This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About upelister
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About upelister
06-24-2022
38Posts
6Likes
1Solution
Jun 24, 2022Last Visited
User
Activity
User
Profile
Latest posts by upelister
| Subject | Views | Posted |
|---|---|---|
| 3514 | 05-05-2022 07:43 AM | |
| 3551 | 05-05-2022 03:56 AM | |
| 325 | 04-08-2022 12:10 AM | |
| 216 | 03-15-2022 01:32 PM | |
| 392 | 03-15-2022 01:22 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 12-20-2021 04:53 AM | |
| 1 Like | 09-03-2021 10:46 PM | |
| 2 Likes | 06-09-2020 11:26 PM | |
| 1 Like | 05-18-2020 12:13 AM | |
| 1 Like | 05-16-2020 08:51 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes | |||
| 1 Like | |||
| 2 Likes | |||
| 1 Like | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 03-22-2016 01:33 AM |
| Date Last Visited | 06-24-2022 04:40 AM |
| Posts | 38 |
| Total Likes Received | 6 |
05-05-2022
07:43 AM
Do you have any idea why " set deviceconfig setting session resource-limit-behavior bypass" solution is not acceptable to customers?
... View more
05-05-2022
03:56 AM
Hello with 9.1.13-h3 we hit this bug, we are waiting TAC response. Downgrade means SSL loop vulnerability. https://security.paloaltonetworks.com/CVE-2022-0778
... View more
04-08-2022
12:10 AM
Hello, TAC response is; in 10.x OS file blocking works but 9.1 OS allowing download. I do not have 10.x right now so i could not test.
... View more
03-15-2022
01:32 PM
Hello, Option 1; -Use nat on both side and enter routes for nat ip adresses. -I know if both side is Palo Alto you do not need to enter a Proxy id. but I am entering as 0.0.0.0/0 in both side every time (My behaveior 🙂 ) -Option 2; -İf NAT is not an option and devices are directly connect to Firewall you can use PBR only for source and destionation ip addresses and ports. More specific is more accurate. I hope these solutions helps.
... View more
03-15-2022
01:22 PM
1) What determines when traffic gets sent to the second gateway instead of the on-board gateway? -Based on your config on portal. -If you choose auto gateway selection with same weight it uses ssl response time. You can see it on PANGPS log and PANGPA logs. 2) Can the same certificate be used for both gateways? I use certificate based authentication. The server certificate on the existing firewall is gp.acme.com - would this same certificate go onto the new gateway as well? I ask as the two gateways would have different IP addresses. -For gateway config if you have wildcard certificate which is not recommended but somehow it works you can use. -If you have a wildcard certificate which has your two gateway FQDN address as subject alt name it works and recommended you can use. Else, (An idea, I did not try.) İf you create two DNS record for your VPN gateways and portals example; DNS Record1 vpn.acme.com = 1.2.3.4 DNS Record2 vpn.acme.com = 1.2.3.5 Same certificate should be usable. User will connect which response (faster one) they get. You mentioned "I use certificate based authentication. " İt is a authentication mechanism which is not related gatway and portal certificate config. You can use same Autjentication Certificate profile for other gateways. 3) If the virtual PAN/secondary gateway was on the inside of DMZ interface of the hardware PAN, would it be still able to serve as the secondary gateway? İf its behind NAT (Not reccomended because NAT means you are making packets more small so SSL connections may be fail.) After Creating requered rule on Hardware PAN should work. Another Option create sub interfaces on Hardware PAN and serve more than one Portal and Gateway on same firewall (I am running 8 Portal and different gateway on same Hardware PAN). I suggest before taking action Create a test gateway and portal then see results. Have a nice day.
... View more
03-15-2022
01:01 PM
- Check if the related interfaces are up and green on both side. Right Cable should connect to right interface 🙂 - Do you see related interface arp entry in both side Firewall and Router. - Check İF config on Firewall are they belong to same virtual router. -Check for defeault route in virtual router there should be 0.0.0.0/0 to isp router faced interface and ip. -Try to ping internet from firewall, isp interface. -Try to ping internet from firewall mng. interface. -Try to ping router from firewall 192.168.100.1 if to router 192.168.100.2 if. -Check İnterface Config on Firewall ip adress is not a shadow object, create an address object than assing it. -Check interface profile and allow ping. (You must write a rule) -Check interface and Zone seetings related interface is assign to related Zone -Check security policy create one any to any rule enable log start and log end to see whats hitting to firewall -Check NAT Rules. Else You can place firewall as Wirtual Wire mode 🙂 Have a nice day.
... View more
02-03-2022
09:20 PM
Policy structure, Security Policy; Allowed applications; dnf,ssl,web-browsing,yum Allowed services, tcp 443 tcp 80 Allowed URL categories in security Rule URL Category Match Field Computer-internet-info web-hosting Profile; IPS, Antispyware,URL, File Blocking Profiles are set Decrytipn Policy; All trafic are decrypted.
... View more
02-03-2022
01:10 PM
Traffic identified as web-browsing. I think Somehow axel acting like browsing file. Thank you for reply.
... View more
02-03-2022
11:51 AM
Hello, I created a file download profile which allows only download rpm,bzip2,gzip and blocked rest. When I use wget iso file download blocked. When I use "axel" iso file download not blocked. What is the difference and how can I completely restrict download. Thanks. "Axel , a Command-Line Download Accelerator for Linux" Tested on PanOS-9.1 Used Centos, İssued commands, wget --no-check-certificate target=_blankhttps://releases.ubuntu.com/20.04.3/ubuntu-20.04.3-desktop-amd64.iso axel --alternate target=_blankhttps://releases.ubuntu.com/20.04.3/ubuntu-20.04.3-desktop-amd64.iso
... View more
- Tags:
- file download
12-20-2021
04:53 AM
1 Kudo
Hello re-importing works but what happens here, why client does not have private key. Any idea?
... View more
09-21-2021
01:09 AM
Hello, Have you tried enforce symetric return option from pbf policy Forwarding section. *Another idea, assign nat ip to a loopback interface than use it for nat.
... View more
09-03-2021
10:46 PM
1 Kudo
Hello, - İs tunnel up? (P1 and P2) -what kind of vpn messages in logs? -CP is Policy based routing type but Palo Alto is Route Based (Without PBR); PA Side; --Palo Alto NAT ip pool range should be in Palo Alto VPN Config>Proxy id as local. --CP NAT ip pool range should be in Palo Alto VPN Config>Proxy id as remote. --CP NAT ip pool range should be in Palo Alto Virtual router>Static Routes, for destination interface related tunnel interface next hop should be CP if ip. info: ---you do not need to assign ip address to tunnel interfaces every time. --- For my enviroment, i am using NAT in many vpn tunnels because adding an ip address to CP encryption domain sometimes fails tunnel. (couses Proxy-id mismatch error) İ mean stright foward s2s tunnel config but both firewall need to know only NAT ip addresses instead of actual ip addresses. Bu setting up with CP another challlange wish you luck. İf tunnel is working 100% than go to policy tab; Create Security Rule. Create destination NAT rule. İf you are new i suggest start with basics and get familiar with log messages. I hope this helps and have a nice day.
... View more
01-31-2021
03:35 PM
Hello, Maybe attackers identifed a vulnerability on your services in past and trying to access your servers. To be on the safe side checking servers, applications against any kind of vulnerability specially this one should be fine. I recommend; If applications are not required to acces from open world, limiting allowed traffic for specific Geo Locations greatly reduce attack surface and attack possibilites. Applying zone protection profiles can reduce scanning risks. Using, Vulnerability Protection, Spyware and Anti-Virus profile in strict state for the rules. Within great care all vulnerability protection signatures can be enabled. Also auto tagging feature can be used to block all or block for a period of time. attacker ip addreses. Vulnerability Protection> Vulnerability protection profile> Vulnerability Protection Rule> Action> Block-ip as source and how much time (Max is 1hr) this will block source ip address for one hour in hardware level With using DAG feature you can block attacker for a long time. I rec
... View more
01-31-2021
03:11 PM
Hello, I think For the syn-scan (with no Threat prevention profile) or telnet you can discover open ports, in traffic logs it should be appear as "incomplete". In session logs also it should be on "discard" state. **Against scanning zone-protection profiles has good prevetion options.
... View more
01-31-2021
02:58 PM
Hello, Checking server security logs can be helpful. To investigate further enabling extended packet capture on ip profile may be helpful. *Sometimes also i am seeing this event on logs and considering it as false positive.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-24-2022
04:40 AM
|
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks