Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
About Nikolay-Matveev
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About Nikolay-Matveev
12-11-2020
19Posts
5Likes
1Solution
Dec 11, 2020Last Visited
User
Activity
User
Profile
Latest posts by Nikolay-Matveev
| Subject | Views | Posted |
|---|---|---|
| 391 | 10-30-2020 08:08 AM | |
| 439 | 10-25-2020 06:10 PM | |
| 618 | 10-21-2020 10:53 AM | |
| 883 | 10-21-2020 09:11 AM | |
| 647 | 10-21-2020 08:43 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-25-2020 06:10 PM | |
| 1 Like | 10-21-2020 10:53 AM | |
| 1 Like | 09-11-2020 06:02 AM | |
| 1 Like | 05-27-2020 10:04 AM | |
| 1 Like | 09-11-2017 07:52 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 4 Likes | |||
| 1 Like | |||
| 7 Likes |
User Badges
Community Statistics
| Member Since | 11-22-2016 04:15 AM |
| Date Last Visited | 12-11-2020 04:06 AM |
| Posts | 19 |
| Total Likes Received | 5 |
10-30-2020
08:08 AM
Yes, please - post the outcome here. vwire deployments are always a good fun
... View more
10-25-2020
06:10 PM
1 Kudo
So, if your original [internet switches (VSS pair)] <> [Cisco ASR] link is LACP, then when you introduce a Palo firewall you do not have to build AE-based v-wire. Just create several "single-legged" v-wires. In such configuration Palo will pass-through LACP control frames and thus the new firewall will be completeley transparent to the internet switches and the ASR, and thus you won't have to change anything on them. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHTCA0 You also need to make sure you specify tags of all VLANs that you want to allow on that link. By default you have only 0 that means only untagged traffic (all tagged frames will be dropped).
... View more
10-21-2020
10:53 AM
1 Kudo
It might be a viable idea with DNS... You can even bypass the DNS altogether and produce different blockpages on the webserver itself (diffirentiating users by the source IP) or use a load balancer/ADC for the same very purpose - to direct users to relevant page based on their IP address (= Zone)...
... View more
10-21-2020
09:11 AM
Answering my own question for the record... It appeared to be easy to upload a certificate directly to the firewall - it's just a matter of constructing a correctly formatted MIME message. It must be a POST request with Content-type header set to multipart/form-data; boundary=<random tag>, followed by Content-length set to the length of the form data. Form data has to be constructed along these lines (Python): form = '--'+<the_boundary_tag>+'\r\n'+'Content-Disposition: form-data; name="file"; filename="certificate.cer"\r\n'+'Content-Type: application/octet-stream\r\n\r\n' form = form+cert_body+'\r\n' form = form+'--'+<the_boundary_tag>+'--\r\n' cert_body here is a plain string with Base64/PEM-encoded certificate. Form data has also be encoded as UTF-8 before referencing from the actual request object. For example like this: form_binary = form.encode('utf-8') req = Request(url, form_binary) URL in its turn may be constructed like 'https://'+fwAddress+'/api/?type=import&category=certificate&certificate-name='+quote(cert_name,safe='<>[]=')+'&format=pem&key='+key I hope this help and saves somebody's time from reverse engineering Curl requests...(which is what I had to do to overcome the scarce API docs on this topic :))
... View more
10-21-2020
08:43 AM
Gareth, What you can do is create separate block rules based on source zones and then in the response page create a basic client-side JavaScript that would be adjusting parts of the response page depending on the name of the block rule that was hit. There is a valiable called <rulename/> - use it in the JavaScript. Unfortunately this is going to work well only for blocks invoked via Deny action set as the rule action. If you block based on a URL-profile then things become more complicated and for that you may need to resort to creating multiple VSYSes...
... View more
10-14-2020
02:12 AM
@Spongerius @RandallLoux Did you succeed with this eventually? I need to do the same but struggle with uploading a cert even directly to the firewall. Can you share a snippet of code? API documentation is exteremely scarce in this regard...
... View more
10-02-2020
02:05 AM
Spoke to TAC (the engineer said he had been unable to reproduce), reproduced the issue for him, then we removed spaces from cert name and subject - the issue was gone, re-added the spaces - the issue did NOT re-occur. There must have been something else, very subtle, that trigerred the error. We'll keep playing with this and update this thread if manage to discover anything...
... View more
10-01-2020
03:51 PM
I am trying to export a CSR via XML API as per this article and as per /debug output that I get when I perform the export via Web UI. The request I run is as follows: https://<fw-address>/api/?type=export&category=certificate&certificate-name=<cert-name>&format=pkcs10&include-key=no&key=<api_key> However this does not quite work - I get an error message that says: Failed to prepare CSR <cert-name> for export. PKCS10 format can only be used with CSRs and not certificates. I have now run out of ideas what it does not like in the request. The article explicitely says - "You can use the example above to export a certificate signing request (CSR). If you do so, then specify the following two parameters as shown: format - pkcs10, include-key - no" and this is exactly what I am doing. The debug out for a succefull operation suggests the same syntax: <request cmd="op" cookie="1001040547321532">
<operations xml="yes">
<download>
<certificate>
<certificate-name>cert-name</certificate-name>
<format>pkcs10</format>
<include-####censored 'key''####
[2020/10/01 23:06:58] user=1001040547321532
Response took 0.040s <response status="success"><result><content encoding="base64"> <---encoded csr goes here-->
]]></content></result></response> Has anybody has an idea about the correct format of the request?
... View more
09-14-2020
03:38 AM
(it should be off, otherwise, logically, the firewalls should be querying the agents for UserID info on public IPs too, which would produce WMI queries if the relevant option is enabled...)
... View more
09-14-2020
03:36 AM
Good point about WMI probing... Perhaps I am too used to have it switched off in my environment 🙂 Do you have UserID switched off for the Internet zone on the firewalls?
... View more
09-14-2020
03:10 AM
KB article about what exactly? About raising a case? Just call the TAC or do it online on the support portal. Quote the application name and give your reasoning as to why a characteristic should be changed.
... View more
09-11-2020
06:46 AM
Yes, you can do this but only via CLI or API, there is no UI option. In the CLI the command would be show predefined application <application name> However the best way to do this would be to put together a quick Python script and pull this via the REST API. I actually needed to do the same and may find some time over the next few days to have this data exported into a pretty XLS...
... View more
09-11-2020
06:21 AM
No, you cannot. Though you can raise it with TAC and they will have a characteristic (SaaS or whatever else) assigned to an application if they believe this should be the case...
... View more
09-11-2020
06:14 AM
Start with disabling NetBIOS in TCP/IP parameters on the UID agents (Control Panel > Network Connections > your connection > Properties > TCP/IPv4 > Advanced > WINS > Disable NetBIOS over TCP/IP). Unless you do use it in your network of course... (but I cannot think of a good reason to do so these days to be honest).
... View more
09-11-2020
06:02 AM
1 Kudo
We have ended up with an EDL where we place the URLs that produce the likes of Chrome's ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY error. This EDL in its turn is used in a decryption rule with "Strip ALPN" option ticked in the decryption profile, and that rule is placed above our default decryption rule. Thus we still decrypt all these sites but downgrade them to HTTP1.1 - is not a big deal. We have ~13K web users and so far discovered only a handful of misbehaving websites... running 9.0.x. Hope this helps.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-11-2020
04:06 AM
|
Latest Tags
No tags yet
Likes From
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
