About Nikolay-Matveev

Yes, please - post the outcome here. vwire deployments are always a good fun ... View more

So, if your original [internet switches (VSS pair)] <> [Cisco ASR] link is LACP, then when you introduce a Palo firewall you do not have to build AE-based v-wire. Just create several "single-legged" v-wires. In such configuration Palo will pass-through LACP control frames and thus the new firewall will be completeley transparent to the internet switches and the ASR, and thus you won't have to change anything on them. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHTCA0  You also need to make sure you specify tags of all VLANs that you want to allow on that link. By default you have only 0 that means only untagged traffic (all tagged frames will be dropped). ... View more

It might be a viable idea with DNS... You can even bypass the DNS altogether and produce different blockpages on the webserver itself (diffirentiating users by the source IP) or use a load balancer/ADC for the same very purpose - to direct users to relevant page based on their IP address (= Zone)...  ... View more

Answering my own question for the record...   It appeared to be easy to upload a certificate directly to the firewall - it's just a matter of constructing a correctly formatted MIME message. It must be a POST request with Content-type header set to multipart/form-data; boundary=<random tag>, followed by Content-length  set to the length of the form data. Form data has to be constructed along these lines (Python): form = '--'+<the_boundary_tag>+'\r\n'+'Content-Disposition: form-data; name="file"; filename="certificate.cer"\r\n'+'Content-Type: application/octet-stream\r\n\r\n' form = form+cert_body+'\r\n' form = form+'--'+<the_boundary_tag>+'--\r\n' cert_body here is a plain string with Base64/PEM-encoded certificate. Form data has also be encoded as UTF-8 before referencing from the actual request object. For example like this: form_binary = form.encode('utf-8') req = Request(url, form_binary) URL in its turn may be constructed like 'https://'+fwAddress+'/api/?type=import&category=certificate&certificate-name='+quote(cert_name,safe='<>[]=')+'&format=pem&key='+key I hope this help and saves somebody's time from reverse engineering Curl requests...(which is what I had to do to overcome the scarce API docs on this topic :)) ... View more

Gareth,   What you can do is create separate block rules based on source zones and then in the response page create a basic client-side JavaScript that would be adjusting parts of the response page depending on the name of the block rule that was hit. There is a valiable called <rulename/> - use it in the JavaScript.   Unfortunately this is going to work well only for blocks invoked via Deny action set as the rule action. If you block based on a URL-profile then things become more complicated and for that you may need to resort to creating multiple VSYSes... ... View more