About ce1028

@reaper    I agree your assessment. I'm all for encrypted dns, but I want all my dns requests coming from my internal dns servers, as you stated.   However, I thought dns-over-https uses certificate pinning, which would not allow it to be decrypted?       ... View more

@reaper    Reason for blocking is corporate policy is to allow dns requests from internal DNS servers only.  Also, they both create security risks that could allow tunneling of malicious traffic and also could potentially bypass your security policies   Palo Alto also recommends blocking.     You don't believe they should be blocked?  I'd like to hear your reasons ... View more

Yes, I am aware of that much, but if the action is drop/block etc, will it be able to capture any packets? ... View more

@reaper thanks much.  One more question, when you're using the action Block IP (or even Deny or one of the reset options), is setting packet capture to single or extended useless? Documentation says it won't capture unless action is alert or allow, yet it suggests setting extended for critical, high medium?   ... View more

thanks @reaper , good to know.   Yes, definitely about url filtering. I was referring to using a url profile without the custom allows ... View more

@reaper thanks for reply.      If that theoretical scenario happened, what action would the firewall take?  Would it still block the threat, even if it had no memory to block the IP?   The custom URL list is a very good idea, I was thinking of a scenario where you have a web server and Palo url database changes and your site get's categorized as malware or unknown or another category you typically block, you would essentially block your customers from accessing the site ... View more

thanks @BPry  ... View more

@BPry   Thanks for the reply.  Yes agreed, it does not matter, but I was more curious as to what the best practice is from a processing standpoint   Very good point on all the rules getting re-evaluated.  Is it safe to say, the most hit rules are better to be towards the top of the rulebase then, or due to firewall performance specs, it doesn't really matter?     ... View more

@harevalo_eog Yes, I did, it's been a long time since I've touched certificate services.  See if this video helps you, at least from the ADCS side   https://www.youtube.com/watch?v=S7IFp8cGOLs   ... View more

@vsys_remo thank you for clarifying. For this purpose, I shall create a seperate URL profile and turn the option off ... View more

@vsys_remoyou were correct, the Log container page only option was enabled. I disabled and now it's logged.  Question though, did I have to uncheck the log container page only because I used the custom url category in the security policy rule, or is it unrelated? ... View more

@vsys_remobut I added a url filtering profile and set some of the categories to "alert". I see my custom url category there too and set that to alert, but no dice   What do you mean by 'log-all' profile? How is that setup? ... View more

This worked, thank you.   The only problem now is I don't see this traffic in the URL Filtering log. If you specify the custom url category in the security policy rule, does that mean its no longer logged? ... View more

duh me. I figured it out, my authenticaiton profile needed to be changed from sAMAccountName to userPrincipalName ... View more

@asillikerI tried setting the username field in the certificate profile to Subject Alt, It surely fixes the username issue, as it will cause the username to be username@mydomain.com and is greyed out. The problem is it will never accept the user's password, even if it's the right username/password combo.     ... View more

@BPry So, originally, I was decrypting the traffic because I disabled the "*.wetransfer.com" decrypted exception that Palo adds under SSL Decryption Exclusion.   With decryption disabled, I'm still able to block wetransfer uploads using a file blocking policy (although small files, like 100k upload even with file blocking on, but that's another issue).   What I'm attempting to do now is the opposite. I've already successfully blocked uploads, but now I want to allow uploads for specific users.  The issue is, with decryption on or off, palo only identifies this traffic as web-browsing and ssl.  It does not categorize the upload as amazon-cloud-drive-upload, although it should.   There does not seem to be a good way to allow uploads to only wetransfer   Update: Just to be clear, I always had TLS Decryption enabled. When I mentioned disabled decryption, I was referring the "SSL Decryption Exclusion" ... View more