About SRA

SRA · ‎07-24-2013

The session vs. transaction option only matters when you have multiple conditions in the signature, and you want all of those be within a single transaction, or they can occur across transactions in a session. Have you taken a packet capture of the session to check if the patterns are indeed exactly the same as you used in the signature.

SRA · ‎07-24-2013

The entire session should be blocked, not just a few packets; unless the remaining packets are part of a different session. Also, from your original post it seems like the patterns don't appear in the session in all the editions of their product. Can you confirm from a packet capture that the patterns (either a header or URI) are indeed present in the session.

SRA · ‎07-23-2013

You can build a custom vulnerability or app signature to identify this traffic. To match on patterns in http request headers, you can use the http-req-headers context, and for matching patterns in URL you can use http-req-uri-path context.

SRA · ‎06-24-2013

This does not appear to be a genuine or valid scenario. The scheme devised in the test assumes both the client and server are already under the control of the attacker. We aren't aware of any real-world clients or servers that can talk DNS initially and then switch to SSH. App-ID has coverage for many evasive real-world tunneling applications and we continue to add coverage for more as we discover them. We are currently reviewing this further, stay tuned for an update.

SRA · ‎06-19-2013

That's the right query. I just tried it on my PA-200 on PAN-OS 5.0.4-h1 and it works right. Are you trying this to the device via Panorama using the target parameter?

SRA · ‎06-05-2013

Have you tried using the type=import API query with curl? Check out the API guide for details. curl --form file=@ filename “http(s)://firewall/api/? type=import&category=configuration&key=xxx ”

SRA · ‎06-03-2013

That change was done in content version 375 and I definitely agree with you that it should have been listed in the content release notes. We are investigating why it missed the release notes and will try to prevent it in the future.

SRA · ‎06-03-2013

The warning message identifies application dependencies for all potential app usage scenarios. If your particular scenario does not need the dependency, you can ignore the warning.

SRA · ‎06-03-2013

When using clients to access Gmail, the outgoing mail server is smtp.gmail.com and this uses SMTP over SSL or StartTLS. This traffic will be identifed as smtp when using StartTLS or when the SSL session is decrypted. https://support.google.com/mail/answer/13287?hl=en

SRA · ‎05-20-2013

are you able to login to the firewall WebUI with those same credentials?

SRA · ‎05-01-2013

Wildfire logs cannot be retrieved from the API using the 'log-type=threat' option. A new 'log-type=wildfire' option is being added for this in upcoming PAN-OS 5.0.x software update.

SRA · ‎04-09-2013

The Application Objects browser on the WebUI as well as the Applipedia page on the Internet provide free text search including searching by port numbers.

SRA · ‎04-07-2013

You can try to match on the http-rsp-headers for the content type of crl : application/pkix- crl, application/x-pkcs7-crl, etc.

SRA · ‎04-04-2013

Your usage is correct. Can you confirm the job id value you provided is the same as the one returned by the previous query.

SRA · ‎04-01-2013

See this API guide:

SRA · ‎04-01-2013

Debug commands are not supported by the API.

SRA · ‎03-17-2013

The cisco-wlc-mobility App-ID covers traffic for wireless lan controllers on udp/16666. If you are seeing this as unknown-udp, please open a case with technical support along with a packet capture.

SRA · ‎02-19-2013

http(s)://hostname/api/?type=config&action=set&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/profiles/custom-url-category/entry[@name='xmltest urlcat']/list&element=<list><member>www.somesite.com</member></list> Check the FAQ section in the API guide for this and other examples.

SRA · ‎02-19-2013

http(s)://your-panorama/api/?type=op&key=your-api-key&cmd=<show><devices><connected></connected></devices></show>

SRA · ‎01-24-2013

The API returns a full list, or a specific app. For other type of filtering, you need to do it as post-processing of the returned data.

SRA · ‎11-09-2012

yes, you will need a security policy rule to allow/block the custom app from your app override rule.

SRA · ‎10-23-2012

You can use the API on the firewall to get the list. The query will be: https://firewall/api/?type=config&action=get&xpath=/config/predefined/threats/vulnerability&key=XYZ

SRA · ‎09-05-2012

This link is only for submitting new application requests. For threat coverage, check out the threat vault or open a case with support for a new threat.

SRA · ‎08-13-2012

You can use config edit API request to replace the entire list of urls in a url filtering profile with a new set of urls: http(s)://hostname/api/?type=config&action=edit&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/profiles/url-filtering/entry[@name='blocked-url-profile']&element=<entry name='blocked-url-profile'><member>www.badsite.com</member><member>www.badsite2.com</member></entry>

SRA · ‎08-08-2012

If you configure a netflow profile on the physical interface, the firewall will export netflow records only for flows ingressing on the physical interface. Flows ingressing on a subinterface will not have netflow records exported.

SRA · ‎06-06-2012

There are no Botnet logs, just predefined Botnet reports that run daily. You can use the XML API to get the botnet report (from PAN-OS 4.1.3) as : http(s)://firewall/api/?type=report&reporttype=predefined&reportname=botnet

SRA · ‎06-06-2012

for the entire table: /api/?type=op&cmd=<show><arp>all</arp></show> or for a specific interface ethernet1/1: /api/?type=op&cmd=<show><arp>ethernet1/1</arp></show>

SRA · ‎05-24-2012

No, this is internally generated.

SRA · ‎05-14-2012

This change is targeted for Content Update version 308 due for release tomorrow 5/15.

SRA · ‎05-09-2012

The Dropbox Common Name *.dropbox.com is in the exclude list for SSL decryption, so its traffic will not be decrypted. This was done to allow the client to function when decryption is enabled, since it does not accept . Data filtering and File blocking profiles are possible on traffic from the web applicationwhen using decryption. To allow this to happen, we plan to remove the dropbox CN from the exclude list for SSL decryption. You can add it back to the SSL exclude list manually if you want using this CLI command:# set shared ssl-decrypt ssl-exclude-cert "*.dropbox.com"

Date Registered	‎05-24-2010 03:26 PM
Date Last Visited	‎07-14-2016 11:19 AM
Total Messages Posted	123
Total Likes Received	19

Online Status	Offline
Date Last Visited	‎07-14-2016 11:19 AM

Strata

Prisma

Cortex

About SRA