LIVEcommunity - About s_quasar

s_quasar · ‎11-14-2019

I want to consider that if an IP make traceroute, this is the first step to do other bad activities on my infrastructure so I want to block it (and not deny) before it can attempt to infiltrate in my network.

s_quasar · ‎11-13-2019

Hi, no, I want to block IP not deny like in reconnaissance in zone protection or in vulnerability protection that you can create a custom rule with 3600 seconds block IP.

s_quasar · ‎11-12-2019

I supposed this. Maybe I can see specific IP attacker and victim because before I activeted a classified rule (now is aggregate). See the IPs is very useful because I can check in other websites if it is a bad or good IP. Maybe I can use an aggregate rule as a test and than activete again a classified rule.

s_quasar · ‎11-12-2019

Hi all, I have set up a dos rule from outside to my server zone. Why sometimes I can see attacker and victim IP and sometimes not?

s_quasar · ‎11-12-2019

Hi all, is there a way to block IP source if I match traceroute App-ID? Maybe with a custom vulnerability?

s_quasar · ‎11-04-2019

What have I to see in the column Type?

s_quasar · ‎11-01-2019

Is there a way to view in monitor spoofed IPs?

s_quasar · ‎11-01-2019

Hi all, dos protection rule can override zone protection? I have a zone protection activated for OUTSIDE and a policy in dos protection from OUTSIDE to INSIDE. In zone protection there are specific features (like ip spoofed) that are not present in dos protection and I want to apply all my rules.

s_quasar · ‎10-30-2019

I've checked now the configuration. Now I can view all the IPs in GUI. Maybe as you say I've checked the list before apply the rule. Thanks.

s_quasar · ‎10-30-2019

@michelealbrigo thanks a lot for you help. If you have a little bit of time can you take a look at these my other problems? (especially about log forwading) https://live.paloaltonetworks.com/t5/General-Topics/log-to-Kiwi-Syslog/m-p/293687 https://live.paloaltonetworks.com/t5/General-Topics/Decryption-policy-and-SNI/m-p/293676 You help is very appreciated

s_quasar · ‎10-30-2019

I have set up the policy but still not presence of IPs in GUI

s_quasar · ‎10-29-2019

Yes that's the problem I meant. Do you know some good lists to use for blocking malicious IPs? I found http://plonkatronix.com/plonkatronixBL.txt and this URL https://panwdbl.appspot.com/ (I'm investiganting about this).

s_quasar · ‎10-28-2019

I thought it was enough to insert the EDL instead we also need the security rule. Thaks a lot! Only one last question. Why in the standard Paloalto EDL do you see all the IPs in detail, while in my personalized rules I don't see IPs? In this manner I can't insert any exceptions.

s_quasar · ‎10-28-2019

How can I use it in a policy? In which part of configuration have I to enter?

s_quasar · ‎10-28-2019

Hi, I have a rule with many denies IPs. Is maybe for this reason? Have I to create a special policy for EDL?

Member Since	‎11-15-2016 06:31 AM
Date Last Visited	‎06-04-2020 09:42 AM
Posts	59
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎06-04-2020 09:42 AM

Re: Block traceroute

Re: Block traceroute

Re: TCP / UDP Flood

TCP / UDP Flood

Block traceroute

Re: SSL application undefined in monitor

Re: Block traceroute

Re: Block traceroute

Re: TCP / UDP Flood

TCP / UDP Flood

Block traceroute

Re: Monitor spoofed IPs

Monitor spoofed IPs

Zone protection and Dos Protection

Re: EDL problem

Re: EDL problem

Re: EDL problem

Re: EDL problem

Re: EDL problem

Re: EDL problem

Re: EDL problem

Network Security

Cloud Security

Security Operations