This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About bradk14
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About bradk14
07-24-2019
91Posts
29Likes
12Solutions
Jul 24, 2019Last Visited
User
Activity
User
Profile
Latest posts by bradk14
| Subject | Views | Posted |
|---|---|---|
| 1597 | 09-27-2017 08:21 AM | |
| 3677 | 05-14-2017 03:01 AM | |
| 2724 | 05-05-2017 02:15 PM | |
| 2968 | 05-03-2017 07:49 AM | |
| 3150 | 05-03-2017 06:57 AM | |
| 2875 | 05-01-2017 07:01 AM | |
| 1731 | 04-27-2017 07:09 AM | |
| 2046 | 04-27-2017 02:39 AM | |
| 3068 | 04-27-2017 02:35 AM | |
| 1485 | 04-26-2017 02:39 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 04-10-2017 11:01 AM | |
| 1 Like | 04-12-2017 08:14 AM | |
| 1 Like | 05-14-2017 03:01 AM | |
| 1 Like | 05-01-2017 07:01 AM | |
| 1 Like | 04-27-2017 07:09 AM |
User Badges
Community Statistics
| Member Since | 03-23-2017 07:51 AM |
| Date Last Visited | 07-24-2019 01:28 AM |
| Posts | 91 |
| Total Likes Received | 29 |
09-27-2017
08:21 AM
Just curious if anyone has any knowledge of an existing tool to check for compliance with the CIS recommendations for Palo Alto firewalls? https://www.cisecurity.org/benchmark/palo_alto_networks/ I'm considering authoring in PHP and using the API to see as far as I can get with it, but obviously if there's already a solution available, no point in reinventing the wheel. Thank you
... View more
05-14-2017
03:01 AM
1 Kudo
since this thread exists, an emergency update 698 was released yesterday, which I believe changed the default for CVE-2017-0144 and CVE-2017-0146 to reset-both. but if your vulnerability protection profile always reset for critical, it's moot. only if you're using default should you ensure you are current.
... View more
05-05-2017
02:15 PM
it puts 1/1 and 1/2 into a vwire group. so if you were a soho, you could plug your router into 1/1 and your trusted switch into 1/2.
... View more
05-03-2017
07:49 AM
you are correct. I completely reversed the policies. I confused myself. apologies.
... View more
05-01-2017
07:01 AM
1 Kudo
on demand is via sms/email. out of hardware, software and oda, it's the chepeast and most versatile option (I've managed all 3).
... View more
04-27-2017
07:09 AM
1 Kudo
the solution is to have your WLC or RADIUS server or whathaveyou to send syslog messages to the PA/UID Agent to map usernames with IPs https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/user-id/configure-user-id-to-receive-user-mappings-from-a-syslog-sender.html
... View more
04-27-2017
02:39 AM
FWIW, in my experience, WMI probing has more issues than just making sure the endpoint can reply. I've actually had multiple PA TAC engineers/SE tell me not to use it at all. basically what I noticed early on was that the logs were filled with reports of WMI queue being full so it was no longer queing, which effectively makes it futile.
... View more
04-27-2017
02:35 AM
1 Kudo
this sounds like normal behavior to me based on my experience with RSA SecurID (not with GP, though). MFA doesn't necessarily mean multiple prompts, it just means something you know (PIN) + something you have (one time password). the only time I've seen SecurID act like I believe you're expecting it to is with on demand authentication in which one first enters their PIN, then receives the one time password via email or text, so there has to be a second prompt for that.
... View more
04-26-2017
02:39 PM
I see you already have your answer, but also for future reference, the two most important CLI commands (IMHO): set cli config-output-format set and find command keyword <keyword> altho you do need to be mindful on both whether you're in configure mode or not.
... View more
04-26-2017
10:13 AM
that sounds like what I was advising earlier (except I forgot the setup tab part). this will effectively undo any changes you made since the last commit.
... View more
04-25-2017
05:14 PM
1 Kudo
I doubt TAC will touch a 7.0.6 install. the first thing they're going to recommend is upgrading to a newer version like 7.0.15, whether it's a known issue or not.
... View more
04-25-2017
05:11 PM
is that specifically what you are trying to do? cancel a commit job being queued? if so, yes, 7.1. prior to that, you couldn't commit when a commit was already in progress, it would just error out. if you are trying to revert changes to the candidate config that have not yet been committed to the running config, you can do that through device -> operations -> revert to running config.
... View more
04-25-2017
08:12 AM
1 Kudo
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/app-id/create-an-application-filter
... View more
04-24-2017
04:33 PM
1 Kudo
an ASA 70 line ACL probably means no more than 15 policies in PA. Personally I would just convert them myself manually in the GUI (and have). https://live.paloaltonetworks.com/t5/Migration-Tool-Articles/Download-the-Migration-Tool/ta-p/56582 also I don't believe all those commands, like setting source user to any is necessary. also it's generally considered good practice to only log at session end. logging at session start is usually done only for troubleshooting purposes (you can reference the session browser prior to the session's termination)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-24-2019
01:28 AM
|
Likes From
| User | Likes Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 2 | |
| 3 |
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks