Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About sgoethals
About sgoethals
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
03-31-2020
25Posts
0Likes
3Solutions
Mar 31, 2020Last Visited
User
Activity
User
Profile
Latest posts by sgoethals
| Subject | Views | Posted |
|---|---|---|
| 593 | 11-10-2019 06:32 AM | |
| 834 | 11-10-2019 06:26 AM | |
| 4113 | 10-20-2019 02:24 AM | |
| 698 | 07-05-2019 11:23 AM | |
| 950 | 06-28-2019 05:10 AM |
User Badges
Public Statistics
| Date Registered | 06-13-2017 01:09 PM |
| Date Last Visited | 03-31-2020 03:12 AM |
| Total Messages Posted | 29 |
11-10-2019
06:32 AM
Hi All, I have an application override setup and it is working fine. The reason for the override is because we changed the port number of the application to something other than the default. The way I have this setup is I created a customer application and then setup an application override policy. My question deals with the override policy. I have the policy currently pointing to the customer application I created. I understand that by doing this, threat protection is bypassed. Since there is a built-in application for what I want, should I be selecting that instead of the custom application that was created.? My gut says yes. My only hesitation is that the built-in app assumes the original port number and not the one that I need. Will using the build-in application in the policy still allow me to use the non-standard port and achieve threat protection? Thanks in advance...
... View more
11-10-2019
06:26 AM
I need to update my firewall from 8.0.17 to the latest release of 8.1. In the past I was instructed to first upgrade to the base release for the PANOS, and then install the maintenance release on top. Is that still the way it should be done.? If I remember correctly, the base has to be there before you can upgrade to the maintenance release. If this is the case, do you recommend leaving the base in place for awhile before updating to the maintenance release or should it be applied as soon as the base is installed?
... View more
10-20-2019
02:24 AM
I did work with support on this, and they did find that they were identifying the traffic incorrectly. They made a change and released it as a part of their weekly content updates. Since doing this, I haven't had an issue.
... View more
07-05-2019
11:23 AM
Hi Everyone, I have been trying to grasp the whole User-ID concept specifically with WMI and the more I read, the more I am confused. I have a simple setup. I want to be able to use agentless configuration and have it read info from my Domain Controllers. I understand that I need an account with permissions for various groups (event log Readers, Distributed COM, Server Operators). Is this truly all that is needed to be setup? I only ask because I see references to WMIMGMT.MSC and the CIMV2 instance. Do I need to configure this on each domain controller that will be queried by the firewall? I see references to performing these steps if you want to use WMI client probing (which I don't need). My environment is pretty simple. I also have a question about the service account. Some documentation (and videos) show creating a user account that is used for the specific purpose of querying the DC. It resides in an OU and is similar to other user accounts with the exception that it is designed for one purpose, the password never expires, and it is not allowed to logon interactively or remotely. . Other documentations says is should be a Managed Service Account? I used the former method sometime ago, and it works, however, if it's more secure to place it in the Managed Service Accounts container, I will. Lastly do most people use the same service account for both user-id and LDAP? Should they be separate and do they require different permissions? I apologize for all of the questions. Just as I think I have things figured out, I read (or watch) something that discusses completing the steps in another way. Not sure it matters, but my environment is PANOS 8.0.17 and I have Server 2008R2 (eliminating this soon) as well as 2012R2 Domain Controllers. Thanks so much.
... View more
06-28-2019
05:10 AM
Thanks @BPry for the comment. I spend a little more time yestrerday looking at my configuration and found a way to accomplish what I wanted without making a switch of IP addresses. My concern at the time was having a way to revert my changes (without reloading a configuration snapshot) if things didn't work out. I was able to make the changes I needed. I appreciate your comments and opinion.
... View more
06-27-2019
12:14 PM
Thanks @OtakarKlier I appreciate the comment. Remembering that I switched the two shouldn't be a problem. What I will likely do is remove the address object (Machine2) once the older machine is decommissioned. I will also likely rename the address object that is being used in the rules to better describe the machine that is being used. The machines are registered in DNS, but at this time, I am not using the FQDN in the firewall. I may consider this later.
... View more
06-27-2019
11:43 AM
Throwing this out here to see if I maybe creating any issues. I have a machine that is setup in my firewall with an address object. Let's say it's its Machine1 and it's IP is 10.0.0.50. This machine will be decommissioned soon and I have setup another machine that will replace it. Let's say it's Object name is Machine2 and it's address is 10.0.0.60. There are rules setup where the object name Machine1 is used. Rather than modify the existing rules and adding the object Machine2 to them and removing Machine1, can I simply just swap the IP addresses associated with the Object names? This way the rules don't have to be modified and after the commit, they will be applied to the replacement machine. Does anyone see any issues in doing this? I would appreciate any suggestions regarding this.
... View more
06-27-2019
10:57 AM
Thanks for the help @SteveCantwell I first tried to just change the Source Zones from Any to the specific zones I wanted to use. as you suggested. This didn't seem to help. I still received a warning indicating it was shadowing. I then went ahead and added as a source address the regions (based on my address schemes) of 10.0.0.0 - 10.255.255.255 and 192.168.0.0-192.168.255.255. Upon making this change, the validation of the commit worked fine and I was able to sucessfully commit the configuration.
... View more
06-27-2019
02:27 AM
Hi, Recently I upgrades my firewall from PANOS 8.0.10 to 8.0.17. The upgrade went fine. However, after making a small configuration change (adding a new address object), my commit showed a Shadow Rule warning. The warning is associated with a rule that I have that is designed to Deny traffic from ANY zone and ANY application whose destination is the outsize (untrusted) zone with a desitnation address that is identified by Palo's External Dynamic lists "PaloAlto Networks High Risk Addresses" and "PaloAlto Known Malicious IP Addresses" This rule "Block Malicious Sites" is the first security rule that is defined. The warning indicates this rule shadoes anothe rule that is listed further down in my list that allows specific traffic (NTP application) to the outside. While I can move the "Block Malicious Site" rule further down the list, I can't comprehend why it would be considered shadowing. It seems to me the rule targets specific address, essentially those identified in the dynamic list. If it truly were shadowing, I would have thought I would have seen this warning prior to my upgrades from 8.0.10 to 8.0.17. It seems to me that something has changed in the way the firewall evaluated the rules. Has anyone else seen this behavior or have any ideas on what might be happening? I appreciate any input. Thanks,
... View more
06-02-2019
07:42 AM
Thanks for the reply. I ended up opening a case with support regarding this. I sent them some packet captures, and they were able to replicate my issue. They are going to relay this information to their content team and have the signatures updated from ms-update.
... View more
05-29-2019
04:22 AM
Hi Everyone, I have an issue that I haven't been able to resolve. I have a small domain setup with a Windows Server Update Service that is located in a DMZ. The machinges that are in the inside network (trusted), are setup to pull their Windows updates from the server in the DMZ. I have setup Group Policy to make this happend, and it works fine for all of my servers. The issue is that I have a Windows 10 machine that refuses to connect to the WSUS server. The same group policy is applied and when I look at Monitor, I can see attempts to connect to the server over port 8530 ( Default Port), but the traffic is identified at web-browsing instead of ms-update. Since 8530 isn't a standard port for web-browsing, the traffic isn't allowed. I know I could always setup an application override, but I shouldn't have to. I cannot figure out why this particular machines traffic is recognized as web-browsing instead of ms-update. If anyone has any suggestions, I would like to hear them. Thanks
... View more
05-29-2019
04:13 AM
Thanks for the help. Installing the latest agent as you indiciated fixes the issue.
... View more
05-28-2019
08:48 AM
Thank you so much. for the reply Does it matter that I am runing PAN OS 8.0.10 at the moment? What is the rule for different versions of TS Agent and the compatibility with the PAN OS? I thought if I was on the 8.0 branch, I had to stay on the same for TS Agent. I am planning to upgrade to a new version of PAN OS, but I wasn't planning on doing this until after I have my new RDS Server installed.
... View more
05-28-2019
07:19 AM
Hi, I am setting up a new Windows 2016 server that will host RDS. I have installed TS-Agent (8.0.12). No issues installing, however, the service won't start. I am receiving receiving the following: The PAN TS Service failed to start for the following reason: Windows cannot verify the Digital Signature for the file. A recent hardware or softrware change might have installed a file that is installed incorrectly or damaged or might be malicious software from an unknown source. Has anyone else seen this or no of a work-around other than disabling signature checking on files. Thanks for the help.
... View more
09-06-2018
07:24 AM
I was also seeing many of these in my logs. For about 2-3 weeks, I saw many of these, then all of a sudden, they stopped. Not sure what exactly happened and why they suddenly went away.
... View more
06-22-2018
08:15 AM
Hi, I have two questions for folks 1) I have setup Inbound SSL decryption as outlined in the documentation (Import Server Certificate, Create Decryption Policy, Create Decryption Profile), and expected that when I looked at my traffic log to the server in question, I would see the decrypted flag set. However, my entry doesn't list it. How should I be validating that my decryption policy is working? 2) If a web server is set up with HTTP redirect to HTTPS, and an incoming traffic comes into the firewall originally as HTTP, will a decryption policy still be applied, or does the redirect happen on the backend (server side) bypass the decryption policy in some way? Thanks for any help.
... View more
06-18-2018
11:01 AM
It appears ports 8530 and 8531 have been removed again from app-id ms-sms as of 6/1/2018. I contacted support and they confirmed this. Unfortunately, they could not provide a reason why. I ended up having to perform an application override for ms-sms to use ports 8530 and 8531 for my Windows Updates to work again.
... View more
06-06-2018
08:41 AM
I am trying to configure OCSP and I am a little confused. I have added an OSCP responder. It appears the second step is to allow the Firewall to use it by configuring Device-Management->Interfaces. However, for most of my settings, I am using a Service Route Configuration and I don't see HTTP OCSP listed as an option in Service Route. Is there a way to tell the firewall to use a service route instead of the management interface? I also see references online (albeit old) that indicates I need to turn on HTTP OCSP for an Interface Management Profile that is used for a specific interface. If this is the case, what interface should be used? Could someone provide me with some guidance? Thanks,
... View more
06-06-2018
07:28 AM
Does anyone use AVG or Avast for their anti-virus requirements and how do you handle streaming updates? It is my understanding that Streaming updates are updates that are pushed to endpoints by AVG/Avast? These updates are different from typical updates (program and virus definitions) that are pulled from AVG/Avast. Does anyone know if streaming updates are covered by the avg-update and avast-av-update Application ID's? Thanks for the assistance.
... View more
06-01-2018
07:22 PM
It appears the vhdx file I downloaded originally had issues. After redownloading it, I was successful.
... View more
06-01-2018
06:24 PM
Does anyone know if the VM50 is supported on Windows Server 2016 Hyper-V? I have downloaded the PANOS 8.0 Vhdx file and installed it based on the Server 2012 R2 Guidelines, but every time I try to start the VM, I receive a message the virtual machine failed to change states. I've verified my CPU, Memory and Network settings, and can't figure out why it won't start. Thank for the assistance.
... View more
05-29-2018
07:28 AM
Hi @reaper, Thanks again for the clarification. I appreciate it your explanation and expertise. Makes total sense.
... View more
05-29-2018
06:37 AM
Hi @reaper, Thanks for the reply and the explanation. This helps. When you state that creating an inbound and outbound policy provides more visibility, I assume you are referring to the ability to view more detailed information as a result of logs. As for security, is there any difference between using either bi-directional or creating separate inbound and outbound policies?
... View more
05-29-2018
05:24 AM
I have a pretty good understanding of the difference between SRC and DST Nat, but there is one area that I could use some clarification on. With SRC NAT, I understand that by selecting BI-Directional, it allows an IP to be translated to an outside address and that Bi-Directional created an implied policy so that someone on the outside could initiate traffic back to the machine from the outside. It sounds like a good use case would be when the inside machine needs access to the outside and also requires the ability for someone on the outside to connect to it. Wit DST NAT, I understand that it uses both the untrust (outside) zone for both the source and destination Zone and that you use a translated address to get it to the proper machine hosted in another zone. My question is does the use of DST NAT still allow the machine/server to originate traffic outbound? For example, if you used DST NAT to provide access to a machine in a DMZ, can that machine initiate traffic to the outside, or does it only allow inbound traffic? I appreciate any feedback you can provide. Thanks.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-31-2020
03:12 AM
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
