Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- ›
- About Curt_Wilson
About Curt_Wilson
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
9 hours ago
14Posts
3Likes
3Solutions
Jan 21, 2021Last Visited
User
Activity
User
Profile
Latest posts by Curt_Wilson
| Subject | Views | Posted |
|---|---|---|
| 747 | 07-13-2020 10:35 AM | |
| 8330 | 07-10-2019 10:48 AM | |
| 2214 | 10-10-2018 07:32 AM | |
| 1637 | 11-28-2017 03:57 PM | |
| 1651 | 11-15-2017 06:31 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 | 07-10-2019 10:48 AM | |
| 1 | 08-30-2017 11:28 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 4 |
User Badges
Public Statistics
| Date Registered | 05-26-2016 08:44 AM |
| Date Last Visited | 9 hours ago |
| Total Messages Posted | 14 |
| Total Likes Received | 3 |
07-13-2020
10:35 AM
Sorry, but I do not have a resolution for this. We opted to configure GlobalProtect as only "user-login (always on)"
... View more
07-10-2019
10:48 AM
2 Kudos
I did what you suggested from the CLI and found the 40006 threat exception. The WebUI did not show it in the exceptions list for me to delete from there. I went back to the CLI, and fumbled my way through it using the following... This is used to get the output in "set" format. (This helps those of us who are not overly familiar with PAN-OS CLI.) > set cli config-output-format set Enter Config mode. > configure Show configuration and search for Threat ID 40006. # show
/40006 or # show | match 40006 Use the above output results to create a "delete" command. # delete profiles vulnerability "vuln-profile-name" threat-exception 40006 Commit changes. # commit Problem solved.
... View more
10-10-2018
07:32 AM
Yeah, we are also getting a lot of the Threat ID 30650 events. All events seem to include a *.min.js or *.js file name.
... View more
11-28-2017
03:57 PM
Looks like "pre-logon tunnel rename timeout" is already set to the default of -1.
... View more
11-15-2017
06:31 PM
Ideas anyone? Or, am I completely missing something?
... View more
11-15-2017
10:08 AM
After looking at the SSL Labs report for this website and seeing all the issues... Try getting in contact with the website owner to fix their site (I have had to do this myself on several occasions). Then, if they don't fix their site and you still require access, create a decryption policy that excludes this one URL. We are running PAN-OS 8.0.5, and the webpage doesn't load for me either.
... View more
11-14-2017
01:10 PM
I have setup GlobalProtect with Pre-Logon configuration, but between the "pre-logon" status and "post-logon" status of the same computer I am getting 2 different IP addresses. For example, during pre-logon I get 172.16.4.201, but as soon as a user logs into Windows I get 172.16.4.200. Is there any way to keep the IP address the same between the different authentication stages? The main reason this would be beneficial, is for instances when the IT dept is remoted (VNC) into the user's computer before they login to Windows, then so the remote VNC session does not get dropped when the IP address changes after Windows login. Is this possible?
... View more
10-30-2017
02:40 PM
I don't want to say based on severity "only", but for us it definitely helps simplify things so that everytime Palo Alto releases a new Threat ID we don't have to go configure a custom action for each one. We also don't feel comfortable using a default action of "alert" for a critical severity threat. This is what we do... For critical, high, and medium threats we use "reset-both" action. For low threats we use "default" action (which uses the individual threat's action recommended by Palo Alto). For informational threats we use "allow" action. Then we use "exceptions" when we have a Threat ID we want configured differently than based on severity.
... View more
10-24-2017
03:32 PM
In the last month or so we have seen lots of network vulnerability scanning for the following 3 Threat IDs coming from all over the world. - MVPower DVR TV Shell Unauthenticated Command Execution Vulnerability(30426) - WebUI mainfile.php Arbitrary Command Injection Vulnerability(38836) - Wireless IP Camera Pre-Auth Info Leak Vulnerability(33556) We don't have products that would be vulnerable to these threats. A single scanning interval seems to always look for only these 3 threats all within a few seconds, coming from the same source IP, and attacking the same destination IP. Then several hours later plus or minus a few hours (seems random), another scan interval occurs, but with a different source IP (and likely different region), and attacking a different destination IP from the last time it occurred. Then it repeats. Our action for these attacks is "reset-both". Should we be doing some thing different? We find it strange that this is coming from several regions around the world. Are they all part of the same hacking group? Has anyone else also seen this same pattern?
... View more
10-24-2017
03:29 PM
They each have their own vulnerability signature, therefore a unique Threat ID. I see a total of 26 threats that are named "HTTP SQL Injection Attempt", 1-high, 23-medium, and 2-low in severity.
... View more
10-24-2017
01:11 PM
When traffic is allowed by a Security Policy and there is a Vulnerability Protection Profile defined to the Security Policy, the firewall checks the traffic for vulnerabilities specified in the Vulnerability Protection Profile. If the traffic matches a vulnerability signature, an action is taken place. The more Security Policies you have Vulnerability Protection Profiles defined with, the better you are protected. However, it may create some false positives. In that case you may want to adjust the "action" to the "severity" that you are comfortable with in the Vulnerability Protection Profiles. For us, we "reset-both" action for critical, high, and medium severities, "default" action for low severity, and "allow" action for informational severity. Finally, there are a few Threat IDs we have made individual "exceptions" to within the Vulnerability Protection Profile. I would say your Security Policies that pass traffic TO/FROM the Untrust zone would likely have the most risk and is where you definitely want to have Vulnerability Protection Profiles enabled. I hope this helps!
... View more
10-24-2017
12:31 PM
It is comforting to know we are not the only ones "targeted" with these, instead it seems to be more general "untargeted" scanning happening to everyone. I will look into making exceptions for these Threat IDs with an action of either "drop" or "block-ip". As far as blocking the source IPs in a policy, I am leaning towards creating a block policy based on region, mainly because there seems to be very little repeat from IP ranges.
... View more
10-20-2017
01:24 PM
In the last month or so we have seen lots of network vulnerability scanning for the following 3 Threat IDs coming from all over the world. - MVPower DVR TV Shell Unauthenticated Command Execution Vulnerability(30426) - WebUI mainfile.php Arbitrary Command Injection Vulnerability(38836) - Wireless IP Camera Pre-Auth Info Leak Vulnerability(33556) We don't have products that would be vulnerable to these threats. A single scanning interval seems to always look for only these 3 threats all within a few seconds, coming from the same source IP, and attacking the same destination IP. Then several hours later plus or minus a few hours (seems random), another scan interval occurs, but with a different source IP (and likely different region), and attacking a different destination IP from the last time it occurred. Then it repeats. Our action for these attacks is "reset-both". Should we be doing some thing different? We find it strange that this is coming from several regions around the world. Are they all part of the same hacking group? Has anyone else also seen this same pattern?
... View more
08-30-2017
11:28 AM
1 Kudo
We had been experiencing AJP (TCP 8009) issues between our Web servers and JBoss servers all morning. Reverting to 727 fixed our issues.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
9 hours ago
|
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
