About jeff6strings

I'm testing (starting) my ethical hack skills and testing our GlobalProtect Gateways for vulnerabilities.   I used the Windows ike-probe and Kali Linux ike-scan against a Cisco gateway with VPN services running. The ike-scan results are what I expected in receiving a response or acknowledgment of 1 returned handshake with the available ciphers. The ike-probe results were expected as well, with recv_notify on most ciphers.   I ran the same scans against a Palo Alto GlobalProtect Gateway with Portal and Gateway configured. This Gateway is working with GlobalProtect clients in IPSec mode and default settings. The ike-scan and ike-probe results are negative as compared to the Cisco gateway.   Is the Palo Alto Gateway more secure? Am I missing a command option with both scans? Appreciate any help.   Jeff ... View more

Our GlobalProtect firewalls are running version 8.1.15 and another 9.1.4. We allow Split Tunnel, and one firewall has a 0.0.0.0/0 Include Access Route, and the other does not.  Both don’t have any Excluded routes. The one firewall (9.1.4) does have a Domain and Application Entry, Excluding *.webex.com and webex.com domain for testing this feature.   Both firewalls, the GP App Config settings are: Split-Tunnel Option: Network Traffic Only and Resolve All FQDNs using DNS servers Assigned by the Tunnel: Yes; both are default and have not changed. About six months ago, we upgraded our GP clients from version 2.0.2 or 4.0.x to 5.0.8, and most are now on 5.2.3. We’ve noticed some DNS issues with some specific situations since the upgrade from 2.0.2 or 4.0.x.   Problem 1: We have a handful of users who use GP to VPN to our network and, when needed, connect to an outside vendor’s VPN (Anyconnect) to access data at the vendor while still on our VPN (due to a vendor whitelist). When they connect to the vendor, the users cannot access their server or ours. Testing one user, we notice we can ping our internal DNS server or others, but DNS requests are not working. Using Wireshark and capturing the local, GP, and AnyConnect interfaces and filtering on port 53, there is no DNS traffic at all. At the command prompt using nslookup and using multiple DNS servers, there is no port 53 traffic. Also, checking the firewall, there is no port 53 traffic during this time. Both our VPN and the vendor have Split-tunneling allowed.   Problem 2: On the GP gateway with the Domain Exclusion of webex.com, when a test user connects, they can access other sites, but webex.com won’t load. Using Wireshark and capturing the GP and local interfaces, I see reply DNS traffic from our internal DNS server to the user, but I don’t see the request from the user to the DNS server. Also, I see traffic for webex.com but trying to use both the GP and local interfaces. We did upgrade the GP client to version 5.2.6.   Were there significant DNS behavior changes from our previous GP versions of 2.0.2 or 4.0.x to 5.0.8, which may account for the strange issues we are experiencing? Thank you for any help. Jeff ... View more

I'm having issues with my garage door opener thru my PA 220 FW, v9.1.6, with the latest dynamic updates. It uses DNS and TCP 8883 to communicate to the MyQ servers. In Monitor>Logs>Traffic, I can see DNS traffic from the opener to 8.8.8.8 with return bytes, but no other traffic. In Session Browser, I see the 8883 traffic but hitting the Interzone Default policy. This is strange as other devices are on the same network/zone and working fine. In a packet capture of traffic from the opener, I see the 8883 traffic in the receive, transmit and drop stages.   At the time of this post, I'm still troubleshooting connectivity but maybe Security Policies just for the opener and specifying DNS and 8883 in their own policies may have helped.   I'm curious why I can see traffic in the Logs>Traffic for all other devices and only DNS for the opener but not the 8883 traffic? Thanks for any input.   Jeff   ... View more

We have a Security Policy Rule with Application rabbitmq, and Service is application-default. In the same Security Policy Rule, we allowed the dependant applications amqp and SSL. When we test traffic, in the Traffic log, we see it matching the zones and interfaces and IP addresses as we expect, but the rabbitmq application is identified as web-browsing, and so it is hitting the interzone-default rule. After creating an Application Override for each port (TCP 5672 and 5671) and using the built-in app ID of rabbitmq in the override policy, the application is identified correctly in the traffic logs.   Is it possible the signature of the version of RabbitMQ we are using is different from the built-in App-ID? I appreciate any help.   Jeff ... View more

We have one GlobalProtect Portal and 3 Gateways. This one Gateway is version 9.0.9-h1, and the GlobalProtect client version is 5.2.3-22. For testing, on this one Gateway, I enabled Split tunnel Domain and Application for *.webex.com and *.zoom.us.   I'm testing from home with two laptops, and both are connected to this same GP Gateway. Laptop 1 does not have all our client-side security software, and I see the traffic for both these domains going out the local network interface/Internet. Laptop 2, which has all our client-side security software, I see traffic for both domains going down the VPN.   I think the problem with laptop 2 may be Cisco Umbrella? Has anyone seen this issue with security software? Thanks for any help. Jeff ... View more