Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About sgoethals
About sgoethals
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
11-12-2020
25Posts
0Likes
3Solutions
Nov 12, 2020Last Visited
User
Activity
User
Profile
Latest posts by sgoethals
| Subject | Views | Posted |
|---|---|---|
| 953 | 11-10-2019 06:32 AM | |
| 1229 | 11-10-2019 06:26 AM | |
| 7671 | 10-20-2019 02:24 AM | |
| 878 | 07-05-2019 11:23 AM | |
| 1332 | 06-28-2019 05:10 AM |
User Badges
Public Statistics
| Date Registered | 06-13-2017 01:09 PM |
| Date Last Visited | 11-12-2020 10:27 AM |
| Total Messages Posted | 29 |
11-10-2019
06:32 AM
Hi All, I have an application override setup and it is working fine. The reason for the override is because we changed the port number of the application to something other than the default. The way I have this setup is I created a customer application and then setup an application override policy. My question deals with the override policy. I have the policy currently pointing to the customer application I created. I understand that by doing this, threat protection is bypassed. Since there is a built-in application for what I want, should I be selecting that instead of the custom application that was created.? My gut says yes. My only hesitation is that the built-in app assumes the original port number and not the one that I need. Will using the build-in application in the policy still allow me to use the non-standard port and achieve threat protection? Thanks in advance...
... View more
11-10-2019
06:26 AM
I need to update my firewall from 8.0.17 to the latest release of 8.1. In the past I was instructed to first upgrade to the base release for the PANOS, and then install the maintenance release on top. Is that still the way it should be done.? If I remember correctly, the base has to be there before you can upgrade to the maintenance release. If this is the case, do you recommend leaving the base in place for awhile before updating to the maintenance release or should it be applied as soon as the base is installed?
... View more
10-20-2019
02:24 AM
I did work with support on this, and they did find that they were identifying the traffic incorrectly. They made a change and released it as a part of their weekly content updates. Since doing this, I haven't had an issue.
... View more
07-05-2019
11:23 AM
Hi Everyone, I have been trying to grasp the whole User-ID concept specifically with WMI and the more I read, the more I am confused. I have a simple setup. I want to be able to use agentless configuration and have it read info from my Domain Controllers. I understand that I need an account with permissions for various groups (event log Readers, Distributed COM, Server Operators). Is this truly all that is needed to be setup? I only ask because I see references to WMIMGMT.MSC and the CIMV2 instance. Do I need to configure this on each domain controller that will be queried by the firewall? I see references to performing these steps if you want to use WMI client probing (which I don't need). My environment is pretty simple. I also have a question about the service account. Some documentation (and videos) show creating a user account that is used for the specific purpose of querying the DC. It resides in an OU and is similar to other user accounts with the exception that it is designed for one purpose, the password never expires, and it is not allowed to logon interactively or remotely. . Other documentations says is should be a Managed Service Account? I used the former method sometime ago, and it works, however, if it's more secure to place it in the Managed Service Accounts container, I will. Lastly do most people use the same service account for both user-id and LDAP? Should they be separate and do they require different permissions? I apologize for all of the questions. Just as I think I have things figured out, I read (or watch) something that discusses completing the steps in another way. Not sure it matters, but my environment is PANOS 8.0.17 and I have Server 2008R2 (eliminating this soon) as well as 2012R2 Domain Controllers. Thanks so much.
... View more
06-28-2019
05:10 AM
Thanks @BPry for the comment. I spend a little more time yestrerday looking at my configuration and found a way to accomplish what I wanted without making a switch of IP addresses. My concern at the time was having a way to revert my changes (without reloading a configuration snapshot) if things didn't work out. I was able to make the changes I needed. I appreciate your comments and opinion.
... View more
06-27-2019
12:14 PM
Thanks @OtakarKlier I appreciate the comment. Remembering that I switched the two shouldn't be a problem. What I will likely do is remove the address object (Machine2) once the older machine is decommissioned. I will also likely rename the address object that is being used in the rules to better describe the machine that is being used. The machines are registered in DNS, but at this time, I am not using the FQDN in the firewall. I may consider this later.
... View more
06-27-2019
11:43 AM
Throwing this out here to see if I maybe creating any issues. I have a machine that is setup in my firewall with an address object. Let's say it's its Machine1 and it's IP is 10.0.0.50. This machine will be decommissioned soon and I have setup another machine that will replace it. Let's say it's Object name is Machine2 and it's address is 10.0.0.60. There are rules setup where the object name Machine1 is used. Rather than modify the existing rules and adding the object Machine2 to them and removing Machine1, can I simply just swap the IP addresses associated with the Object names? This way the rules don't have to be modified and after the commit, they will be applied to the replacement machine. Does anyone see any issues in doing this? I would appreciate any suggestions regarding this.
... View more
06-27-2019
10:57 AM
Thanks for the help @SteveCantwell I first tried to just change the Source Zones from Any to the specific zones I wanted to use. as you suggested. This didn't seem to help. I still received a warning indicating it was shadowing. I then went ahead and added as a source address the regions (based on my address schemes) of 10.0.0.0 - 10.255.255.255 and 192.168.0.0-192.168.255.255. Upon making this change, the validation of the commit worked fine and I was able to sucessfully commit the configuration.
... View more
06-27-2019
02:27 AM
Hi, Recently I upgrades my firewall from PANOS 8.0.10 to 8.0.17. The upgrade went fine. However, after making a small configuration change (adding a new address object), my commit showed a Shadow Rule warning. The warning is associated with a rule that I have that is designed to Deny traffic from ANY zone and ANY application whose destination is the outsize (untrusted) zone with a desitnation address that is identified by Palo's External Dynamic lists "PaloAlto Networks High Risk Addresses" and "PaloAlto Known Malicious IP Addresses" This rule "Block Malicious Sites" is the first security rule that is defined. The warning indicates this rule shadoes anothe rule that is listed further down in my list that allows specific traffic (NTP application) to the outside. While I can move the "Block Malicious Site" rule further down the list, I can't comprehend why it would be considered shadowing. It seems to me the rule targets specific address, essentially those identified in the dynamic list. If it truly were shadowing, I would have thought I would have seen this warning prior to my upgrades from 8.0.10 to 8.0.17. It seems to me that something has changed in the way the firewall evaluated the rules. Has anyone else seen this behavior or have any ideas on what might be happening? I appreciate any input. Thanks,
... View more
06-02-2019
07:42 AM
Thanks for the reply. I ended up opening a case with support regarding this. I sent them some packet captures, and they were able to replicate my issue. They are going to relay this information to their content team and have the signatures updated from ms-update.
... View more
05-29-2019
04:22 AM
Hi Everyone, I have an issue that I haven't been able to resolve. I have a small domain setup with a Windows Server Update Service that is located in a DMZ. The machinges that are in the inside network (trusted), are setup to pull their Windows updates from the server in the DMZ. I have setup Group Policy to make this happend, and it works fine for all of my servers. The issue is that I have a Windows 10 machine that refuses to connect to the WSUS server. The same group policy is applied and when I look at Monitor, I can see attempts to connect to the server over port 8530 ( Default Port), but the traffic is identified at web-browsing instead of ms-update. Since 8530 isn't a standard port for web-browsing, the traffic isn't allowed. I know I could always setup an application override, but I shouldn't have to. I cannot figure out why this particular machines traffic is recognized as web-browsing instead of ms-update. If anyone has any suggestions, I would like to hear them. Thanks
... View more
05-29-2019
04:13 AM
Thanks for the help. Installing the latest agent as you indiciated fixes the issue.
... View more
05-28-2019
08:48 AM
Thank you so much. for the reply Does it matter that I am runing PAN OS 8.0.10 at the moment? What is the rule for different versions of TS Agent and the compatibility with the PAN OS? I thought if I was on the 8.0 branch, I had to stay on the same for TS Agent. I am planning to upgrade to a new version of PAN OS, but I wasn't planning on doing this until after I have my new RDS Server installed.
... View more
05-28-2019
07:19 AM
Hi, I am setting up a new Windows 2016 server that will host RDS. I have installed TS-Agent (8.0.12). No issues installing, however, the service won't start. I am receiving receiving the following: The PAN TS Service failed to start for the following reason: Windows cannot verify the Digital Signature for the file. A recent hardware or softrware change might have installed a file that is installed incorrectly or damaged or might be malicious software from an unknown source. Has anyone else seen this or no of a work-around other than disabling signature checking on files. Thanks for the help.
... View more
09-06-2018
07:24 AM
I was also seeing many of these in my logs. For about 2-3 weeks, I saw many of these, then all of a sudden, they stopped. Not sure what exactly happened and why they suddenly went away.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-12-2020
10:27 AM
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
