About BrianRa

@vsys_remo wrote:   So if the client uses this name but connects to an IP that is controlled by an attacked, the firewall will happily allow the connection with the rule in your screenshot. As soon as I realized how that worked this was my first thought! Fortunately our DNS is fairly secure (externally anyway).  However if a bad actor got in and started spoofing DNS internally then yes we would have problems.  Also a user that understands the vulnerability would be able to access sites that are blocked.  We do have all of the Security Profiles built and are using all but Data Filtering on this rule.   Unfortunately I don't know that DNS proxy would work internally as we are using split DNS internally for both domain and some site requests.  During our initial configuration Palo Alto implied this was not prefered due to the load it put on the firewall (this may not be correct but it has caused us to avoid it on most of our networks). “Do not own a computer; Do not power it on; and do not use one.” Morris’s Three Golden Rules of Computer Security ... View more

@vsys_remo I have included the rule.  We have tried with both Application and Service (better results for internet access in general with Services as it turns out). Yes all the log results are the results of that rule.  We removed all confidential/internal data from the excel sheet.  In that timeframe dozens of hosts had made requests to get to the site.  All the "Destination address" results are valid IPs for the dev-prod05.conferdeploy.net domain.  From what I understand the firewall checks the DNS of the requested domain/site and if they do not match blocks the request (DNS poisoning of a client can be prevented this way). [EDIT] I stand corrected.  We did not have that domain properly in the "Vendors Whitelist" like we should have.  We had a ruler higher up in the stack we were using that IS using FQDN for all CarbonBlack domains we need.  I added the dev-prod05.conferdeploy.net properly (spelling) into the custom URL Category and it is functioning properly.    FQDN - does a DNS lookup to ensure the information is correct Custom Objects -> URL Category - only checks the domain to ensure it is in the allowed/denied list (as this is SSL an invalid cert warning should popup [in a browser] or the application should [hopefully] fail due to the failed cert)   [/EDIT] ... View more

@rmfalconer I will break each one down so it makes more sense.  If you understand more than this and it is redundant I apologize but I want to make sure it is all clear.  All definitions are in reference to what I am doing with it.  A not on the ".txt" extension, this has nothing to do with linux but makes it easily Windows readable (auto opens in notepad++ for me). host = nslookup | breaks out for the new command based on the results of the previous command grep = search request based on the result of "host" command (because of the pipe) containing the word "has" awk = a programing language initiator for printing the 4th value in the string based on a space breakout >> is equl to an append at the end of file > is equal to a replace/create file rm = remove file   RUN EVERY 5 MINUTES (Done every 5 minutes to try to capture all the IPs that are available)                   host dev-prod05.conferdeploy.net | grep has | awk '{print $4}' >> dev-prod05.conferdeploy.net_BULK-IPs.txt dev-prod05.conferdeploy.net has address 52.45.174.75 dev-prod05.conferdeploy.net has address 52.2.229.136 Find all lines that contain "has" in the line Now pull out the 4th variable based on a space delimiter from each line 52.45.174.75 52.2.229.136 Paste that value at the end of the current/defined txt file   RUN EVERY 10 MINUTES (Done every 10 minutes to try to capture new IPs but there is no reason to do it as often because the likely hood of a new IP after the first hour is low)                   awk '!seen[$0]++' dev-prod05.conferdeploy.net_BULK-IPs.txt > dev-prod05.conferdeploy.net.txt Search in the defined "BULK-IPs.txt" file for a unique value Repeat this command for all lines in this file Paste that unique values into a new/overwritten defined txt file   RUN ONCE A DAY: (I chose once daily because it is easy to troubleshoot and keeps the file down to the expected 30 IPs)                   rm /dev-prod05.conferdeploy.net_BULK-IPs.txt Remove the defined "BULK-IPs.txt" file There is no reason to rm/delete the dev-prod05.conferdeploy.net.txt final product file because it is already overwritten every 10 minutes with a new file   Please let me know if any of this does not make sense and I will try to explain it. ... View more

vsys_remo thanks for the reply. We currentlly have a rule for all "non internet" users/machines that has a URL Filter and we have added a "vendor whitelist" URL Category.  The domain is in this custom list.  This rule also onlly allows SSL and HTTP applications. This is the rule that is sometimes allowing access and other times denying based on whether or not the PA knows about the IP being used.  I may be missing something you are adding but the custom URL Category list only allows me to put in domains. ... View more

Generate Time Source Destination Destination address Application Action URL 9/10/2018 10:00 Internal External 18.214.112.236 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 10:00 Internal External 34.198.54.80 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 10:00 Internal External 34.197.244.92 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 10:00 Internal External 34.199.106.239 ssl alert dev-prod05.conferdeploy.net 9/10/2018 10:00 Internal External 34.192.44.112 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:59 Internal External 34.198.88.190 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:59 Internal External 34.198.88.190 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:59 Internal External 34.199.227.239 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.237.240.4 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.237.240.4 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.237.240.4 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.237.240.4 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.237.240.4 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 35.173.197.210 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 35.173.197.210 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.206.73.176 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.206.73.176 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.206.73.176 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.234.104.211 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.239.202.48 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.239.202.48 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:56 Internal External 34.198.54.80 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.192.44.112 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.194.166.1 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.197.159.199 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.198.88.190 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 18.213.132.157 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 18.213.132.157 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.192.210.120 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.197.244.92 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.197.244.92 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.197.244.92 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:55 Internal External 34.199.106.239 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:54 Internal External 18.213.132.157 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:54 Internal External 52.207.81.137 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:54 Internal External 52.207.81.137 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:54 Internal External 34.197.159.199 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.199.227.239 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.198.54.80 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.192.44.112 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.192.44.112 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.197.159.199 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.197.159.199 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.197.159.199 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.199.227.239 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.194.166.1 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.194.166.1 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.192.210.120 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.197.244.92 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.197.244.92 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.199.227.239 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:53 Internal External 34.197.244.92 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:52 Internal External 34.197.244.92 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:52 Internal External 34.192.44.112 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:52 Internal External 34.194.166.1 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:52 Internal External 34.199.106.239 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:52 Internal External 34.194.166.1 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:52 Internal External 34.199.106.239 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:52 Internal External 34.192.44.112 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:51 Internal External 34.199.106.239 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:51 Internal External 34.199.106.239 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:51 Internal External 34.199.227.239 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:51 Internal External 34.197.244.92 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:51 Internal External 52.207.81.137 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:50 Internal External 52.207.81.137 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:50 Internal External 52.207.81.137 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.199.227.239 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.192.210.120 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.192.210.120 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.198.54.80 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.198.54.80 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.192.210.120 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 18.213.132.157 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 18.213.132.157 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 18.213.132.157 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.197.159.199 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.197.159.199 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:49 Internal External 34.199.106.239 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.239.202.48 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.239.202.48 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.194.191.180 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.238.4.33 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 35.173.197.210 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.238.4.33 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 35.173.197.210 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.238.4.33 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.206.73.176 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.206.73.176 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.206.73.176 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 18.214.112.236 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 18.214.112.236 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.194.191.180 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.239.202.48 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.239.202.48 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.238.4.33 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:48 Internal External 34.225.200.240 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:47 Internal External 34.237.240.4 ssl alert dev-prod05.conferdeploy.net 9/10/2018 9:47 Internal External 18.214.112.236 ssl block-url dev-prod05.conferdeploy.net 9/10/2018 9:47 Internal External 34.239.202.48 ssl block-url dev-prod05.conferdeploy.net ... View more