About BrianRa

Hello, With regards to split-tunnel. I recommend only Full tunnels. Its the only way to make sure the PAN is scanning all traffic to/from VPN clients and is a finding on pretty much all compliance models. Regards, ... View more

@JohnWiktorski Thanks for the feedback. It look's like they have updated there known issues documentation for PAN OS 9.1.12 now as well with this bug ID.   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-release-information/known-issues/known-issues-related-to-pan-os-9-1-releases/pan-os-9-1-12-known-issues.html ... View more

@vsys_remo wrote:   So if the client uses this name but connects to an IP that is controlled by an attacked, the firewall will happily allow the connection with the rule in your screenshot. As soon as I realized how that worked this was my first thought! Fortunately our DNS is fairly secure (externally anyway).  However if a bad actor got in and started spoofing DNS internally then yes we would have problems.  Also a user that understands the vulnerability would be able to access sites that are blocked.  We do have all of the Security Profiles built and are using all but Data Filtering on this rule.   Unfortunately I don't know that DNS proxy would work internally as we are using split DNS internally for both domain and some site requests.  During our initial configuration Palo Alto implied this was not prefered due to the load it put on the firewall (this may not be correct but it has caused us to avoid it on most of our networks). “Do not own a computer; Do not power it on; and do not use one.” Morris’s Three Golden Rules of Computer Security ... View more

I didn't get any complaints but I was doing it between 6 am and 8 am on a Saturday morning which is a low traffic time for us.   I expect there was since one firewall was told to stop responding and the other was not already operating as an active.  Generally I see some traffic drops when I put one in standby due to a combination of OSPF convergence and the really unfortunate way I'm having to do traffic routing via Policy-Based Routing and ping watchdogs (I keep running into issues with "set ip next-hop recursive" and the hardware I'm using). ... View more

@Arti_K, SOme of these that you have listed won't be answered by using the 'match' command without quite a bit of CLI knowledge to ensure nothing get's overlooked. I highly recommend that you actually review the configuration to ensure each recommendation is acutally being followed by physically looking over the configuration.    ... View more

@BrianRa   Yes the configurations are probably not the same for everyone, but TAC assured me it was 99% unlikely that the configuration on the Zone protection broke my VPN ... View more

@brian, yes this is what you have mentioned above. Somehow this is a production firewall. Will have to secure approval on this one. But I really am consideting this suggestion. Will let you know oncw I have a feedback ... View more

Ryan,   We had pushed these components from Panorama so I am not sure exactly what is supposed to synchronized in Devices -> Setup in an H/A pair.  I do know that the entire Setup portion is separate from the production config as it is the management plane.   Brian ... View more

I would recommend that you look  at  the  'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\GlobalProtect' registry key.  GP checks that key every time the user logs in, and starts GP.  If the key is missing then that can cause issues.   Also, it can depend on how GP was removed/reinstalled. ... View more

Use this with caution.  I would decide how important the rule changes are in the immediate.  https://live.paloaltonetworks.com/t5/Management-Articles/Disable-Panorama-Policy-and-Objects-Disable-Device-and-Network/ta-p/76539 Once this is done it can be a pain to pull back into Panorama, we have had to do this for a site we were bringing online once and also when a site was no longer able to connect due to ISP changes.  Both times there were unique challenges bringing it back into Panorama.   Brian   Company note: we chose to run Panorama for configurations as a VM, we maintain a backup copy of it at a DR site incase there is an emergency/failure. ... View more

Supposedly with the active on 7.1.x and the passive on 8.0.x you can tell them to fail over and the passive will pickup without any problems. ... View more

@jsalmanswe had a similar experience.  We started stacking/nesting them right off the bat and ended up deleting everything and just making a default template concept to copy. @sam_millerI do agree they work differenty.  With Template stacks the config priority goes to the farthest down the chain.  Device Groups are the opposite in the sense that whatever is configured Globaly takes priority.   Another interesting thing to note is that the Device Groups and Templates are developed by different groups.  I would guess the Device Group developers are more of the CheckPoint experienced devs and the Template group are more the Juniper devs. ... View more

Glad things are moving in the right direction.   With 100m interfaces there never was a universally accepted standard for auto-neg.  I've found it almost never works correctly cross different vendors so setting explict 100 full settings on both sides is generally required to avoid a 100 half link.   Agree that some color coding for error conditions like half-duplex would be helpful in the gui.   ... View more

NAT has worked well for us.  You may not need to use PBFs if you put everything in the VS default routes.  Its the Security Policies and the NAT Policies that will be required.   Good luck with the project. Brian ... View more