This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About TheRealDiz
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About TheRealDiz
04-10-2018
96Posts
12Likes
1Solution
Apr 10, 2018Last Visited
User
Activity
User
Profile
Latest posts by TheRealDiz
| Subject | Views | Posted |
|---|---|---|
| 3171 | 04-10-2018 11:52 AM | |
| 3181 | 04-10-2018 05:39 AM | |
| 3186 | 04-10-2018 03:03 AM | |
| 3219 | 03-23-2018 08:11 AM | |
| 1076 | 10-25-2017 01:18 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 05-03-2016 01:05 AM | |
| 1 Like | 03-21-2017 02:10 AM | |
| 1 Like | 03-17-2017 02:55 AM | |
| 1 Like | 02-22-2017 02:13 AM | |
| 1 Like | 01-31-2017 09:05 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 3 Likes | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 01-18-2016 06:21 AM |
| Date Last Visited | 04-10-2018 03:13 PM |
| Posts | 96 |
| Total Likes Received | 12 |
04-10-2018
11:52 AM
Hi @BPry, That’s right haha! It doesn’t matter actually it was only for test purposes 🙂 (I’ll keep that in mind)
... View more
04-10-2018
05:39 AM
Hi @Raido_Rattameister, I know I've seen what you described, infact starting from this mechanism (NIC0 = mgmt NIC1= eth1 etc. ...) my question is if it's possible to disable mgmt interface when is not needed. But no problem guys at the end I have basically assigned to mgmt a non-used IP 2.2.2.2 and I have finalized my configuration on eth1 🙂 Thanks for your reply! Luca
... View more
04-10-2018
03:03 AM
Hi @BPry, Thank you for your reply! Sorry for the wait I was very busy during these week. Via GUI there was no way to disable mgmt interface but via CLI was possible to issue command mentioned in my post. It has caused some strange issues with DNS, PA-VM sometimes was able to solve domains and sometimes not. That's why I'm asking if there is a way to disable mgmt interface or leaves it without IP when is not needed. BR Luca
... View more
03-23-2018
08:11 AM
Hi Guys, I got a simple question for you: Is it possible to literally disable/shutdown mgmt interface, via CLI or webUI, in a VM enviroment when is not needed? I notice a DNS issue after we have deleted the IP address assigned to the MGMT interface via cli with command: "delete deviceconfig system ip-address" Obviously we have made PA reachable from another interface ethernet1/1, configuring every "service route configuration" on this specific ethernet1/1. Unfortunately DNS queries were not working properly even if service route configuration was set on ethernet1/1. I configured fake IP address on MGMT interface.. and guess what happened? DNS queries start working properly. From my point of view this kind of command "delete deviceconfig system ip-address" should be banned haha 🙂 In order to avoid future issues, is there a way to clean the entire mgmt configuration or literally shut down it? Bye Luca
... View more
10-25-2017
01:18 AM
Hi Guys, We're experiencing issue with GP app version 4.0.4(10) with Android 7.0. ------------------------------- 1. User inserts credentials 2. Seems logged in 3. Returns to the app home page 4. Promted again with insert credentials ------------------------------- Anyone is experiencing issue with this app version? BR Luca
... View more
10-06-2017
08:37 AM
Hi @Raido_Rattameister, Thank you so much for your reply. Yes, I'm agree with you! I'm investigating.. I'll update you with my findings. Thanks also for the linked articles. BR Luca
... View more
10-05-2017
06:40 AM
Hi guys, Enviroment PA3020 panOS 7.1.11 -- UserID agent 7.0.4 I got issue with UserID that is currently receiving identites from UserID Agent. UserID has already mapped IP address with a specific LDAP user for example "domains.it\test". Sometimes happens that UserID starting to map the same IP address with this user: "nt authority\accesso anonimo (anonymous access)". I believe that UserID Agent takes this user from somewhere..but I checked personally: 1. UserID status -- No issues 2. AD -- I didn't find anywhere " nt authority\accesso anonimo" 3. Other users mapped with UserID agent are working properly I think this is NOT a Palo Alto's issue. Just per confirmation guys, do you have experienced this behavior before? Thoughts/Suggestions? Thanks in advance, BR Luca
... View more
- Tags:
- userid
05-26-2017
07:42 AM
Hi @Raido_Rattameister, Do you think it's possible to apply "zone protection" on DMZ? Or I have to apply this profile on the "OUTSIDE" zone? I have tried to apply it on DMZ, and test it (configured minimum threshold) with a port scan via NMAP.. No threat logs generated. On which zone "zone protection" has to be applied? BR D!Z
... View more
05-25-2017
08:16 AM
Also I'm tryng to configure a strong "Zone protection" profile.. 🙂
... View more
05-25-2017
07:23 AM
Obviously that's a Palo Alto's default behavior .. But when you got an application such as h.245 that has defined as standard port "tcp/dynamic" .. You'll got an issue, because PA's starts to allow first packet (SYN, SACK) in order to identify h.245 application (A LOT OF PACKETS coming in)! That's not great... 😞
... View more
05-25-2017
07:17 AM
Exactly I'm worried about "port scan" because PA in order to identify an Application, allow the first packets to the server (SYN, SACK). So I've seen from traffic a lot of attempt from outside to Videoconference server, allowed by Palo Alto: NOTE** As you can see the reset is coming from server and packet is allowed D!ZZ
... View more
05-25-2017
01:40 AM
I think the only way to proceede is to define a port range with who has configured the Videoconference system and put that range in the NAT bidirectional rule. Do you agree? D!ZZZ
... View more
05-25-2017
01:26 AM
Nope! That's the issue H.245 is a control channel protocol used with[in] H.323 communication sessions, and involves the line transmission of non-telephone signals. Category: collaboration Subcategory: voip-video Technology: client-server Risk: 3 Standard Ports: tcp/dynamic How can I proceed with this protocol?! Should I Enable everything?! Anybody has this issue before? Thx Luca
... View more
05-24-2017
10:58 AM
I have configured static-ip source mapping with bidirectional option flagged! And I have only one public IP!
... View more
05-24-2017
10:53 AM
Hi all I have tried to expose Videoconference system behind Palo Alto. Unfortunately using App ID in security policy I have seen Palo Alto allows a lot of "incomplete" traffic. That's really an issue: When enabling h.323 in security Policy App id engine starts to allows every port in order to find something related to this protocol and obviously you will see in the traffic log incomplete as" session end-reason". Which is the best practice in this kind of situation? Thanks in ⎌advance D!Z
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-10-2018
03:13 PM
|
Likes From
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks