About MikeC

MikeC · ‎07-23-2020

@kiwi Thanks for reply. I fixed disconnect by restarting mgmt server As for the roadmap, it better be. I was told it was going to be August/September. Just wasn't sure if that was still the case, since I haven't heard anything about it since

MikeC · ‎07-16-2020

Has anyone else experienced many more "Disconnected from Log collector Server" alerts since the CDL Migration to GCP? I used to get one every now and then but since the change, it's increased dramatically. Every time I check, the firewalls are logging properly, it's just annoying to see these alerts. Also, any news on when CDL will start allowing for detailed custom reports, instead of just summary reports.

MikeC · ‎05-18-2020

@BPry I did a further test on my machine. I don't think this particular issue has anything to do with Skype. On my machine, I started a packet capture on both my wifi interface and the GP interface. While connected to GlobalProtect, I ran command "ipconfig /registerdns". I see two standard query SOA requests. One of them is destined to my corporate internal DNS server (active directory) and the other one is sent to my home wifi local connection. I then receive the proper responses from both. However, when the dynamic update is sent, it uses my GP interface instead of sending to our internal servers Here's an example. 192.168.1.139 is my home IP. 172.16.x.x is my GP IP and 192.168.x.x is our internal DNS server 68.x.x.x is the Name Server IP for the domain name. The clients should not be sending the dynamic update to this IP.

MikeC · ‎05-18-2020

@BPry Understood on the skype part. However, our clients are configured to use internal DNS servers (DNS that runs on our Domain Controllers, which are part of RFC 1918 addresses) not public facing dns servers. We never provide clients public DNS servers, as we only allow DNS requests from our domain controllers I don't believe while they are on VPN, they should constantly be sending their dynamic update to a public DNS server that their system is not configured to use. It's sending these dynamic updates multiple times an hour I should also add, that some of these users are no longer using Skype. They have switched to Microsoft Teams.

MikeC · ‎05-18-2020

@BPry Thanks for reply. Interesting but I'm still a little confused. All of our clients are configured to use our internal DNS servers regardless of where they are connecting from, since we use always on VPN. The other part is these are not dns query requests...these are dynamic updates (where the client sends the update to tell the dns server what IP address their machine is using)

MikeC · ‎05-18-2020

Hi @BPry We do use Skype for Business. The "no direct access to local network" is unchecked. This was to allow users to use their home printers

MikeC · ‎05-14-2020

We deny DNS outbound except for domain controllers. I noticed a lot of denied DNS entries on the firewalls for users coming through globalprotect. Looking at the packet captures, the traffic is destined to the domain name's public name server ip address. The payload are "dynamic updates SOA <domain name>" This is a DNS split-brain environment, where our corporate machines are on a domain name that is also publicly hosted. What does not make sense to me is why is the traffic going to the public nameserver for our domain? It should be sending those updates to the internal DNS. I should add that the ip address the clients are sending in their update is their home private IP address, not their globalprotect ip address

MikeC · ‎05-11-2020

Interestingly enough, the best practice guide mentions to leave the default threshold, but there is a video from Palo Alto regarding BPA and the threshold is different than the default https://www.youtube.com/watch?v=QAuJyboFPy8

MikeC · ‎05-08-2020

Hi, Are there any best practice settings for the reconnaissance portion of the zone protection profile. I see the default has the below. Is it recommended to leave as defaults or does someone have a better recommendation? TCP Port scan 100 events within 2 seconds UDP Port scan 100 events within 2 seconds Host Sweep 100 events within 10 seconds

MikeC · ‎10-04-2019

@OtakarKlier Yes, I meant to come back and delete the post. I was able to figure it out. I had to uncheck Log Container Page Only in my URL profile, to see the exact URL for aws. appreciate the reply though

MikeC · ‎10-04-2019

Is there any way to restrict amazon-cloud-drive-upload for certain websites? For example, say the website is www.mywebsite.com (public IP 1.1.1.1) and has an applet that allows users to upload files. When the user attempts to upload the files, the firewall detects this as application "amazon-cloud-drive-upload". You can't create a firewall rule that with a destination of 1.1.1.1 and allow app amazon-cloud-drive-upload , since that function is using amazon's IP address range (52.216.0.0/15). However, if you allow the application for that aws region, then these users can upload to any site that is in that region, which is not ideal. Hopefully, this makes sense

MikeC · ‎08-05-2019

@codyweber54 I decided to use the Windows User-ID agent instead. No more issues, since switching to that

MikeC · ‎05-24-2019

@kiwi I know but I went with 5.0.2 because of others informed me that a lot of bugs from 5.0.1 would be resolved in 5.0.2 @BPry So far it was only 2 users, one was windows 10 and the others windows 7. Both dell but different models. I have had many people successfully upgrade already. 5.0.2 has been working great for me so far

MikeC · ‎05-23-2019

Anyone experiencing any issues with GP 5.0.2? I started an upgrade this week. So far so good, but a few users experienced an odd issue during the upgrade. You'd click download, then when you click install, their screen went completely black. The upgrade completes successfully if you want it out but have to restart the explorer.exe process to get your desktop icons back

MikeC · ‎05-07-2019

@vsys_remo yes! I saw the email. I'll be installing it tomorrow too (for testing)

MikeC · ‎05-01-2019

thanks @cnygaard Sounds like I'll be waiting for 5.0.2. Right now, until I get the MFA vendor integration going, I use user certs as well as AD auth. Not sure if this is also a problem with 5.0.1, but I'll wait for 5.0.2 anyway 🙂

MikeC · ‎04-30-2019

@vsys_remo you have 10 open cases? Are you a palo employee? Thanks for the tip, I will wait a few days 🙂

MikeC · ‎04-30-2019

Thanks @vsys_remo I read this statement you made wrong " This feature also works with PAN-OS 8.0.x. With user-logon (as right now configured by @MikeC ) this is already possible with 4.1.x." I understand correctly now. I'm actually upgrading to 5.0.1 this week. Thanks so much

MikeC · ‎04-29-2019

thank you @hshawn and @vsys_remo So a few things, yes, currently it easy to circumvent, but most users don't know how to do that. The goal (for now) is for all internet traffic from corp devices to be full tunnel for inspection We are also looking at switching to pre-logon for other reasons. This may actually work out better. GP set to pre-logon, this will allow to internal resources, such as AD. Then, after user authenticates, they will be prompted for MFA from chosen provider (okta, duo, ping, etc)? The caveat being it has to be PAN OS9. Until firewalls are upgraded to os9, we can use this user-logon with the exception that you can't enforce gp for connectivity Do I have this correct?

MikeC · ‎04-29-2019

I was wondering if anyone here using GlobalProtect with MFA, such as Duo, Okta or Ping. Currently, clients portal app is set to User-Logon (Always On). I'd like to implement MFA for GP, but also keeping the always on functionality. The question is if the user does not enter their OTP, then GP will not connect. This would circumvent the always on functionality. There is the option (currently disabled) to "Enforce GlobalProtect Connection for Network Access". With this option set to yes, it should prevent someone from circumventing the VPN connection. However, what about when the user is in a hotel or using public wifi and needs to access to accept terms and conditions before wireless connection is established?

MikeC · ‎03-17-2019

@BPry @Raido Maybe another option that makes more sense is to switch from legacy mode to panorama mode? Do you see any downsides to doing this?

MikeC · ‎03-17-2019

Hi @BPry , Yes, this is the confusing part. This is the same link that I discussed with support. it sounded like it can be done, however, support said this option is only used if I were to deploy a new Panorama. The way it was explained was, setup a new Panorama VM and then we can copy the old logs to new Panorama. I should probably escalate the case.

MikeC · ‎03-15-2019

thanks. I was already aware of this one. I was wondering if it's possible to increase the space without deploying a new panorama

MikeC · ‎03-14-2019

I currently have a virtual Panorama on esxi running version 8.1.x in legacy mode. The VM is configured with a system disk and an additional 500GB disk for logging. The 500GB is proving to be not enough as I'm only able to keep a little of 1 month of logs. I have asked this question to support, but could not really get a clear answer. Is it possible to shut down panorama and expand the existing 500GB disk to 2TB? Not sure if Panorama will recognize the unallocated space when the VM powers back on. If this not an option, what is suggested? Should I convert from legacy to panorama mode? I'm still trying to read the caveats of doing that. I'd prefer not to lose any of the existing logs

MikeC · ‎02-22-2019

Hi, Not to deny. In my situation, I always block uploads with a File Blocking policy. What I needed was to allow uploads for only wetransfer. Since PAN was seeing the wetransfer upload traffic as application 'ssl', I need to add these urls to allow uploading only for wetransfer If you typically allow uploading and want to only block wetransfer uploads, then yes, you can use deny action

MikeC · ‎01-16-2019

I got it working, Would be nice to decrypt the web dropbox traffic but not decrypt from the client. I tried excluding just client.dropbox.com but that didn't work. The below got me what I needed Custom URL category for the below and don't decrypt that. *.dropbox.com dropbox.com/*

MikeC · ‎01-15-2019

I have a policy rule to allow dropbox. I am performing SSL Decryption. The users are using the dropbox client (not web). I came across this article that mentions this will not work when decrpytion is on https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGaCAK Anyone have recommendations on how to exclude the dropbox client traffic?

MikeC · ‎01-14-2019

I have Cisco WLC and use ACS for radius authentication. I'm trying to configure PA FW to use those accounting logs for User ID. I'm following this article but it's not working https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm8DCAS Where it says, " Give the target a name and enter the IP address of the interface that will process the Syslog and use port 514". They are referring to the Management interface, correct? When I run cli command, show user server-monitor state <Monitored server name> The number of logs increases, but the number of auth success messages stay at 0. I'm using ACS 5.8, PAN 8.1.4 and Cisco WLC

MikeC · ‎01-10-2019

Thank you both!

MikeC · ‎01-10-2019

@vsys_remo wrote: Do they authenticate in your wireless with their company credentials maybe with the authentication happening on a radius server? If yes, then use these logs for User-ID mapping. If thats not the case then you need to make sure that you configure enough sources for user-ID like active-directory, exchange ... to make sure that the time without mappkng is as short as possible. Yes! That's what I was just thinking. I'm using Cisco ACS for Radius auth. Is it pretty straight forward?

Date Registered	‎08-12-2016 06:17 PM
Date Last Visited	Thursday
Total Messages Posted	50
Total Likes Received	5

Online Status	Offline
Date Last Visited	Thursday

Strata

Prisma

Cortex

About MikeC