About RobinClayton

RobinClayton · ‎02-25-2020

The alternative is to configure your MTA to accept unauthenticated SMTP from the address of the Firewall. Rob

RobinClayton · ‎02-25-2020

Select the rule , then find (OVERRIDE) Cog at the bottom o the page. This will allow you to change the log settings. Rob

RobinClayton · ‎02-21-2020

Yes, Do you have a logging option set on ALL your rules [ including the two default inter/intra zone ones ] If so on Objects > Log Forward > [your YourLogFowardName ] Create a log forward type "Threat" with a destination of e-mail... You will probably want tor change the severity in the log filter section. Rob

RobinClayton · ‎02-21-2020

I posted a Linux scripted solution a few weeks back in response to another query on he EDLs. We briefly looked at mindmeld.

RobinClayton · ‎02-12-2020

"Monitor", "Mirror" or "SPAN" are the general terms your probably looking for.. All our switch traffic is mirrored out to the PA Tap interface for inspection.

RobinClayton · ‎02-11-2020

Solved??? How?

RobinClayton · ‎02-06-2020

What is in your Application? You should remove application, and set service any in order to test unfiltered connections. Rob

RobinClayton · ‎02-06-2020

Monitor to where? You can send system SYSLOGS that should alert to ports going down.

RobinClayton · ‎02-06-2020

Sounds like a L3 routing issue to me then. Rob

RobinClayton · ‎02-06-2020

Otakar eludes to the V-Wire, which would allow traffic to traverse the PA seamlessly, but in that scenario, as he points out, you would need bot a trusted and untrusted v-wire ports. And the untrusted v-wire and external interface still both need to connect to the Leased line somehow. The present setup is really correct for most instances. Or are you trying to get rid of £$ threat inspection licences on the checkpoint and put that into the PA?? Rob

RobinClayton · ‎02-06-2020

If one connects and the other does not then it's not the user itself. Ensure CIMv2 is setup correctly as that's one usually missed. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0

RobinClayton · ‎02-05-2020

So the L2 Switch has the Internet on one port. PA on another port Checkpoint on another port. All there in the same vlan. Personally that's how I intend my external infrastructure to be, I can then have multiple ISP's and trusted their part circuits on different VLANS going to any combination of firewalls.

RobinClayton · ‎02-05-2020

If the other firewall has 5.X.X.34 , then it's going to conflict if both are the same?? Or are you getting rid of the other firewall? Rob

RobinClayton · ‎02-04-2020

is it possible to try with SFTP. There are numerous threads on the internet over the years relating to SCP being slow ( nothing to do with firewalls ). I have seen it connecting to a local server where SCP is slow and SFTP significantly faster (or actually normal). Rob

RobinClayton · ‎02-04-2020

Have you tried a full allow rule in both directions? That will indicate if it's a security policy or other issue.

RobinClayton · ‎02-03-2020

For registration the CUCM should not necessarily need a rule as the Phone is the client. Have your got logging turned on for your "default interzone" block?? Do you see any traffic from the phone? Is the routing from the phone to the CUCM correct? You will need a rule from the CUCM to the phone for SIP/SCCP, and perhaps the RTP traffic.

RobinClayton · ‎02-03-2020

Have you got denied traffic logged? Does the phone have static or is it trying to obtain a DHCP IP address.. Is there a Proto Difference between the two types of phone ( Skinny vs SIP )

RobinClayton · ‎01-30-2020

Best practice, is to fail traffic to the passive as the first step after disabling pre-empt(personally I have it off all the time anyway.) Then step through each iteration, switching firewalls at each step to confirm the upgrade is successful and traffic still passes. From what you say you have upgraded the passive all the way in one go. You could disable pre-empt now and fail the traffic over and see if it works but your more likely to see and issue. Better option would be to downgrade the passive and then fail over to it and do one step at a time on each. That way they are only ever one version different be it Major, Minor or Increment.

RobinClayton · ‎01-29-2020

It was set on the MGMT interface, but I did not see any CRL/OSCP app-id traffic. I now have it configured for CRL Service on the external interface, but that made no difference.

RobinClayton · ‎01-29-2020

The unit is configured to send both CRL and OSCP but I can't find where I would see this traffic. Service router does not include an option for OSCP only CRL... This is on an 8.0 FW, but the certs are there and look to have the same time stamp. Rob

RobinClayton · ‎01-29-2020

Since SFTP is just FTP over SSH, it implicitly is just SSH. So without deeper inspection of the packets by the AppID enigne there is no way to a SSH terminal over SFTP.

RobinClayton · ‎01-29-2020

I have had 1.0.105 installed for a while .. I know it has some inconsistencies and wondered if an update may fix these. But when I go to update tab it just tells me I need a FW rule. That's there, but how do I force an update? All I see in the FW log is blocked NTP requests ( It's trying the Canonical Default ) and some Snapcraft.io SSL requests. Cheers Rob

RobinClayton · ‎01-29-2020

No Anything on Digicert or Comodo is an issue. [at least] I have to unset "Untrusted Issuer" & "Unknown Status" , and that's in addition to the "Check Timeout" which fails for everything.

RobinClayton · ‎01-27-2020

Yes multiple URL's Lists and Multiple Rules are required if you need to be 100% granular in your white listing. Also be aware that any one site may pull assets from other sites that are not white listed. and therefore content may not show correctly.

RobinClayton · ‎01-27-2020

If they are anything like us, we have some bespoke 3rd party applications that only play nicely with I.E... Rob

RobinClayton · ‎01-27-2020

We did it the other week. 8.0.9 to 8.0.20 8.0.20 to 8.1 8.1 to 8.1.11 This was on a HA 3020, took us about 1h:30m but we were being very cautions, unfortunately it did cause interruption on one of our very time critical services. But overall it went without issue. we probably could have done it in 45mins if we just bashed on..

RobinClayton · ‎01-27-2020

I am trying to get SSL Forward Proxy working properly, generally it seems to be OK but I have a site I have tested is for the bank hsbc that gives an error.. Certificate Error There is an issue with the SSL certificate of the server you are trying to contact. Certificate Name: IP: 91.214.6.22 Category: not-resolved Issuer: Status: unknown Reason: I have read this https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm66CAC Coincidentally, the site in the help link actualy uses the exact same certificate as HSBC. I have imported both certificates in the chain "DigiCert High Assurance EV Root" "DigiCert SHA2 Extended Validation Server CA" Tried setting root and SHA2 as CA... But the error persists for both the site I need and the site from the help document. My forward Proxy is presently configured like.... ( I had to disable "Check Timeout" as that failed also ) [/] Block sessions with expired certificates [/] Block sessions with untrusted issuers [/] Block sessions with unknown certificate status [ ] Block sessions on certificate status check timeout [ ]Restrict certificate extensions Cheers Rob

RobinClayton · ‎01-23-2020

'tcp-rst-from-server' Is this from one server or a whole bunch of them?

RobinClayton · ‎01-15-2020

I don't think we have seen and issue since late December. Rob

RobinClayton · ‎01-14-2020

To elaborate on the above consider this scenario. Your end user downloads a seemingly malignant file that the PA has no signature for [yet]. 12 hours later that malignant file is found to have malicious payload and PA create a signature for it. So do Sophos, MacAfee, etc etc.. 13 hours later it the file activates on your network. You don't have AV/Malware protection on the endpoints. 14 hours later your packing your desk..... So as OtK points out, it's a multi layer approach. It's always best to block as close to "SOURCE" as possible, but there needs to be the extra layers and indeed different methods of detection, selecting products from differing vendors who may get an update to you quicker than one of your others. Rob

Date Registered	‎08-25-2017 12:46 AM
Date Last Visited	18 hours ago
Total Messages Posted	259
Total Likes Received	33

Online Status	Offline
Date Last Visited	18 hours ago

Strata

Prisma

Cortex

About RobinClayton