About Sec101

Sec101

lookup the vcenter plugin for panorama. Make SURE to note there are a handful of unsupported characters for that plugin- that WILL mess up the entire integration if you use them.....

Sec101

Is there a solution to this, or is this a limitation of this setup? Probably that same would happen if you directly monitored the ESXi host? That is exactly what is happening. It is using a distributed virtual switch, and that is why it's not pulling in the information.

Sec101

bumping this

Sec101

I have successfully turned up our vm information sources monitor on the firewall, but it appears to be missing random data, information, vlans, and networking mostly. I'm wondering if this is in relation to a timeout that is occurring because our VM's are so numerous. How would one confirm this? Almost all of the vm's I can get info on, it's just that it's missing vswitch/port/vlan id info....

Sec101 · ‎03-27-2020

did you ever get an answer on this one?

Sec101 · ‎03-23-2020

would like to know this as well

Sec101 · ‎03-19-2020

It appears possible to configure the firewall to be an OCSP responder to itself/clients from the posts below? Is that correct? (Specifically referring to self-signed certificates generated on the firewall) If so, is there any risk to having this service run on an external interface, in order to control/revoke machine certificates? If the need arises for a certificate revocation, is the firewall responding to itself and not letting the client connect to the portal/gateway, or is the client ultimately making that decision? I'm finding the GP agent will still connect to the Gateway even if I have revoked a generic machine certificate used in the profile for the Gateway. The CA certificate is still good, but If I revoke the machine certificate, and it shows revoked in the firewall, the client can still connect. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIzCAK https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClteCAC

Sec101 · ‎02-24-2020

How many people know about this? - if this is true - O365 environments are not as secure as once thought right now.

Sec101 · ‎02-21-2020

Yes. Decryption is working normally. I should specify, that this is when you click on File/save as/ "download a copy", and try to download it. Correction - only Word docs get blocked, and marked as sharepoint-online-downloading. Both powerpoint and Excel documents come through, and marked as the application sharepoint-online, not sharepoint-online-downloading. Workaround/solution is to block these files in the app sharepoint-online?

Sec101 · ‎02-21-2020

The application sharepoint-online-downloading will catch word docs. However it does not catch excel file downloads. If we block sharepoint-online-downloading - it will bock everything but excel file and powerpoint downloads. I'm not sure why, but excel files and powerpoint come through as the app sharepoint-online ....Why?

Sec101 · ‎02-12-2020

Does this still mean that it's applied to the physical interface overall? - or maybe you don't even have to select the physical interface?

Sec101 · ‎01-29-2020

Interesting. One of the domains was marked as c2. I could still get a resolution on it though. Even though other domains I could confirm were getting sinkholed. So i'm not sure now they are missing that? Either way, Props @OtakarKlier for the good reply on how this works, and how to setup secure DNS services.

Sec101 · ‎01-29-2020

Thank you for the reply. I just don't understand why the palo would allow resolution requests over udp/53 - for known malware domains? - What good is sinkholing if it doesn't sinkhole?

Sec101 · ‎01-29-2020

We are finding that even domains configured as malware/c2 are not getting sinkholed. I'm aware from other posts, that these are not the same database on the firewall. Why are these not persistent? Why would you not flag on a DNS lookup that is out to resolve a malware/c2 domain - and NOT sinkhole it? Is the DNS database something that get's updated with the code release version, and is this why Palo came out with the DNS security service? We have other products that are flagging on domains that are clearly marked as malware- but palo is letting them resolve.

Sec101 · ‎01-28-2020

commenting to follow

Sec101 · ‎01-26-2020

I've found some other odd behavior with HIP checks as well, as it relates to registering/not registering to windows. I am not surprised you are having an issue with this. By chance, have you checked with the actual AV vendor to ensure that their product is registered and reporting to windows security center? I'm guessing this may have something to do with the way GP is trying to grab the info from windows itself, and not the vendor.

Sec101 · ‎01-15-2020

bump

Sec101 · ‎01-14-2020

How are you identifying Apple Mac devices/making sure they are part of your organization before letting them connect through Global Protect? We have an MDM - that joins our MACs, but the User ID-MDM integration is proving to be a bit more difficult than I had plannned. Are most of you using a certificate that is exported to a machine, and or verifying plists on the device? Is there a better more common way to verify Apple MACs are part of your organization?

Sec101 · ‎12-31-2019

When I try to populate the drop down for HIP notifications on the gateway, it comes up blank. All firewalls are panorama managed, but for whatever reason, I can't get this box (while on panorama) to populate with any of the current HIP profiles/objects I've created. Just looking to create a notification through a panorama defined gateway. Is this possible?

Sec101 · ‎12-12-2019

Is this only in a situation where you have a single firewall? If the objects sync inbetween active/passive firewalls, as long as you have one active, that knows about the objects you should be ok right? ps-Thank you for the reply Reaper.

Sec101 · ‎12-11-2019

It appears that these are synchronized through HA, but do IP address objects registered/populated to a Tag through the API survive a reboot?

Sec101 · ‎12-10-2019

Turns out the backend is mostly Windows. Terminal services agent it is. Hoping this solves the problem.

Sec101 · ‎12-09-2019

@adeliomoreira I would like to know this as well. It appears that the wl - indication works exactly opposite of what you would expect in this scenario?

Sec101 · ‎12-08-2019

let me check and get back to you on the exact application here. Should have the answer shortly. Thank you for the quick reply!

Sec101 · ‎12-07-2019

How are others monitoring their Vmware view / horizon environments for user-id? I see there is a terminal services agent you can use, (looks like you can only install on windows and citrix) but I haven't found specifics on actually monitoring the vmware view environment/and what permissions that account would need in vmware. Can anyone point me in the right direction for monitoring a vmware view environment for user-id? There is a vm information sources area, but I'm thinking that that is only for obtaining VM tags for use in security policy and DAG - NOT for user-id user to ip mapping specifically. The below link talks about it - but doesn't give clear direction on how/what to look at for vdi view environments: https://www.paloaltonetworks.com/solutions/initiatives/virtual-desktop-infrastructure

Sec101 · ‎12-06-2019

do you have Collect HIP data - check mark box in your agent config on your portal?

Sec101 · ‎12-06-2019

Nope, just set up some HIP checks checking against internal programs, which definitely worked. I wonder if there is a grace period after one of these license expire?

Sec101 · ‎12-06-2019

running this cmd - rundll32.exe keymgr.dll, KRShowKeyMgr I do not show mine stored, however, I'm not saving credentials either - only username.

Sec101 · ‎12-02-2019

I thought that HIP check licensing expiration (trial version), would cause any rules on the FW - using a HIP check profile column to not match. Instead, it appears that it causes the firewall to simply not care about that column at all.... and allow traffic through, on the rule with the HIP check profile specified, even if you are out of compliance. Do others have experience with this? I guess this makes sense, just expected different behavior.

Sec101 · ‎11-19-2019

@MickBall Thanks for all the replies. Definitely a help to the community! Thank you!! I would say this problem is solved.

Date Registered	‎04-03-2017 11:53 AM
Date Last Visited
Total Messages Posted	158
Total Likes Received	9

Strata

Prisma

Cortex

About Sec101