acuityplatform.com/Adserver/exds?xuid=41ed950b4ac8a2da0effdb75f6b13fe2 4 vsys1 Repeatedly visited (45) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36953 4 vsys1 Repeatedly visited (127) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLQicAoIzcAAIBXHTwAAAD7 4 vsys1 Repeatedly visited (133) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (107) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36939 4 vsys1 Repeatedly visited (38) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLi5cAoI0oAAJ2eaAIAAAAD 4 vsys1 Repeatedly visited (150) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (38) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLwVMAoIzsAABrw-C0AAAE8 4 vsys1 Repeatedly visited (42) the same malicious URL cdn.mxpnl.com/libs/mixpanel-2.2.min.js 4 vsys1 Repeatedly visited (187) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (58) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCL9o8AoIzMAABBzJg0AAABO 4 vsys1 Repeatedly visited (51) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (85) the same malicious URL g.symcd.com/ 4 vsys1 Repeatedly visited (54) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2 4 vsys1 Repeatedly visited (163) the same malicious URL acuityplatform.com/Adserver/atds?getuserid= http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID 4 vsys1 Repeatedly visited (70) the same malicious URL ortc-ws6-useast1-s0003.realtime.co/ 4 vsys1 Repeatedly visited (555) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2

VSU_ITSEC · ‎09-25-2014

Have a new site in today's list with the same issue: g.symcd.com. This is new for us (so is the device); how often does this happen?

VSU_ITSEC · ‎09-23-2014

VSU_ITSEC · ‎09-23-2014

from the CLI @PA-5020-P(active)> test url www.googletagservices.com/tag/js/gpt.js www.googletagservices.com/tag/js/gpt.js search-engines (Base db) expires in 0 seconds www.googletagservices.com/tag/js/gpt.js search-engines (Cloud db) i'll get the URL/threat log in a few...

VSU_ITSEC · ‎09-23-2014

URL googletagservices.com Category Search Engine Any yes, that was my PAN- OS version #, my bad... URLfiltering is 2014.09.22.470

VSU_ITSEC · ‎09-23-2014

6.0.3

VSU_ITSEC · ‎09-23-2014

Dumb question perhaps, but why is www.googletagservices.com/tag/js/gpt.js being flagged as a malicious URL? It doesn't come up that way in PA's URL filtering site. It's created a considerable jump in my botnet list. Thanks in advance... //moe

VSU_ITSEC · ‎08-28-2014

sample

VSU_ITSEC · ‎08-28-2014

i believe so. the connections don't match that vulnerability, which i have "reset-both" assigned to it.

VSU_ITSEC · ‎08-28-2014

I'm experiencing a ton of hits over ssh to servers that must have ssh access. Is there a way to do threat assessment based on SSH, port etc – and then automatically shut the attack down? For example if a certain IP begins sending all that traffic on port 22 within a certain timeframe – we shutdown the traffic and blacklist the IP. What would be better is to limit this rule to a certain scope – say all of China and Korea where we know attacks tend to happen from – this will help keep down false positives. thanks //moe

VSU_ITSEC · ‎06-30-2014

thank you!

VSU_ITSEC · ‎05-13-2014

I did a search for this... came up w/nada. Has there been any convo about CryptoWall? Has PA addressed it? thanks //moe

Date Registered	‎03-03-2014 10:23 AM
Date Last Visited	yesterday
Total Messages Posted	37

Online Status	Offline
Date Last Visited	yesterday

About VSU_ITSEC

TAP interface questions

Re: PAN-OS and Global Protect software

Re: PAN-OS and Global Protect software

Re: PAN-OS and Global Protect software

Re: PAN-OS and Global Protect software

Re: PAN-OS and Global Protect software

TAP interface questions

Re: PAN-OS and Global Protect software

Re: PAN-OS and Global Protect software

Re: PAN-OS and Global Protect software

Re: PAN-OS and Global Protect software

Re: PAN-OS and Global Protect software

PAN-OS and Global Protect software

URL Filter Question

UserID from 2 separate logs?

Add throughput to GUI?

Custom Redirecting

Re: Software Update Issue

Re: Software Update Issue

Re: Software Update Issue

Re: Software Update Issue

Software Update Issue

Re: HA dedicated to Fiber

HA dedicated to Fiber

Re: malware??

Re: malware??

Re: malware??

Re: malware??

Re: malware??

Re: malware??

malware??

Re: ssh (or any) threshold?

Re: ssh (or any) threshold?

ssh (or any) threshold?

Re: CryptoWall??

CryptoWall??

Strata

Prisma

Cortex

About VSU_ITSEC