About scantwell

scantwell · ‎09-06-2019

There are free evaluation licenses that your reseller and/or PANW-SE can provide to you, that allows 30 day testing. But NFR licenses are for 1 year and are not free.

scantwell · ‎09-06-2019

Licenses are purchased from your reseller. Do you have a reseller than can submit a PO on your behalf? Perhaps I misunderstood your question. Did you purchase your NFR VM100 from a reseller?

scantwell · ‎08-31-2017

Hello NO error messags in the file ubuntu@minemeld:/var/log$ more cloud-init-output.log Cloud-init v. 0.7.5 running 'init-local' at Wed, 23 Aug 2017 12:40:50 +0000. Up 7.78 seconds. 2017-08-23 12:40:52,367 - cloud-init[WARNING]: Stdout, stderr changing to (| tee -a /var/log/cloud-config-output.log, | tee -a /var/log/cloud-config-output.log) Generating public/private rsa key pair. Your identification has been saved in /etc/ssh/ssh_host_rsa_key. Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub. The key fingerprint is: What is below this is my key fingerprints (not displaying these in public community. 😛 Confirmation on the following... please even though I see references for cloud in this image, I am using the correct version for VMWare Player, correct? I would hate to waste time and troubleshooting to find that I am using an incorrect version. ubuntu@minemeld:/var/log$ netstat -na Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 192.168.1.4:22 192.168.1.12:32231 ESTABLISHED tcp6 0 0 :::22 :::* LISTEN udp 0 0 0.0.0.0:68 0.0.0.0:* udp 0 0 0.0.0.0:60069 0.0.0.0:* udp6 0 0 :::19782 :::* Next steps please? Steve

scantwell · ‎08-23-2017

I am brand new into Minemeld. I followed the link https://live.paloaltonetworks.com/t5/MineMeld-Articles/Running-MineMeld-on-VMWare-desktop/ta-p/72038 for installation and followed steps. All seemed to work fine. There was a note that to access Minemeld, it would be using 443. Great. I opened my browser up and attempt to reach the DHCP:443 address of Minemeld. Cannot connect. i did a netstat -na on the minemeld via cli and 443 is not opened up? I have attached output. What could I be doing incorrectly?

scantwell · ‎06-22-2015

I have implemented SinkHole and it works awesome. thanks

scantwell · ‎10-06-2014

Tician I would like for you to go back and test the number of users and logins. Your comment about After 15 or 20 log in's and out's, I have faced with automatic log off from web interface after successful login..... I have seen this before (automatic log off when you logged in...) and I see this as a bug in 6.x version of software. I have talked to PAN about this, but I do not think a bug tracker has been identified on this.

scantwell · ‎09-15-2014

I do not see any problems with upgrading a single FW only. It should not break the HA functionality.

scantwell · ‎09-05-2014

I believe he is talking about Trusted CA Trusted Root CA —The certificate is marked as a trusted CA for forward decryption purposes. I think he had this checked off. when he removed it, his GP worked. This would make sense.

scantwell · ‎09-05-2014

I am not aware of any single location that you would /could see all the re-graded items in a single location. I like the idea of what you are doing, however, I think the spirit of the reasoning behind re-grading was for a handful of apps, not all of them. So, I feel you are looking at a feature request to have a single list.. trust me.. that would be very handy and helpful! Thanks SC

scantwell · ‎08-15-2014

I tried to migrate over my Cisco IPS regex to Palo Alto but it failed to load. Below is my Cisco Regex. [Uu][Ss][Ee][Rr][-][Aa][Gg][Ee][Nn][Tt][:][\x20][^\x0d\x0a]*([Ss][Yy][Nn][Aa][Pp][Ss][Ee]) I tried creating a new pattern but it is to specific and not working. I am looking to search the http header for User-Agent and if the value contains the word Synapse then alert. Can someone help me to better understand what I am doing wrong? Can someone educate me AND help generate the RegEx example for me.. (that is my real question) Thanks Steve

scantwell · ‎07-23-2014

Quick question.. What experience does anyone in the forum has with setting up a PA in an E-Commerce site? Is there anything in specifics that we need to do differently than a normal implementation? The basis is that E-Commerce will have servers on the internet, so they are very prone to "nosey" people who are constantly trying to exploit vulnerabilities. I understand that we scan for the known vulnerabilities, but I also need to know if there is anything else that needs to be done on the FW. I am going to recommend that SSL Inbound Decryption be enabled to give the FW the opportunity to scan for the bad traffic. Any other items/best practices, configuration recommendations, etc, would be greatly appreciated. Let me know asap :smileysilly: Steve

scantwell · ‎07-21-2014

Hi Guys I need some help/thoughts on how to do the following: I have 5 Panorama servers that are virtual in Montreal. I need to move them ffrom Montreal to a different VMWare environment in Chicago I need to know if there are any problems with doing such a thing. Is there a document that can be found to do this. I am concerned about a different CPUID/UUID being different from one VMWare server to another. I mean, how else do you prevent someone from buying a single copy of software and deploying it in multiple locations (that do not talk to each other) Help! :smileysilly:

scantwell · ‎10-23-2013

Also, I think it is important to understand what hardware platform you are running, what screens/pages are loading slowly for you. For example. I have a PA-2050 that when I first configured it, all was working fine. As I continue to add more rules the security policy page gets slower as it takes time to read the entire page etc. Unless someone comes back to tell me this is abnormal, I am pretty sure this is working as intended.

scantwell · ‎10-03-2013

More than that... which I agree with Mikand and PanOs.... the IE (or any browser) is a client connecting to a server page. If IE is not displaying correctly, it has gotten the info from the FW, but not showing it correctly. thats a browser issue and nothing that PA can do to fix that... sorry

scantwell · ‎09-05-2013

I always understood the Migration Tool was geared to Partners only, not to the end users. Maybe that is why it has limited access.

scantwell · ‎08-28-2013

I agree with Phoenix... Having the client and nothing to test the GP does not make sense. Configure GP and then use against a few IPs.

scantwell · ‎08-27-2013

You could restore to a previous version or config, but the date of the license would not change, so it would still not completely work. Now the real question is... what if you backdated the FW to a previous time/date (maybe 2002, when the 2013 and 2002 calendar are repeating pattern of each other.) :smileysilly:

scantwell · ‎08-20-2013

Would this work if you used Vwire sub interfaces on the eth1/2 interface? VWire1 = 1/1 and eth1/2.10 Vwire2 = eth1/2.20 to Eth1/3? You would essentially add a VLAN tag to the 2.10 interface, send it down to your router, which would then send it back to the FW on a different vlan (routing between vlans, what a concept) then the router forwards the traffic to the 2.20 interface and to eth 1/3? Thoughts on this from the community please? Thanks

scantwell · ‎08-20-2013

Hi Community I was teaching a class and was asked a simple question: Is there a max number of FW administrators that can be concurrently logged into the FW at the same time? I have a large customer (a Managed Service Provider) with a large number of FWs, as well as a international team supporting the customers. It is possible to have many admins logged into the box at the same time. Do we have a reasonable number (25, 30, 50?) that reaches the max number, or can I go back and state that 25 or 50 admins could be logged in, but Palo Alto Networks does not recommend it? Thanks.

scantwell · ‎07-16-2013

Hi there. Glad you figured it out. Can you go back into your post, mark it as Correct, and then highlight my response as the correct answer? This way, other people that search for similar info see the issue is resolved. Steve

scantwell · ‎07-15-2013

DanLukas Do you have a 1 or more routes pointing 0.0.0.0 to your next hop router? In other words, I have seen people program their own 0.0.0.0/0 route, pointing to their ISP's router. I am curious if you did the same?

scantwell · ‎06-13-2013

Hi Group I am looking for some practical experience on how to best block as many cloud-based services as possible. I know I can probably create some Dynamic Filters for some apps, but other may need to be controlled differently (SSL decryption, block the domain name, etc). I am wondering what the bulk of firewall admin or others are doing in such circumstances. I am about to do a remote install, and I want to make sure I cover all my bases. Thanks

scantwell · ‎06-08-2013

There is supposed to be awareness by the Palo Alto firewall, as there are AET questions from this forum from 2010. I would recommend that you contact your SE and discuss your findings with him, so a ticket for escalation could be opened as needed.

scantwell · ‎05-24-2013

You are somewhat correct. My recommendation is I do not think you can put the src any and dest any.... you must create a policy, otherwise it matches ALL traffic. Create an address group object of all subnets or addresses that you want to enforce on eth1

scantwell · ‎05-24-2013

I would mirror on the TX from the Trusted Network. I would mirror on the RX on the DMZ. (Presuming there is NO reason why the DMZ should be TX traffic to the Trusted side of the network). If DMZ is sourcing traffic to Internet, then maybe you can mirror on TX side then. I would mirror on the RX on the Internet (presuming you have switch on OUTSIDE of the current FW, so this is TX into the network, not being TX out to the Internet, as you already caught that traffic on the Trusted side TAP interface) I do not think you need to tap on VS for eval purposes. Use Vsys1.

scantwell · ‎05-24-2013

So in your example, outgoing traffic would go out through ISP1/old_FW (the only static route on the PA), return traffic would come in through ISP2, go into trusted and response for that would go out through ISP2 again? Yes... in a sense... WHAT if traffic comes INBOUND from ISP2? The default route on the FW states to go out Eth1/1, but that is not where the traffic originated. We need to enforce symmetric return. :smileysilly: Could I use the enforce symmetric return feature to make sure response traffic from server #1 goes out the same interface the requests came in through? Again, if the default GW is already eth1/1, then inbound traffic from Old_FW, going into the DMZ, would already go (based on the default GW) out eth1/1 (no need to enforce) • No PBF—Do not alter the path that the packet will take. This is a good question. My only comment would be, depending on how granular your PBF rules are, there could be some unique matching characteristics where PBF would forward traffic, and you need to tell it to specifically NOT to do it. I do not have a great example to provide you.

scantwell · ‎05-24-2013

Hi Sascha I think it is great to tackle new features, and I will be glad to try and answer your response. I will attempt to write this out, but drawing it is a little easier. :smileysilly: For ease of example: Eth1/1 connects to ISP1 (old FW??) (1.1.1.2) Eth1/2 connects to traffic from ISP2 (2.2.2.1) Eth1/4 connects to subnet(s) (10.x.x.x or whatever) In the new FW, there is only 1 static route bound, and it point to the eth1/1 interface (next hop is ISP = 1.1.1.102) Return traffic FROM the internet, comes in on ISP2 (and therefore eth1/2) (next hop is 2.2.2.101) The traffic goes through the FW and leaves (to the trusted network You symmetric return would look like this: SOURCE (eth1/2) Destination (10.x,x,x) ACTION: Forward Egress Interface eth1/4 Enable Symmetric Return Next Hop (2.2.2.101) The "NO PBR rule" states that it will fall back the virtual router (not what you want it to do. You NEED a PBF Foward action rule) PBF has to match a certain policy, hence the name :smileysilly: In this example, as with other rules managing destination NAT, be sure to use the pre-NAT value for the destination address in the PBF rule since the rules are evaluated before the NAT changes are applied.

scantwell · ‎05-21-2013

I think you need to get a wireshark trace ready to see what is happening when inbound traffic from the Internet is processed by the FW. I would go back to original suggestion. Contact Palo Alto T2 support, get a ticket opened, and then get on a conference call with Polycom T2 support and when Polycom attempts to call you, the Palo Alto techs can perform the associated traces. To answer your question, YES, I think this definitely a PA issue, and they need to do the troubleshooting.

scantwell · ‎05-21-2013

Turn OFF H460 Turn OFF NAT configuration. The PA box (to the best of my knowledge) does NOT support H.460 FW traversal. The NAT config is ONLY is your FW does not know how to do H323 with the PA does know how to do. Thanks

scantwell · ‎05-21-2013

Dat, Do NOT follow the document https://live.paloaltonetworks.com/docs/DOC-3194 (H323 Polycom Video Conf Drops), as if you notice, that document references Port 5060 (SIP), but SIP is certainly NOT H.323 traffic. (2 totally diff protocols). I worked at Polycom for 4 years, so this is a common problem that needs to be resolved by the Firewall, checking ports, etc. The H225 call setup is probably working, but the negotiation of what TCP/UDP ports is not being allowed by the firewall. I have seen this many many times. Many times. :smileysilly: Your best friend in troubleshooting this will be to use Wireshark traces to see what is and is not going in your network. Please confirm what settings you have enabled on your codec from the WebUI: Fixed Ports: (what if anything do you have here) Enable H.460 (on or off) NAT configuration (what is this setting) <---- Very important, and could be the reason why the call fails. First thing I would do, is to create a rule allowing ONLY the specific IP address from the source network, inbound to your network, with ANY application, ANY service. Put this rule at the top of your rulebase. (Please confirm this for me) We do this, just to see if the H225 call setup and negotiation work correctly. If the call sets up and works correctly, then you know we have some firewall rules and dynamic NAT policies in the FW that are not working. What I would definitely do, is to contact Palo Alto T2 support, and get the ticket opened with them. I would then (with Palo T2 on the phone), called into Polycom T2 support (they have codecs on the public internet with no firewalls between them. Best test scenario). Have Polycom call into your FW, and let PA T2 support look at your logs and see what is going on. I will be glad to assist you, just send me a PM and I can work with you on this. Thanks SC

Date Registered	‎08-01-2012 07:54 AM
Date Last Visited	‎04-13-2020 11:21 AM
Total Messages Posted	132
Total Likes Received	32

Online Status	Offline
Date Last Visited	‎04-13-2020 11:21 AM

Strata

Prisma

Cortex

About scantwell