About ADK999

ADK999

hey holger, nothing changed. it's one of the things where pan is a bit out of touch with reality, also ipv6 dhcp client on a interface is to new... i migrated the small office branches partial to sophos and if not possible to paloalto and a draytek vigor 165 vdsl modem. servus, andy

ADK999 · ‎04-10-2019

here there, little question: any known plan's to support PPPoE on a subinterface? reason: since fiber to the building (FTTB) isn't something usual over here, we are stuck with xDSL (FTTC) for the years to come. and this is where we have a problem with our pa2x0 installations right now, because pan-os doesn't support PPPoE on a subinterface (a common thing with VDSL). right now there are 4 possible solutions for this missing feature (as far as i know) 1) waste a few interfaces (http://www.limvuihan.com/2018/06/palo-alto-pppoe-with-vlan-tag-its.html) 2) let a switch do the tagging (kinda like 1) 3) get a xdsl modem that is able to do the tagging 4) get a router that does all the internet connection stuff (downside: public ip is on the routers side and one more nat router-> pa) all those workarounds are kinda meeee... with 3 being the most common one, but this also includes the need to configure the vlan tag on the modems side (different vlan tags depending on the isp) thanks in advance, andy

ADK999 · ‎08-15-2018

@jsalmans wrote: Since you generally own the cert and servers with Inbound then you could always make them use TLS 1.2 but if your server team wanted to implement 1.3 wouldn't the firewall still be able to decrypt with the cert installed? indeed, if the firewall works as endpoint (tunnel must be terminated at the firewall). as far i understand 1.3: passive decrypting (virtual wire decryption for an example) with the private key won't work anymore since all connections are PFS crypted. but my problem is more about the outbound connections. how shall we prevent business senstive data leaks or detect malicious streams if anything is just "ssl"? the good side from 1.3, it prevents nsa, gchq and mossad from spying on us, (let's assume the is no willingly coded backdoor in pan systems) as long the is no direct access to client or server (pfs debug keys), but this also is a major issue for network based security.

ADK999 · ‎08-14-2018

hey there, since tls 1.3 is now a ietf standard, is there any use running ssl-decryption in the close future? as far i understand 1.3 documents, it "looks like" 1.2 for the firewall, so there's no way to just block 1.3 and force both parties to downgrade to 1.2, or i'm wrong? any news/tech docs from pan about the 1.3 "issue"? so long o/

ADK999 · ‎08-30-2017

hello there, since searching the internet didn't help, and even my business partner can't help me, i'll drop a line here. aren't there any small home lab licenses for traps avaliable? the smallest package i got from my partner was 200 for about 15.000€, and i don't know why, but i don't fell like going for that. something about 5 licenses for a lab price? i already have a pa-220 at home for gaining and keeping knowledge, it would also be great to have traps for this, since i have a hard time to tell my colleagues what's the benefits of traps compared to our av-solution right now. at least i stopped falling for shiny sales papers 😉 thanks in andvance, andy

Date Registered	‎06-06-2017 05:31 AM
Date Last Visited	2 weeks ago
Total Messages Posted	5
Total Likes Received	2

Online Status	Offline
Date Last Visited	2 weeks ago

About ADK999

Re: PPPoE Support on a Subinterface (VDSL VLAN Tagging)

PPPoE Support on a Subinterface (VDSL VLAN Tagging)

Re: so TLS 1.3 got IETF branded

so TLS 1.3 got IETF branded

Traps for Home Lab?

Re: PPPoE Support on a Subinterface (VDSL VLAN Tagging)

PPPoE Support on a Subinterface (VDSL VLAN Tagging)

Re: so TLS 1.3 got IETF branded

so TLS 1.3 got IETF branded

Traps for Home Lab?

PPPoE Support on a Subinterface (VDSL VLAN Tagging)

Re: PPPoE Support on a Subinterface (VDSL VLAN Tagging)

Re: so TLS 1.3 got IETF branded

Strata

Prisma

Cortex

About ADK999