About PaulBrock

PaulBrock · ‎05-23-2023

Hi Raido, sorry, I probably did not explain myself properly. I need to turn off Palo Alto disclosing information to a public scan. at the moment you can see the following information " Palo Alto GlobalProtect Gateway httpd"

PaulBrock · ‎05-23-2023

Hi Han, You must have received the same report, 😀 the Pen testers flagged Weak ciphers, secure renegotiation, and also Information Disclosure With regard to Information disclosure: I don't suppose anyone knows how to turn off Palo Alto "Palo Alto GlobalProtect Gateway httpd"

PaulBrock · ‎05-22-2023

Thank you so much, this is so helpful 👍 I wish that when I contacted support, rather than sending KBs they would simply answer like you have.

PaulBrock · ‎05-21-2023

Hi All, I recently had a pen test return the following results: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ( 0xc030 ) ECDH secp256r1 (eq. 3072 bits RSA) FS 256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ( 0xc02f ) ECDH secp256r1 (eq. 3072 bits RSA) FS 128 TLS_RSA_WITH_AES_256_GCM_SHA384 ( 0x9d ) WEAK 256 TLS_RSA_WITH_AES_128_GCM_SHA256 ( 0x9c ) WEAK 128 TLS_RSA_WITH_AES_256_CBC_SHA256 ( 0x3d ) WEAK 256 TLS_RSA_WITH_AES_128_CBC_SHA256 ( 0x3c ) WEAK 128 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ( 0x9f ) DH 2048 bits FS 256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 ( 0x9e ) DH 2048 bits FS 128 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ( 0xc014 ) ECDH secp256r1 (eq. 3072 bits RSA) FS WEAK 256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ( 0xc013 ) ECDH secp256r1 (eq. 3072 bits RSA) FS WEAK 128 TLS_RSA_WITH_AES_128_CBC_SHA ( 0x2f ) WEAK 128 TLS_DHE_RSA_WITH_AES_256_CBC_SHA ( 0x39 ) DH 2048 bits FS WEAK 256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA ( 0x33 ) DH 2048 bits FS WEAK 12 which of the below cipher suites do I disable to comply ? (enc-algo-3des is already disabled), this is set on my global protect interface, will anything break 🙂 + auth-algo-sha1 Allow authentication SHA1 + auth-algo-sha256 Allow authentication SHA256 + auth-algo-sha384 Allow authentication SHA384 + enc-algo-3des Allow algorithm 3DES + enc-algo-aes-128-cbc Allow algorithm AES-128-CBC + enc-algo-aes-128-gcm Allow algorithm AES-128-GCM + enc-algo-aes-256-cbc Allow algorithm AES-256-CBC + enc-algo-aes-256-gcm Allow algorithm AES-256-GCM + enc-algo-rc4 Allow algorithm RC4 + keyxchg-algo-dhe Allow algorithm DHE + keyxchg-algo-ecdhe Allow algorithm ECDHE + keyxchg-algo-rsa Allow algorithm RSA + max-version max-version + min-version min-version

PaulBrock · ‎08-20-2019

Hi Kiwi, Many thanks for replying, yes i do tick " Include Detailed Browsing" however that just shows the URLS the user has visited. what I am after if a way to find out what site a user used a large amount of Bandwidth on. At the moment i can seem to only narrow it down to a catagory. Regards, Paul

PaulBrock · ‎08-19-2019

Hi Everyone, This is probably a very simple task, however i am not getting the result I am after. I am trying to create a report that shows me the top URLS by bandwidth for a user for the last 7 days , in the User Activity Report ( predefined) it shows Traffic summary by URL Catagory not the url itself. which is what I am after however not URL category, just URL , as that graph shows me he used e.g 20gb on Computer and Internet etc. Can someone tell me what template to try and customise. Many Thanks in advance

PaulBrock · ‎07-02-2019

Hi Everyone, I would like to create a report that sends me a email either straaight away or on a schedule, that when a user performs a search for a keyword i.e suicide I am alerted. I workout how to create a report if the url contains a keyword, however that is not what I am after. Many thanks in advance for any suggestions. Regards Paul

PaulBrock · ‎03-20-2018

Thankyou both for taking the time to respond in a very detailed manner, I have also opened a case with TAC and have just got back the following response PAN-92564 . It's not yet resolved in 8.0.8. Fix is planned for 8.0.9 release which is due for release by end of this month. Fingers crossed . I am curious what other people use in regards to 3rd party transceiver My firewall connects into a HPE switch which only accepts HP branded trancivers using 10gb DAC, so therefore I was allways grateful PA is transceiver agnostic . Paul

PaulBrock · ‎03-19-2018

Hi Everyone, i am currently running 7.1.14 and am looking to upgrade to 8.08 with third part trancivers HPE X242 10G SFP+ to SFP+ 3m Direct Attach Copper Cable J9283B I read in the Upgrade/Downgrade Considerations Support for Third-Party SFP Transceivers https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/upgrade-to-pan-os-81/upgradedowngrade-considerations#id0593bb6c-d14c-4458-870a-0c39cc9c4539 that to not upgrade to 8.0 or 8.1 unless you then upgrade to a maintenance release that contains the fix for this issue. also it states Additionally, when you are ready to upgrade, make sure that you do not reboot the firewall after you download and install the PAN-OS 8.1 (or PAN-OS 8.0) base image until after you download and install a maintenance release that contains the fix for this issue. My question is How do i know if there is a maintenaince release ideally 8.06 that contains the fix? and also is it possible to upgrade to 8.0 and the to 8.06 without restarting?

PaulBrock · ‎11-29-2017

Hi Everyone, I know this is more of a personal choice rather than a exact science , I am currently running 7.1.14 on a PA 3600 which is very stable for my organisation at the moment, however I do not want to fall to far behind firmware levels , so I am beginning to question when to move to the current F/W My question is , have alot of people upgarded to 8.xx , is it a stable release , should I hold off till 8.1.X ? I am not wanting to be an earlier adopter, but i think considering its 8.0.6 it has had a bit of time to flatten out and also the new way to add ssl exempt urls feels a lot better than the existing method . Paul

PaulBrock · ‎11-14-2017

Hi i have a problem at the moment where it appears there is a proxy/Vpn application that is using port 123 . as i have lots of byod devices that require access to NTP i leave the port open. When I look at the monitor logs it source port can be anything from 123 to any other port and the dest port is 123 and P.A is letting me know the application is NTP , hence allowed I have ssl decryption turned on . i am slightly stuck on how i ca allow legitimate NTP traffic as opposed to vpn/proxy using port 123 ?

PaulBrock · ‎03-30-2017

Hi gd@westbuckland.devon.sch.uk Can i ask how did you go with TAC in regards to " Google, et al and their apps not working with decryption, I know people are saying wait 2h hous and some of the problem appears to be resolved , however you are saying some problems remain. To all people who upgraded to 8.0 or 8.0.1 , would you recomened too people to upgrade or are you regreting the fact due to this decryption issue. Paul

PaulBrock · ‎03-29-2017

Hi Kiwi, Many thans for taking the time to eply , I missed that document along the way. I was wondering. as I not going to be intsalling 8.0.1 for a week or two, can i still update my uia on the Domain controller to version 8 now or do i have to wait ? and the same question for the global protect agent can i make the 4.0 version active prior to the upgrade ? Paul

PaulBrock · ‎03-28-2017

Hi everyone, I Iam about to take the plunge and update from 7.1.7 to 8.1 I have read a few of the guides out there such as : 8.0 upgrade/downgrade considerations PAN‐OS® 8.0 Release Notes My questions I have are 1. Do I need to upgrade the global protect client , which is currently version 3.1.5 ? 2. Do I need to update the User-Id agent running on my Domain Controller , which is currently 7.0.7-13 3. Should i be concerned about https://live.paloaltonetworks.com/t5/General-Topics/PAN-OS-8-0-Decryption-Issue-with-Firefox-and-Chrome/m-p/149917#U149917. Paul

PaulBrock · ‎03-21-2017

Thankyou Steve, for a direct and simple answer, very much appreciated.

Member Since	‎08-29-2016 11:02 PM
Date Last Visited	‎06-23-2023 01:45 AM
Posts	21
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎06-23-2023 01:45 AM

About PaulBrock

Re: Which weak cipher suites for SSL/TLS to delete

Re: Which weak cipher suites for SSL/TLS to delete

Re: Which weak cipher suites for SSL/TLS to delete

Which weak cipher suites for SSL/TLS to delete

Re: Top urls by Bandwidth for a user

Top urls by Bandwidth for a user

Looking for a keyword report

Re: Third-party SFP transceivers

Third-party SFP transceivers

When to upgade from 7.1.14 to 8.0.6

Re: Which weak cipher suites for SSL/TLS to delete

Re: Which weak cipher suites for SSL/TLS to delete

Re: Third-party SFP transceivers

Re: Help with creating a custom App

Re: Which weak cipher suites for SSL/TLS to delete

Re: Which weak cipher suites for SSL/TLS to delete

Re: Which weak cipher suites for SSL/TLS to delete

Which weak cipher suites for SSL/TLS to delete

Re: Top urls by Bandwidth for a user

Top urls by Bandwidth for a user

Looking for a keyword report

Re: Third-party SFP transceivers

Third-party SFP transceivers

When to upgade from 7.1.14 to 8.0.6

NTP and proxy bypass

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Re: Upgrade to PAN-OS 8.0.1

Upgrade to PAN-OS 8.0.1

Re: HTTP-Proxy allow or deny app