Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About SThatipelly
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About SThatipelly
Online
227Posts
10Likes
2Solutions
May 18, 2022Last Visited
User
Activity
User
Profile
Latest posts by SThatipelly
| Subject | Views | Posted |
|---|---|---|
| 821 | 09-21-2021 11:56 AM | |
| 173 | 06-28-2021 01:49 PM | |
| 1490 | 06-28-2021 01:03 PM | |
| 1516 | 06-28-2021 12:24 PM | |
| 1551 | 06-28-2021 07:38 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-02-2019 12:28 PM | |
| 1 Like | 09-18-2019 11:27 AM | |
| 1 Like | 02-23-2021 01:16 PM | |
| 1 Like | 02-23-2021 11:47 AM | |
| 1 Like | 06-28-2020 07:43 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 5 Likes | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 08-03-2017 01:42 PM |
| Date Last Visited | 05-18-2022 12:25 PM |
| Posts | 227 |
| Total Likes Received | 10 |
09-21-2021
11:56 AM
I have around 500 policies having 'log at session end' enabled and 'log at session start' disabled. I know Palo recommends logging at session end only but I also have a concern that for eg. a malicious file export that lasts for 8 hours and 10gigs go unnoticed if the session wasn't logged at the start. I am in a dilemma to enable the logging at start or not. Please shed some light on this. Thanks.
... View more
06-28-2021
01:49 PM
Yeah, I think I'm left with that one option only for now. Sorry for not wording the question properly. Thanks so much for your help.
... View more
06-28-2021
01:03 PM
Nope, they are in same IP range and subnet. My Outside interface is a /24 which hosts the public routers and public IPs for the DMZ servers. This is what throwing me off on the protection steps I need to take. Should I simply put in a rule saying that traffic from all but few 1.2.3.x should be blocked to 1.2.3.0/24 on firewall?
... View more
06-28-2021
12:24 PM
@vsys_remo I greatly appreciate you taking time to test this. I see that is working just as described which is great however I have a concern here. So, some of my DMZ servers are in that public IP range and also a neighboring public router(outside the firewall) that has the IP in that same public IP range. so, let's say there is a packet from that public router(1.2.3.10) destined to SNMP server(1.2.3.80). Does the IP spoofing prevent that traffic? if so, is there a way I can exclude that rather than putting in an additional security policy?
... View more
06-28-2021
07:38 AM
@vsys_remo I understand but what I'm looking for is has anyone enabled this and observed such attacks getting dropped? as per the definition, those attempts will not be blocked by that IP spoofing protection feature.
... View more
06-28-2021
05:57 AM
@vsys_remo I have none of them enabled. I was worried they may drop any legitimate traffic so, didn't enable them.
... View more
06-26-2021
11:38 AM
I have IP spoofing protection enabled on PaloAlto but it is not effective due to the following reason: My external Interface IP is 1.2.3.1/24 . The spoofed attacks are coming from a fictitious source IP for e.g. 1.2.3.25 destined to 1.2.3.50(web server). As per Palo's IP spoofing definition, this is not blocked because 1.2.3.25 is routable over that interface. I am considering to write an ACL on the neighboring router that says block all inbound connections with source IP in 1.2.3.0/24 subnet. Has anyone implemented this? Am I right in my approach? Thanks.
... View more
06-22-2021
07:26 AM
@BPry I'm hesitant to do sub-interfaces as I will need to spin up 40 sub-interfaces for this.
... View more
06-21-2021
01:02 PM
I have a Layer3 interface on the firewall that is connected to a zone that hosts multiple subnets spread across the remote sites. I would like the firewall to block the intra-zone traffic in this. To do this, I will need to give the Firewall IP as the Def gateway. For e.g. Site A has 192.168.2.0/24 & site B has 192.168.4.0/24 , can I assign my firewall interface both 192.168.2.1 and 192.168.4.1 and block intrazone? if this possible, how many IPs can I assign to this Layer3 interface? I have 40 sites. Thanks.
... View more
06-12-2021
06:21 PM
We have a critical application that breaks with certain google chrome updates. we test the updates prior to pushing to clients. so, I'm trying to block automatic updates. I have decryption enabled.
... View more
06-10-2021
09:36 AM
I blocked 'google-update' app in firewall rules but I still see some of the users' browsers getting updated. I can't find any helpful logs for those users. Please let me know a solid way I can blocked google updates on Palos. TIA.
... View more
06-09-2021
07:10 AM
Hello all, has anyone tried DNS security service on Physical NGFWs? Does it provide any additional benefits compared to the regular Anti-spyware protection with Threat licensing? Please post your reviews. TIA.
... View more
05-12-2021
06:37 AM
@reaper Thanks for your response. do I have to be licensed for Minemeld to get that?
... View more
05-11-2021
01:58 PM
I am looking to block TOR IPs inbound and outbound on my perimeter firewalls. Do any of you know of any trusted list of TOR nodes which I can use in EDLs? Thanks.
... View more
04-06-2021
12:15 PM
How do I block all Github but allow access to a specific repository? For eg. I want to allow https://github.com/cisagov and block all github using a single URL filtering policy. How can I do that? I added github.com/* to custom URL list and set it to block.Created another security policy with a custom URL list containing the specific github page and set the action to allow. I was able to get to the page but the contents inside the page are incomplete. I am showing github pages render content from different pages like avatars.githubusercontent.com, github.githubassets.com etc. How can I keep up with the change in future if I allow the extra sites for now? Is there are any best way I can achieve this? TIA.
... View more
Contact Me
| Online Status |
Online
|
| Date Last Visited |
05-18-2022
12:25 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
