About jsalmans

jsalmans · ‎04-17-2020

Anyone know what's up with the release notes links in PAN-OS or Panorama GUI? Some of them are taking me to an XML response page and there is apparently an email circulating on REN-ISAC that the GlobalProtect links for 5.1.2 download a *.solitairetheme8 file (I can confirm that I'm seeing this behavior in the release notes link in Panorama this morning. Thanks

jsalmans · ‎03-02-2020

Greetings all, This morning I moved our GlobalProtect from a 4.0.x release to 5.0.7. We're planning on a maintenance tonight to upgrade our firewalls to 9.0.6 and I noticed that there is a minimum supported GlobalProtect version of 4.1 for the 9.0 platform. If I upgrade the firewalls tonight and there are users who still have the older 4.0.x GlobalProtect version installed (i.e. they haven't updated yet) will they still be able to sign in to the client and be prompted to upgrade? Or will the 9.0.6 firewall prevent them from connecting and essentially force them to go download the updated client from the VPN portal? I don't have any HIP checks configured currently to check for a minimum version and the client is currently configured to prompt for an update. Thanks!

jsalmans · ‎10-31-2019

@aceandy79I would be curious what your results are. I have a test unit at home and while I can't really set it up as true static NAT since I get a dynamic IP from my service provider, it is still only one IP it is using. I still see strict NAT on my home gaming devices. Granted, it's entirely possible their port algorithms are set up differently for a true static IP configuration vs a Dynamic IP even though you're only ever getting the same IP. I'd also encourage any Higher Ed or other entity supporting multiplayer gaming to contact your Palo Alto sales team and look into supporting Feature Request 7654. I put this in about 2 years ago asking for some DIPP NAT option to implement something like "sticky NAT" and/or to implement something closer to Cisco's ASA implementation for Port Address Translation (PAT). I was told by our sales team that these Feature Requests gain priority based on the number of customers that express the need for the specific feature. There may be a better option than the one outlined in that specific FR but, one way or the other, I feel like we as a community can get together and express interest in something to get this fixed that doesn't involve using another vendor's product for gaming networks.

jsalmans · ‎09-10-2019

As per usual, the most interesting part of my job always seems to come back to our on-campus students and their BYOD devices. We've had some reports that Rainbow Six Siege is still having multiplayer issues despite most of those consoles/PCs being assigned public IP addresses (so no NAT required). This doesn't surprise me too much since it is an Ubisoft game and I hear lots of bad things about their network stack.. plus I think a number of their games are designed around peer-to-peer once their servers handle the matchmaking part. Now, NAT Type (essentially the indicator most of these games or consoles provide to the end user about their connectivity) apparently isn't actually just about NAT, it's also about ports. Most of these game publishers have FAQs about what ports to open to the entire Internet. I suspect Rainbow Six gameplay would benefit from opening some ports, especially if it actually is peer-to-peer. We've also had some requests to open up ports that are for a number of Blizzard games and associated voice chat. I'm curious what other people with Palo may be doing in situations like this. I was considering if I could get custom applications made for these I could probably allow incoming connectivity so long as it matched one of the application types. Opening up just ports seems like such a bad idea without knowing a source IP (which seems about impossible unless someone knows of some Minemeld miners for game servers) even to BYOD networks since we don't allow them to run their own routers/firewalls.

jsalmans · ‎08-14-2019

@MickBall wrote: Just a thought... would the entire operation be smoother if you just forwarded all DNS requests to your internal boxes via NAT policies...? Possibly and it is certainly something to consider. I'm not sure how many of these devices are using anything like DNSSEC. The worst part would be that I'd probably have to do a hairpin NAT since the servers reside on the same area of the network as the users I want to do this for so I'd have to adjust both source and destination IPs. Another alternative might be to spoof the IP addresses on the DNS servers themselves so that they respond to queries to 8.8.8.8 and 8.8.4.4 but I'm not sure if that is considered bad practice.

jsalmans · ‎08-13-2019

Greetings all, I'm toning down some of our NAC enforcement in favor of trying to find other ways to secure the network (lots of users on BYOD don't like to install a 3rd party client to monitor their device). One of the things we were doing was to check for proper DNS settings. We block external DNS in favor of using several sets of internal servers so that our BYOD users still have access to internal services that aren't available on the public Internet. We're also interested in possibly using a DNS security service at some point so keeping DNS queries internal seems like a good policy still. I had originally thought to catch the DNS queries on the way out the firewall and then somehow provide a notification to the user that they need to set their DNS settings to Obtain Automatically from DHCP. I thougth I had figured out how to do this at some point but, for the life of me, I can't remember what I was going to do. Blocking, obviously, is no problem but is there any way to provide from the firewall to provide a notice to the end user without them running GlobalProtect or something? For an application block like Facebook, the browser is open and intigating the app usage but DNS happens a lot behind the scenes and I wasn't sure if there was a way to display the notification. Thanks!

jsalmans · ‎04-02-2019

Hi all, I'm curious what others may recommend for connecting internal networks that are also untrusted. We've got a teaching department that will probably end up running their own DHCP and DNS services, in addition to a cybersecurity program (clean lab only.. dirty lab should always be isolated). We've previously had issues with students in these classes not following instructions and running rogue DHCP servers on bridged connections or doing ARP/Penetration scans without limiting the target ranges. My thought was to directly connect their switch with our A/S 5250 firewalls. Currently they're on a VLAN that flows through some of the building switches but I even want to remove that... even layer 2 some of those things they've done in the past has caused connectivity issues for users on other VLANs if the network hardware is in common. I would think the firewalls we have should be able to handle pretty much anything these folks could thow at them but of course I recognize internal traffic and attacks (malicious or not) can be very different than what the Internet can throw at you. Of course I don't want it to affect production, and we do pipe internal traffic through it as a central means of controlling access and security. I'm curious what others may have done or recommend and if there are any specific areas of the config I should look at (flood control caught my eye for example). Thanks!

jsalmans · ‎02-13-2019

@BPryhow does one get signed up for the beta? I was in the beta for 4.0 or maybe one of the later 3.x versions but I think it was only for that version... I haven't seen beta community forums or emails for a long while.

jsalmans · ‎02-13-2019

I just checked the patch notes. We're running 4.0.x currently and the visaul improvement came in 4.1: " GlobalProtect app 4.1 for Windows and macOS endpoints introduces an enhanced user experience through a more modern and streamlined user interface and a more intuitive connection process. The new app features simplified workflows that enable end users to view and modify GlobalProtect app settings, manage notifications from a central location, and connect to or disconnect from GlobalProtect more seamlessly. "

jsalmans · ‎02-13-2019

So an update.. it was determined the server and client are trying to use X25519 which is an ECDHE curve that Palo Alto doesn't support (definitely would be nice to see this as a note on the supported ciphers page... TLSv1.3 uses it as a standard and I know that isn't supported yet but TLSv1.2 uses it as well). The workaround is to disable ECDHE but that doesn't seem like a great call given that we're talking about lowering server security to apply SSL Decryption for additional server security. I found this for Windows Server 2016 and it seems to work: https://www.nsgp.net/2018/09/how-to-disable-curve25519-x25519-key-exchange-on-windows-server-2016/ I'm looking for similar instructions for Apache and Tomcat. I'm not a server expert and I'm having trouble finding methods to do this on those platforms.

jsalmans · ‎02-12-2019

Wow our 5250s can do 30,000 tunnels. Do we know what the GRE througput performance looks like? I know IPSec and GlobalProtect SSL tunnels have limited max bandwitdh but I've always heard GRE has the potential to be closer to standard network speeds. That's kind of disappointing on the Unique Policy ID but the audit history is still really cool. *edit* I just downloaded GP 5.0 64-bit for Windows. It's a completely different interface than the 4.x client! Definitely will play around with it. Can't wait for the Android version.

jsalmans · ‎02-12-2019

I got pretty excited while reading the release notes today and I'm installing 9.0 on my lab PAN-220 this evening to give it a spin. Things that jumped out at me Security policy optimization is going to help out big time. Expedition seems powerful but it also is a bit overwhelming when you're just trying to use it for security policy migration to app-based rules. I'm sure I'll still use the best practices analyzer though. App-default rules applying correctly to decrypted traffic including web-browsing... yay! GRE tunnel support... A previous coworker had a thought about redoing our campus design to incorporate newer methods of network segmentation. GRE tunnels were an interesting method since it means the core and access layer can be pretty much whatever you need it to be as long as each building has a GRE capable Layer 3 device that can tunnel to the firewall. Traffic simulator for security rules.... one of the only things I miss from the ASA. DNS security WinRM for UserID Multiple categories for URL filtering is definitely cool and could allow more granual control Cisco SGT Things I have questions about Any plans for a GlobalProtect update for other platforms besides iOS? I've seen it on my coworkers phones and it looks waayyyy better than my Android version or even the desktop versions. Will the Universal Unique IDs for Pocily Rules allow more than one rule with the same name? I ended up copying rules from our own old device group into our new one and, of course, am having to deal with rules with "-1" at the end due to the existing code using the rule name as the unique ID. I can also see this being handy for pointing a rule out to someone... rules being moved around or renamed makes them hard to refer to others sometimes. GRE Tunnels.. how many can each hardware platform support? Seems like I had some other questions but they aren't coming to mind at the moment.

jsalmans · ‎02-05-2019

@gwessonnot sure how I missed that with the Intermediary cert but thanks! I had it uploaded for on Panorama but not in the Device Group that pushed to the firewall... I added it and it immediately changed the Wildcard to be a sub-cert. I did another scan and it hows correct now. I'm opening a TAC case for the SSL decryption issue and I'll reply again when I have a solution in case someone else runs into this as well.

jsalmans · ‎02-05-2019

I found the SSL Labs IP range. Some of the traffic does appear to be decrypted while some of it hits a decrypt-error. I also see "This server's certificate chain is incomplete. Grade capped to B. " Here is the current decryption profile for reference

jsalmans · ‎02-05-2019

@gwesson Here is my session output: Session 35433597 c2s flow: source: desktop IP [CampusCore] dst: server IP proto: 6 sport: 64022 dport: 443 state: DISCARD type: FLOW src user: jsalmans dst user: unknown offload: Yes ecmp id: 8001 s2c flow: source: server IP [DataCenter] dst: desktop IP proto: 6 sport: 443 dport: 64022 state: DISCARD type: FLOW src user: unknown dst user: jsalmans offload: Yes Slot : 1 DP : 1 index(local): : 1879165 start time : Tue Feb 5 12:03:56 2019 timeout : 90 sec time to live : 28 sec total byte count(c2s) : 1797 total byte count(s2c) : 5445 layer7 packet count(c2s) : 20 layer7 packet count(s2c) : 7 vsys : vsys1 application : ssl rule : Allow Dept Anywhere service timeout override(index) : False session to be logged at end : True session in session ager : True session updated by HA peer : False layer7 processing : enabled URL filtering enabled : True URL category : educational-institutions session via syn-cookies : False session terminated on host : False session traverses tunnel : False captive portal session : False ingress interface : ae1.10 egress interface : ae1.4001 session QoS rule : N/A (class 4) tracker stage firewall : proxy decrypt failure end-reason : decrypt-error

jsalmans · ‎02-05-2019

@gwesson I only have decryption enabled between my client and the server right now. The scan from SSL Labs would have not gone through any decryption process on the firewall. I wasn't sure if the scan would work since my browsers don't seem to get very far into the process when it is enabled and I didn't want to break anything for Internet traffic hitting the server. I'll see if I can find an IP range they use so I can enable it just for that traffic.

jsalmans · ‎02-05-2019

@LukeBullimore We went ahead and did a packet capture on the server. I'm not seeing any communication between it and the firewall. I see the following, all between my desktop and the server: Initial SYN from my desktop ACK from server Client Hello on TLSv1.2 from my desktop Server Hello, Certificate, Certificate Status, Server Key Exchange, Server Hello Done from server RST, ACK from my desktop ACK from my desktop ACK from my desktop TCP Retransmission from my desktop ACK from server RST, ACK from desktop RST, ACK from server

jsalmans · ‎02-04-2019

Thanks for the reply. I believe I've done that. I've tried this as Max and also setting TLS 1.2 as the max. As far as I know, Firefox and Chrome are both using whatever the defaults are. If I turn off decryption, I can see it negotiating successfully with the server wiht an ECDHS cipher. Here is what the packet capture is seeing my client offer. Here is the SSL Labs results for TLS 1.2:

jsalmans · ‎02-04-2019

Greetings all, I feel like I'm probably missing something simple here, but I'm running into a decrypt-error issue on 8.1.3 in regards to a server that is negotiating DHE or ECDHE ciphers with the client. On Chrome I get: ERR_SSL_VERSION_OR_CIPHER_MISMATCH And on Firefox I get: SSL_ERROR_NO_CYPHER_OVERLAP If I turn off decryption for this or set it to RSA only, the traffic goes through (albeit not decrypted) so the client and server do indeed have shared ciphers they can negotiate to. A packet capture from my machine and an SSL Labs scan of the server seems to back this up. I know DHE and ECDHE wasn't supported on Inbound Decryption before but the warning is no longer on the configuration GUI and I see newer documentation that it has been supported since an 8.0 version. Any ideas on what I might be doing wrong or how I should proceed with troubleshooting?

jsalmans · ‎01-09-2019

@dstjamesthanks for the reply. That is actually what I ended up trying and it seems to work. Panorama actually has no config information for those fields and they're just defined locally on the firewalls. Since they won't sync even after config sync is re-enabled, they should remain unique on each. I'm really curious why the instructions are worded like that... it doesn't make it clear if they're talking about management IP/hostname config in the Panorama templtate or the settings on the local configs on the firewalls.

jsalmans · ‎01-09-2019

I'm in the process of setting up our new firewalls. I went ahead and set up management on each of them, got them updated, got them paired up into Active/Passive, and am now following the Palo Alto 8.1 guide to migrate an HA config over to Panorama. I'm almost to the end but I have a question concerning the templates. The instructions say to delete the template for the secondary and then add the secondary into the template for the primary, but it also says: "Do not combine the HA firewall pair in to a single template if a unique Hostname, management IP address, or HA configuration is configured for each HA peer." I find this a little confusing since everything I've read indicates that each unit in the A/P pair still has to have unique management IP, hostname, etc. The guide I'm following is here: https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management Can anyone clue me in on what best practices is here? My intention was to have a single config with A/P so I don't have to duplicate VPN changes on a second template. The instructions say to turn config sync back on at the end too so it sounds like it is supposed to use a single template but then wouldn't that mean the passive firewall would be unreachable on its management port, even to Panorama? Thanks!

jsalmans · ‎01-09-2019

In case anyone has this question again in the future, after seeing some responses on other sites it looked to me that the firewall would accept passive cable and even ones set up for other vendors. I ordered a few QSFP+ direct attach passive cables that show compatibility for Cisco from Amazon and it seems to work fine so far in the lab.

jsalmans · ‎01-03-2019

Greetings all, I should be getting our new 5250 firewalls in any day now and I'm trying to get my cable shopping list together so we can start working on our install process. I noticed the HSCI port for the A/S config uses a 40/100 port and, giving the units will be close together, I was thinking I'd like to get a twinax style cable instead of individual optics/fiber. I noticed the Front Panel Description for the 5200 series recommends using Active Optical Cables but these are a lot more expensive than similar passive options. Is the port compatible with passive style cables or does it require active? Thanks!

jsalmans · ‎12-10-2018

@OtakarKlier thanks for the reply. I believe that still burns some exrtra IP addresses... not a big deal on privates but some of these networks may end up on publics. I did see another way to do something like that... OVH has an article on how to configure hosts on their network using network bridging. It looks like they have you assign /32 addresses to each host and the gateway exists outside of that subnet so you have to create a static route for it. I wasn't crazy about that solution because it requires extra config on the hosts. I also found this but I'm not clear from the replies if someone got it to work or not: https://live.paloaltonetworks.com/t5/General-Topics/Has-anyone-had-success-using-Cisco-Systems-Private-VLANs-and/m-p/30641#M22429 If PVLAN won't work directly on the firewall, my fallback option is to put the SVIs on our Nexus9K and then use policy-based routing to push the traffic the rest of the way to the firewall. It's an extra hop but the Cisco equipment can handle the traffic isolation and push the traffic to the firewall when it receives it.

jsalmans · ‎12-09-2018

@BPry VRFs are possible and may be an option but I would imagine I'd need to create one per server for true DC host isolation. PVLANs seem much easier to scale since it seems to mostly be a one-and-done configuration on the Layer 2 side.

jsalmans · ‎12-08-2018

Is there way to target a PAN hardware platform in an Expedition project before importing the actual hardware? We may be getting the new hardware in January but may also have a very short window to setup and install. I had hoped maybe to use Expedition in the meantime to import our current config and then tell it what hardware models I'd be deploying to so I can start designing and building the config early. Thanks!

jsalmans · ‎12-08-2018

I'm looking at doing some re-design for our DC networks and wanted to investigate some further segmentation. Since we aren't really large enough for NSX or ACI I wanted to look at PVLAN. I've got some Nexus9K switches with Layer 3 licensing in HA and had originally thought to use them as the gateway for the DC networks. Now though I'm wondering if it wouldn't be just as easy to keep them strictly as Layer 2 and use the Palo Alto A/S HA as the Layer 3 gateway. What I'm not sure on is whether I can do this with a PVLAN configuration? My research on the Cisco whitepaper for PVLAN indicates the container VLAN and all of the isolated/community/etc VLANs have to be tagged to the device with the PVLAN gateway. If that is the case, how to I tell my PAN boxes to treat those as PVLAN and not require an interface or subinterface with IP for anything but the container VLAN? Thanks!

jsalmans · ‎11-28-2018

I have some questions on the Active/Standby deployment model. Right now I'm on A/A which requires all network config between the two units to be different since they're both active at the same time. From looking at the documentation, it looks like in an A/S model the network config between the two units is identical which includes all of the same IP addresses on subinterfaces, virtual routers, etc. Is this correct? If so, does the standby simply keep its interfaces shut while not active? During a failover scenario, does the switchover happen fast enough that dynamic routing protocols to not notice and therefore not require reconvergence? I'm aslo wondering if anyone uses their firewalls for the L3 network gateways for any of their VLANs? I was considering setting up subinterfaces and maybe using them for our DC networks so that the firewall could more directly dictate for each server what it can and not have access to without doing ACLs on a Cisco switch or router. Alternatively, I'd probably use Policy Based Routing to push the traffic from the network's gateway to the firewall.

jsalmans · ‎11-22-2018

@vsys_remo any idea why it would be missing data after migrating to a stack? It seems like if that information was required it would have been in the original template or else I wouldn't have been able to commit.

jsalmans · ‎11-21-2018

Hi all, I upgraded from an 8.0 release to 8.1.3 to prepare for a migration to some new hardware. I did a commit after the upgrade to make sure everything was synced up between Panorama and the firewalls and I believe everything went ok. I was making some adjustments at the recommendation of the Best Practices analyzer in Expedition and noticed it failed to commit due to something in a Template Stack. This confused me a bit since I gave up on Template Stacks over a year ago when I first tried them due to not being able to reference values in a template lower in the stack (common values but they had to be referenced in non-common config areas). I looked again tonight and it appears Panorama created two "_mig" template-stack configs, migrated from each of my two device configs, and moved the devices over to use those. Was this expected behavoir that I missed in the notes somewhere? If so, is there any issues with moving each firewall back to its original device config and deleting the migrated template-stacks or should we be using template-stacks moving forward? Thanks! *edit* Looking at this a little further, it appears the new template-stacks it created are actually each referencing their corresponding original template files. The Commit and Push failed due to a missing "device-id" in the HA configuration.

Date Registered	‎02-23-2016 07:18 AM
Date Last Visited	‎04-20-2020 01:11 PM
Total Messages Posted	165
Total Likes Received	30

Online Status	Offline
Date Last Visited	‎04-20-2020 01:11 PM

Strata

Prisma

Cortex

About jsalmans