About Fengrui

cool, this is great, thanks @jvalentine, this explains why Palo is not sinkholing the DNS request.   @kiwi, the article you mentioned probably needs updating, DNS sinkholing in itself is very useful and effective, however in this specific case, looks like it's not being used. ... View more

@jvalentine, I think if you sinkhole the the killswitch domain, then the malware will exit and do nothing? As it thinks being analysed in a sandbox environment? That's my understanding how the killswitch worked. You can't block it though.   @kiwi, for DNS sinkhole to work, the domain/URL have to be regarded malicious by palo to start with, and it seems this is not the case yet, we have DNS sinkhole configured in our environment, I'd expect the DNS query internally to the killswitch domain would come back with the sinkhole bogus IP, however it didn't.   ... View more

@jdelio, thank you for the link, as we have dedicated log collectors - physical appliances, so I guess the last command you supplied won't be applicable for us? I am trying to get a clear instruction on upgrading our environment, so far your comment above seems the closest one. As the option for labbing this up is restricted, since we don't have any spare log collectors to test, and also the log conversation process sounds like irreversible, so I am a bit nervous. ... View more

@jdelio, thanks Joe. ... View more

 @jdelio Thanks Joe, we do have dedicated log collector, so the serial number in the command would be from one of the firewalls sending logs to the collector? And this means I will need to convert log for each firewall? ... View more

Hi Joe @jdelio,   We have a panorama(VM) with 2x M-100 log collectors, to upgrade to 8.0, here is my plan,   1. Upgrade both Panorama and log collectors to 8.0, confirm they are working, e.g. new logs are showing fine. 2. Start the old log migration with the following command.     PA>request logdb migrate lc serial-number<serial_number> start   My question is on the 2nd step, where do I run this command from, is it from Panorama or LC? If it's panorama, I guess the serial_number is one of the log collectors?   Thanks, Fengrui   ... View more

The error message    Server error : entry not found   is most likely caused by not setting the vsys, if you do,   > set system setting target-vsys vsys1   This should work. ... View more