About bradk14

bradk14 · ‎09-27-2017

Just curious if anyone has any knowledge of an existing tool to check for compliance with the CIS recommendations for Palo Alto firewalls? https://www.cisecurity.org/benchmark/palo_alto_networks/ I'm considering authoring in PHP and using the API to see as far as I can get with it, but obviously if there's already a solution available, no point in reinventing the wheel. Thank you

bradk14 · ‎05-14-2017

since this thread exists, an emergency update 698 was released yesterday, which I believe changed the default for CVE-2017-0144 and CVE-2017-0146 to reset-both. but if your vulnerability protection profile always reset for critical, it's moot. only if you're using default should you ensure you are current.

bradk14 · ‎05-05-2017

it puts 1/1 and 1/2 into a vwire group. so if you were a soho, you could plug your router into 1/1 and your trusted switch into 1/2.

bradk14 · ‎05-03-2017

you are correct. I completely reversed the policies. I confused myself. apologies.

bradk14 · ‎05-03-2017

--- removed ---

bradk14 · ‎05-01-2017

on demand is via sms/email. out of hardware, software and oda, it's the chepeast and most versatile option (I've managed all 3).

bradk14 · ‎04-27-2017

the solution is to have your WLC or RADIUS server or whathaveyou to send syslog messages to the PA/UID Agent to map usernames with IPs https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/user-id/configure-user-id-to-receive-user-mappings-from-a-syslog-sender.html

bradk14 · ‎04-27-2017

FWIW, in my experience, WMI probing has more issues than just making sure the endpoint can reply. I've actually had multiple PA TAC engineers/SE tell me not to use it at all. basically what I noticed early on was that the logs were filled with reports of WMI queue being full so it was no longer queing, which effectively makes it futile.

bradk14 · ‎04-27-2017

this sounds like normal behavior to me based on my experience with RSA SecurID (not with GP, though). MFA doesn't necessarily mean multiple prompts, it just means something you know (PIN) + something you have (one time password). the only time I've seen SecurID act like I believe you're expecting it to is with on demand authentication in which one first enters their PIN, then receives the one time password via email or text, so there has to be a second prompt for that.

bradk14 · ‎04-26-2017

I see you already have your answer, but also for future reference, the two most important CLI commands (IMHO): set cli config-output-format set and find command keyword <keyword> altho you do need to be mindful on both whether you're in configure mode or not.

bradk14 · ‎04-26-2017

that sounds like what I was advising earlier (except I forgot the setup tab part). this will effectively undo any changes you made since the last commit.

bradk14 · ‎04-25-2017

I doubt TAC will touch a 7.0.6 install. the first thing they're going to recommend is upgrading to a newer version like 7.0.15, whether it's a known issue or not.

bradk14 · ‎04-25-2017

is that specifically what you are trying to do? cancel a commit job being queued? if so, yes, 7.1. prior to that, you couldn't commit when a commit was already in progress, it would just error out. if you are trying to revert changes to the candidate config that have not yet been committed to the running config, you can do that through device -> operations -> revert to running config.

bradk14 · ‎04-25-2017

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/app-id/create-an-application-filter

bradk14 · ‎04-24-2017

an ASA 70 line ACL probably means no more than 15 policies in PA. Personally I would just convert them myself manually in the GUI (and have). https://live.paloaltonetworks.com/t5/Migration-Tool-Articles/Download-the-Migration-Tool/ta-p/56582 also I don't believe all those commands, like setting source user to any is necessary. also it's generally considered good practice to only log at session end. logging at session start is usually done only for troubleshooting purposes (you can reference the session browser prior to the session's termination)

bradk14 · ‎04-24-2017

was it working for a while and then went to the portal? it may be that the association timed out and a WMI probe or a security related event didn't occur within that timeout time frame.

bradk14 · ‎04-24-2017

is it possible you don't have all of the AD servers defined in the UID agent?

bradk14 · ‎04-21-2017

performing my favorite trick of configuring in the GUI, then checking the config in the CLI in set mode, it looks like the following to me: set network tunnel ipsec XXX auto-key proxy-id YYY protocol any set network tunnel ipsec XXX auto-key proxy-id YYY local ZZZ/Z set network tunnel ipsec XXX auto-key proxy-id YYY remote ZZZ/Z but it looks like it can all be combined in a single line like you expressed. set network tunnel ipsec XXX auto-key proxy-id YYY protocol any local ZZZ/Z remote ZZZ/Z

bradk14 · ‎04-21-2017

there is no 8.1, the current version is 8.0.1 and I don't believe you'll have much luck finding anyone encouraging you to update to it just yet, although it does appear to be fairly stable. I'd recommend going to 7.1.9 and you shouldn't have an issue if the other end is on a PA with 7.1.x, as one side is always going to be a lesser version until they're all upgraded.

bradk14 · ‎04-20-2017

honestly, I'd strongly consider just rebuilding them manually within PA. nothing automated as far as I'm aware, but I'm sure it's technically possible with the API. Even the migration utility skips VPN migration, in part because by default the pre-shared key is masked when submitting the show run.

bradk14 · ‎04-20-2017

@Brandon_Wertzapologies if my point wasn't clear. I'm not disparaging or questioning the use of multiple providers, I was just trying to streamline the question. Whether you have 1, 2, 3 or 5 or more ISPs, the process should be the same. You shouldn't have to rely on each PA in an HA pair to be responsible for a single ISP connection, especially when you are setting out to have an Active/Active configuration just to accomplish it. The process should be the same for as many external connections as you may have and that's to use that switch before the firewall to be able to 'split' the connections and leave the passive firewall's ports disabled.

bradk14 · ‎04-20-2017

if it's possible, I haven't figured it out. best advice I can find is to add the description column so it's displayed in the policy list and just visually identify any rules that don't say 'none' in that column

bradk14 · ‎04-19-2017

if I am understanding the question, we can actually simplify it to a single ISP. I mean basically you want each firewall to be able to leverage having two available ISPs, correct? in that case, your approach would be the same as asking how you would configure a single ISP to work with a firewall pair in HA. and I believe the response would be to have an intermediate switch (or two depending on your desire for switch HA), so that the ISP is plugged into one port and each PA is plugged into another port (for a total of 3), and then just scale that up for 2 ISPs (likely private VLANs on the switch for each set of 3 ports). if that makes sense. i've had a day, so my brain is fried anyway. that's my excuse. ETA: You will be warned and very well educated to try to avoid putting PA in active/active unless absolutely mandatory, such as in the case of resolving asymetric routing issues.

bradk14 · ‎04-19-2017

if there is a way in the GUI, I can't think of it. my gut response would be to use the CLI. and basically execute the following: admin@PA-220> set cli config-output-format set admin@PA-220> configure Entering configuration mode [edit] admin@PA-220# show rulebase security | match disable-server-response-inspection set rulebase security rules test option disable-server-response-inspection yes so in the above example, the only rule that has DSRI set is the rule cryptically named 'test'

bradk14 · ‎04-19-2017

okay, sorry, you had me confused as you said untrusted interface which I took to generally be the internet.

bradk14 · ‎04-19-2017

forgive me if I'm way off base here or missed something, but just taking a step back... is the trusted IP a public IP? or do you have a destination NAT rule configured so that the outside can reach it? is your security policy configured correctly? i.e., post NAT security zones (which sounds correct), but pre-NAT IPs (so your destination IP should be the inside IP, not the public IP). Can you share your NAT and Security policies?

bradk14 · ‎04-19-2017

I believe the redirect was just an example. you have all of javascript at your disposal (assuming the client browser is running javascript), so you can make it as complex or as simple as you wish. but if you do take the redirect approach, yes, you'd have to provide your own server/sever side scripting.

bradk14 · ‎04-18-2017

it wouldn't be free, but probably the easiest approach is to install a PA VM in AWS and just pay for the time it's running.

bradk14 · ‎04-18-2017

right in the lower right hand corner is an option to change the number of entries shown per page

bradk14 · ‎04-18-2017

if you want to create policy based on full URLs, you need to have SSL decryption in place.

Date Registered	‎03-23-2017 07:51 AM
Date Last Visited	‎07-24-2019 01:28 AM
Total Messages Posted	91
Total Likes Received	28

Online Status	Offline
Date Last Visited	‎07-24-2019 01:28 AM

Strata

Prisma

Cortex

About bradk14