About zanonibs

zanonibs · ‎06-21-2011

Hi, I'm doing same tests using IBAN codes and your results are similar to mine. I've also opened a case of 2 months but no real solution was found over DLP. In my opinion DLP lacks some capabilities: 7-bytes error doesn't permit to have short & composite pattern. Without the keyword it's impossible to verify the real information (eg the pure IBAN number in the various variants) There is a limit in pattern length and after that the commit phase can't be accomplished (no response from engine) I've tried also with the new 4.0.3 but nothing changed. I hope in future improvement. Other vendors DLP is better.

zanonibs · ‎06-17-2011

This can be a choice, VPN without split tunnel. All traffic from the remote office to the central site for inspection and filtering. You save devices/licenses and add the unique apps control but the required bandwith is double than the stand-alone case. This is a test I want to do with ASA 5505 <--> PA-2050 controlling if PAN is capable to do routing & inspection in the same interface (ASA can't do) Another solution could be Firewall as a Service. Virtual Firewall (PA 2000+ can do that) in central site used as branch office firewall, a crypto (IPSEC) or private connection (MPLS / own fiber) is needed.

zanonibs · ‎06-17-2011

Done for a PA-500 from 4.02 to 4.03 without any problems. I have seen only minor changes, from the documentation it's a bugfix.

zanonibs · ‎06-17-2011

Update after 2 month from opening the case: Problem still remains even with the new 4.0.3 due to limit in long regex pattern. There is a limit that you can't trespass that generates errors in commit operation like commit failure or commit thread not responding. For now DLP has big limitations respect other vendors and I want to remark that having a strong DLP support is quite important in this kind of device. Please verify the error in the future and improve this feature. Now the case with the support is closed with the note: not solved. By the way thanks to the support team.

zanonibs · ‎06-15-2011

Perfect! This is the information I want to Thanks

zanonibs · ‎06-15-2011

Hi, does anyone know if PAN retires somehow the old IPS signuters? Into the update bulletin there are informations only for new and modified signatures, not for the retired ones. For example yesterday night I received the PAN bulleting and Cisco. In the PAN's email 65 new signatures were added and 14 updated. In che Cisco's 10 added/modified and 21 retired. Is the special PAN hardware capable to keep all the signatures due it's special parallel multi-core configuration? Any information will be appreciate. Thanks

zanonibs · ‎05-21-2011

The DNS-proxy feature of PAN 4.x can be useful without using U-turn nat.

zanonibs · ‎05-21-2011

Required: Better DLP support (quite bad right now) and integration with outbound email control & block SSLVPN portal for clientless connection. A client for mobile (Iphone/Android) and linux is also quite useful. A deeper integration between rules/applications and URL filtering Useful in the future: Seamless user notification when policies are violated. Large log & monitoring SSD for all devices Packet Fowing test section in order to verify rules, nat, profile group, url filtering. Cisco and Websense have a section like this and is great for troubleshooting & quick deployment. PA has now a great product and with other imporvements may become the real leader of network security firewall. Keep the good job!

zanonibs · ‎05-04-2011

Do you mean filter share folders on a file server behind the PA? I think this kind of capability belongs to different devices such as Imperva file firewall and user rights managment. Even GOP of Active Directory can be very helpful.

zanonibs · ‎05-03-2011

right, for PANOS 4 type the complete word "maint" and I suggest to reboot the device after the factory rest boot, oftet whit my PA-500 the first time the GUI interface is not responding, only a second reboot resolve the issue. default mgm ip 192.168.1.1/24 (no dhcp server) admin:admin

zanonibs · ‎05-03-2011

NordicEdge is a great solution and you don't have to care about OTP page, it's automatic due the RADIUS response. Nice integration with Palo Alto (and all other major vendors to tell the truth), in one hour you can have domain user logging into SSL VPN with strong authentication. OTP can be sent via sms, email o smartphone app, A demo 30-days with SMS support is available to try, I suggest the product.

zanonibs · ‎04-15-2011

Hi, the attached guidance is quite short and inclomplete, i prefer better documentation. For example Checkpoint has a quite long list of best practices, example and data pattern implemente in default configuration and should be interesting see the Palo Alto thought and tips.

zanonibs · ‎04-15-2011

Quick update: the long commit time is only for the first commit after the regex insertion. The others take the normal time, about one min, the coffee time

zanonibs · ‎04-15-2011

Hi, I'm trying to enable some data patterns in order to block banking informations going out from the network. Model PA-500 PANOS 4.0.2 The first task is to block Italian IBAN code starting from Checkpoint's DLP blade pattern. This is the regex extracted from a UTM-1 R75 IT\d{2}( )?[A-Z]\d{3}( )?\d{4}( )?\d{3}[0-9A-Za-z]( )?([0-9A-Za-z]{4}( )?){2}[0-9A-Za-z]{3} As far as I know (Admin guide source) Palo Alto pattern recognition doesn't have some features like \d{2} and repetition {2} and I've changed the format into a new one according to PA's needs. .*(IT[0-9][0-9]( )?[A-Z][0-9][0-9][0-9]( )?[0-9][0-9][0-9][0-9]( )?[0-9][0-9][0-9][0-9A-Za-z]( )?[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]( )?[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]( )?[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]) The first problem is due to 7 bytes lenght: in this format always I received the error and only adding some other words i can continue with the commit. I added, for example, a simpe phrase: .*(IBAN Italia).*(IT[0-9][0-9]( )?[A-Z][0-9][0-9][0-9]( )?[0-9][0-9][0-9][0-9]( )?[0-9][0-9][0-9][0-9A-Za-z]( )?[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]( )?[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]( )?[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]) I' ve tried other format (without long IBAN code) still receiving 7 bytes error so might there is a bug somewhere in pattern recognition: .*(IBAN).*((Italia)|(ITALIA)|(italia) -> pattern -> IBAN-IT -> regex '.*(IBAN).*((Italia)|(ITALIA)|(italia))' is invalid. pattern must be at least 7 bytes The second problem is an increbilbe increasing in commit time from 1 minute to 5-10 minute and often this is the result: device: response from cfgpush.s1.dp0.comm.cfg: config push error Commit failed The only way to create this pattern match is creating a subset rule but commit long time still remains and the match is due the first two words not the real IBAN code. .*(IBAN Italia).*(IT[0-9][0-9]( )?[A-Z][0-9][0-9][0-9]) If someone has an idea how to resolve this odd behavior please send me an update. If not I will open a support case. Regards

zanonibs · ‎04-14-2011

Sometimes is quite useful deny a specific source in the beginning rather than apply the classic "deny any any" at the end. But if is not possible using the negate form of a source group/user then the solution you proposed it's the only that works. Thanks for support

zanonibs · ‎04-09-2011

Hi, is it possible to create a security policy with user/group with NOT form? for example : LAN => WAN !domain-group any all-app deny My task is to create a rule in order to block all known users except those belongs to a specific domain group indentified correctly in the PAN GUI via LDAP handshake. I've tried introducing a simple "!" simbol before the group name. Commit is OK but in practice nothing happened. If somebody has tried succesfully a smarter solutions please inform me. Regards

Date Registered	‎10-08-2010 04:04 AM
Date Last Visited	‎08-18-2015 09:06 AM
Total Messages Posted	16
Total Likes Received	4

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

About zanonibs

Re: How to apply Data Filtering effectively

Re: Websense, WCCP, ETC.

Re: Upgrade to 4.03

Re: Data pattern strange behavior

Re: IPS Signatures

IPS Signatures

Re: need help with u-turn nat between zones

Re: What is still missing or needs to be improved in PA Next Generation Firewalls ?

Re: file share

Re: How do I reset the unit to factory default via mgt and console port?

Re: SSL VPN & VeriSign VIP Access for Mobiles

Re: How to apply Data Filtering effectively

Re: Data pattern strange behavior

Data pattern strange behavior

Re: Security policy using group in negate form

Security policy using group in negate form

Re: How to apply Data Filtering effectively

Re: Websense, WCCP, ETC.

Re: Upgrade to 4.03

Re: Data pattern strange behavior

Re: IPS Signatures

Re: Data pattern strange behavior

Re: How to apply Data Filtering effectively

Re: How do I reset the unit to factory default via mgt and console port?

Re: What is still missing or needs to be improved in PA Next Generation Firewalls ?

Strata

Prisma

Cortex

About zanonibs