About TheRealDiz

TheRealDiz · ‎04-10-2018

Hi @BPry, That’s right haha! It doesn’t matter actually it was only for test purposes 🙂 (I’ll keep that in mind)

TheRealDiz · ‎04-10-2018

Hi @Raido, I know I've seen what you described, infact starting from this mechanism (NIC0 = mgmt NIC1= eth1 etc. ...) my question is if it's possible to disable mgmt interface when is not needed. But no problem guys at the end I have basically assigned to mgmt a non-used IP 2.2.2.2 and I have finalized my configuration on eth1 🙂 Thanks for your reply! Luca

TheRealDiz · ‎04-10-2018

Hi @BPry, Thank you for your reply! Sorry for the wait I was very busy during these week. Via GUI there was no way to disable mgmt interface but via CLI was possible to issue command mentioned in my post. It has caused some strange issues with DNS, PA-VM sometimes was able to solve domains and sometimes not. That's why I'm asking if there is a way to disable mgmt interface or leaves it without IP when is not needed. BR Luca

TheRealDiz · ‎03-23-2018

Hi Guys, I got a simple question for you: Is it possible to literally disable/shutdown mgmt interface, via CLI or webUI, in a VM enviroment when is not needed? I notice a DNS issue after we have deleted the IP address assigned to the MGMT interface via cli with command: "delete deviceconfig system ip-address" Obviously we have made PA reachable from another interface ethernet1/1, configuring every "service route configuration" on this specific ethernet1/1. Unfortunately DNS queries were not working properly even if service route configuration was set on ethernet1/1. I configured fake IP address on MGMT interface.. and guess what happened? DNS queries start working properly. From my point of view this kind of command "delete deviceconfig system ip-address" should be banned haha 🙂 In order to avoid future issues, is there a way to clean the entire mgmt configuration or literally shut down it? Bye Luca

TheRealDiz · ‎10-25-2017

Hi Guys, We're experiencing issue with GP app version 4.0.4(10) with Android 7.0. ------------------------------- 1. User inserts credentials 2. Seems logged in 3. Returns to the app home page 4. Promted again with insert credentials ------------------------------- Anyone is experiencing issue with this app version? BR Luca

TheRealDiz · ‎10-06-2017

Hi @Raido, Thank you so much for your reply. Yes, I'm agree with you! I'm investigating.. I'll update you with my findings. Thanks also for the linked articles. BR Luca

TheRealDiz · ‎10-05-2017

Hi guys, Enviroment PA3020 panOS 7.1.11 -- UserID agent 7.0.4 I got issue with UserID that is currently receiving identites from UserID Agent. UserID has already mapped IP address with a specific LDAP user for example "domains.it\test". Sometimes happens that UserID starting to map the same IP address with this user: "nt authority\accesso anonimo (anonymous access)". I believe that UserID Agent takes this user from somewhere..but I checked personally: 1. UserID status -- No issues 2. AD -- I didn't find anywhere " nt authority\accesso anonimo" 3. Other users mapped with UserID agent are working properly I think this is NOT a Palo Alto's issue. Just per confirmation guys, do you have experienced this behavior before? Thoughts/Suggestions? Thanks in advance, BR Luca

TheRealDiz · ‎05-26-2017

Hi @Raido, Do you think it's possible to apply "zone protection" on DMZ? Or I have to apply this profile on the "OUTSIDE" zone? I have tried to apply it on DMZ, and test it (configured minimum threshold) with a port scan via NMAP.. No threat logs generated. On which zone "zone protection" has to be applied? BR D!Z

TheRealDiz · ‎05-25-2017

Also I'm tryng to configure a strong "Zone protection" profile.. 🙂

TheRealDiz · ‎05-25-2017

Obviously that's a Palo Alto's default behavior .. But when you got an application such as h.245 that has defined as standard port "tcp/dynamic" .. You'll got an issue, because PA's starts to allow first packet (SYN, SACK) in order to identify h.245 application (A LOT OF PACKETS coming in)! That's not great... 😞

TheRealDiz · ‎05-25-2017

Exactly I'm worried about "port scan" because PA in order to identify an Application, allow the first packets to the server (SYN, SACK). So I've seen from traffic a lot of attempt from outside to Videoconference server, allowed by Palo Alto: NOTE** As you can see the reset is coming from server and packet is allowed D!ZZ

TheRealDiz · ‎05-25-2017

I think the only way to proceede is to define a port range with who has configured the Videoconference system and put that range in the NAT bidirectional rule. Do you agree? D!ZZZ

TheRealDiz · ‎05-25-2017

Nope! That's the issue H.245 is a control channel protocol used with[in] H.323 communication sessions, and involves the line transmission of non-telephone signals. Category: collaboration Subcategory: voip-video Technology: client-server Risk: 3 Standard Ports: tcp/dynamic How can I proceed with this protocol?! Should I Enable everything?! Anybody has this issue before? Thx Luca

TheRealDiz · ‎05-24-2017

I have configured static-ip source mapping with bidirectional option flagged! And I have only one public IP!

TheRealDiz · ‎05-24-2017

Hi all I have tried to expose Videoconference system behind Palo Alto. Unfortunately using App ID in security policy I have seen Palo Alto allows a lot of "incomplete" traffic. That's really an issue: When enabling h.323 in security Policy App id engine starts to allows every port in order to find something related to this protocol and obviously you will see in the traffic log incomplete as" session end-reason". Which is the best practice in this kind of situation? Thanks in ⎌advance D!Z

TheRealDiz · ‎03-23-2017

Hi All, That's not an issue.. I just want to share with you this thought Starting from the fact that the egress interface is NOT a matching criteria.. But I have to configure around 80 VPN tunnel (with their own backup tunnel using pbf option "disable if unreachable") .. so it means I will have 80 warnings.. :,( It should be useful to put egress interface in PBF policies as a matching criteria? What is it your opinion? Regards D!Z

TheRealDiz · ‎03-21-2017

Exactly @TranceforLife, As tranceforlife told you.. When you ping via CLI from a PA firewall you have to type "ping source <ip related to the interface> host <ip dst>" . If you don't put the keyword "source" you will start ping (by default) from the management interface! BR D!Z

TheRealDiz · ‎03-17-2017

Further @reaper I got your point: https://live.paloaltonetworks.com/t5/Configuration-Articles/Security-Policies-Based-on-Zone-Assignment-for-VPN-Tunnel/ta-p/54385 😄

TheRealDiz · ‎03-17-2017

Thx all of you for the explanation @reaper @BPry @TranceforLife @santonic. I know that is a route based (zone based) firewall but everytime I have configured proxy ids, I suppose (wrongly) PA would do something implicitly that denies traffic which is not included in the proxy ids defined. I suppose that was a "complete integration" with a VPN policy based firewall. " The proxy ID's are implemented (ONLY) for compatibility with policy based vpn peers" --> Is there something explicitly written inside documentation? Or just starting from the fact that is route based, PA doesn't take care about "proxy ids"? Many many thanks again to all of you 🙂 D!Z

TheRealDiz · ‎03-16-2017

On the other end probably Fortinet. If it's like you both told me @TranceforLife @santonic, I'm a little bit disappointed. I don't care about Checkpoint, Fortinet etc. Also I don't care about routing: You have to configure a specific "tunnel interface". So each VPN tunnel as a dedicated "tunnel interface" and a dedicated route. On my side it's a simple a concept: Define encryption domain between two firewalls = define IPsec security association for specific networks You told me that: Define encryption domain between two firewalls = define IPsec proxy ids. Then if there is a route for a network which is NOT included in the proxy id defined, and obviuosly a security policy that allows the traffic flow.. Well go everywhere you want Sorry but from the bottom of my experience.. I'm like 😮

TheRealDiz · ‎03-16-2017

Assuming this ... How can make sense to configure proxy id?! So IPsec SA generated for specific network allows everything you want? Well done...

TheRealDiz · ‎03-16-2017

Hi All, First of all enviroment's specific: panOS 7.1.7 PA 3050 The "strange behavior description": 1. VPN S2S between PA and third party vendor 2. Usual configuration 3. Proxy id: VTI: Tunnel.103 Local: 10.48.0.0/13 Remote: 10.64.22.176/28 4. Strange behavior --> Remote network 10.64.22.176/28 is able to reach 10.64.29.0/24 that is NOT defined as our local proxy id **Note: 10.64.29.0/24 is a network that is related with ANOTHER IPsec tunnel behind tunnel.65 How this is possible? I never seen a similar behavior before. I miss something or do you agree that is NOT a normal behavior? Thanks in advance, Luca

TheRealDiz · ‎02-22-2017

Hi All, Many many thanks to all for your answers. I will check everything you gave me, really appreciated. Also if it's helpful, PA TAC confirms and suggests to install panOS 7.1.7. Best Regards Luca

TheRealDiz · ‎02-21-2017

Hi All, I'm currently checking documentation and release notes etc about 7.1.X. I have to learn how can I understand if a version is really stable/reliable? Obviously testing and working on it it's a good way to learning about a specific release.. I know it's sounds like a stupid question but in my opinion is not. Besides my first question, the main question is: Which is the most reliable panOS version out right now? Thanks in advance, BR Luca

TheRealDiz · ‎01-31-2017

Hi @reaper, Thanks a lot.. that's my fault I know 😞 Also thank you for the article :)! BR Luca

TheRealDiz · ‎01-30-2017

Fixed ... There is URL category filtered! When you approach logs and rules you cannot see clearly that there is an URL category applied. By default the column is hidden ... 😞 BR Luca

TheRealDiz · ‎01-30-2017

Hi All, I have PA 2050 with panOS version --> 7.0.9 I have two rules: Rule 4 --> Permit for svc-casse application as (ssl, ms-updated ecc) Rule 5 --> Cleanup for svc-casse That's the situation check : RULES LOG Really really strange behavior I never seen this before. Rule 4 permit ssl and ms-update but it's ignored.. Another crazy thing? Sometimes ssl is "Allow". SSL ALLOWED WITHOUT CHANGES I cannot understand this behavior maybe... I'm missing something stupid? Suggestions? Have you ever seen this issue before?! Best Regards Luca

TheRealDiz · ‎01-30-2017

Hi All, I have PA 2050 with panOS version --> 7.0.9 I have two rules: Rule 4 --> Permit for svc-casse application as (ssl, ms-updated ecc) Rule 5 --> Cleanup for svc-casse That's the situation check : RULES LOG Really really strange behavior I never seen this before. Rule 4 permit ssl and ms-update but it's ignored.. Another crazy thing? Sometimes ssl is "Allow". SSL ALLOWED WITHOUT CHANGES I cannot understand this behavior maybe... I'm missing something stupid? Suggestions? Have you ever seen this issue before?! Best Regards Luca

TheRealDiz · ‎01-13-2017

Many Many thanks, Infact I didn't find anything related to this argument inside Wildfire's documentation. Have nice day! 🙂

TheRealDiz · ‎01-13-2017

Hi @reaper, You are always on point, thanks a lot for your quick response. So in conclusion, is this mechanism not configurable? Thanks again Luca

Date Registered	‎01-18-2016 06:21 AM
Date Last Visited	‎04-10-2018 03:13 PM
Total Messages Posted	96
Total Likes Received	11

Online Status	Offline
Date Last Visited	‎04-10-2018 03:13 PM

Strata

Prisma

Cortex

About TheRealDiz