About Gukaaran

Hi,   One of my customers is having an issue where by Skype is not being allowed through despite the Stun and RTP applications being allowed through:     Previously we'd used the 'skype' and 'skype-probe' but this was not matching with the traffic.   Looking through the traffic logs the traffic is being denied because Stun is running on a high level port and not the default TCP/UDP 3478:   According to ARIN this entire range is assigned to Microsoft so making the assumption this is Skype traffic: Net Range 104.40.0.0 - 104.47.255.255 CIDR 104.40.0.0/13 Name MSFT Handle NET-104-40-0-0-1   This customer does not have URL filtering filtering installed so we are unable to permit/deny based on any details included in that.  The infrastructure also does not permit FQDN for using dynamic IP address lookups, hence the any in the destination IP rule.   At the present we have allowed this traffic by setting the service to 'any' not 'application-default'   The device is a PA-5050 running 7.0.11   Anyone else hit this issue and know of a fix?   One other thing I'd thought about doing is to clone the built-in 'stun' application (e.g. 'skype-stun') so that I can specify alternative port or set it to dynamic but it doesn't seem possible to do that.   Thanks   Gu ... View more

Hey Everyone,   Has anyone come across an official RSS feed (or similar) from Palo Alto which allows easy access to recent security advisories. Within my company we're look at pulling these from all our vendors so we can easily automate the notification and tracking of them.   I know the vulnerabilities are published at the link below but these can't easily be processed automatically: http://securityadvisories.paloaltonetworks.com/   Cisco and Juniper make there's available in much better format: http://tools.cisco.com/security/center/rss.x?i=44 https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES   The quality obviously varies but just being able to get the title and CVE number is a start.   Credit where due, Cisco's new-ish OpenVULN API is very useful to work with and provides access to the same information as on their website but in a XML/JSON format, anyone would basic scripting skills could pull the info out and adapt as needed: https://developer.cisco.com/site/PSIRT/   If they don't have one already Palo Alto could learn a lot from that.   I prefer not to have to deal with the CVE/NVD database if I can avoid it as it's getting very out-of-date with product details, they admit it themselves. This is again where Cisco's API works well as as the vulnerabily information gets added the list of products also does so you can match this up with the asset information for your company.   Thanks   Gu ... View more