About MP18

MP18

Seems for Natting we used dynamic NAT as our source was 10.0.0/8 and for source address translation we used /27 Public IP. All went well. Thanks for your help

MP18

Hi Mayur, Tunnel is unidirectional. As traffic is initiated from out side. Also i Read if PA does not own the IP here Public IP of vendor as we are using that IP for Source NAtting then proxy arp will come into play? Are you sure NAT T is needed? As our PA is doing NAT then vendor will do on their end. No device in between

MP18

We need to build the new IPSEC tunnel with the vendor. Our side PA Public IP say 200.23.23.x for IPEC tunnel Our Lan 1>>10.0.0.0/8 2>>172.16.0.0/16 Vendor Juniper Public IP 104.156.166.x Users on our side need to access the vendor network IP 1>> 100.65.5.x 2>>100.66.25.0/24 Vendor told us they do not want to allow our Private IP address inside the Tunnel So they told us for our private network like 10.0.0.0/8 and 172.16.x.x we can NAT that to their Public IP 100.67.25.25 in our firewall 1>So need to know on our side of PA i need to configure the NAT rule saying any traffic coming from our zone say corp with IP 10.0.0.0/8 or 172.16.x.x going to Tunnel interface say tunnel.5 get natted to 100.67.25.25? When I put Vendor Public IP for source NAT will this work as PA does know about this IP? For this i need to create source NAT with bidirectional enabled right? 2>Also on our PA side do i need to enable NAT traversal? Normally we do this when middle device in IPSEC tunnel is doing the NAT?

MP18

Try this command show lacp aggregate - ethernet show lacp aggregate-ethernet all Show all LACP-enbled AE interfaces <value> <name> AE interface name

MP18

Please see this link here https://live.paloaltonetworks.com/t5/general-topics/exclude-all-zoom-traffic-from-globalprotect-vpn/m-p/318235#M81729

MP18

You can do on the application base like choosing application zoom-base.

MP18

Many Thanks for confirming that Reaper.

MP18

We have PA 9.1 running vwire for vendor traffic. I need to create ssl decrypt cert for the user traffic going to internet. Seems SSL decryption can work in vwire mode. When I create self signed cert for the user PC what should I put under common name? any name will work? As traffic is sourced from the switch which is doing all the natting and it has public IP address . setup switch with public ip say 184.x.x.x-----------v wire PA------------------------ISP modem. Regards

MP18

Many Thanks Reaper need to learn lot from you.

MP18

So in this case PA sends the reset connection to both pc and server at same time right?

MP18

I agree we have opened the case with PA for 10 days as per them decryption is working as expected. They are looking into this vulnerability as we can exploit the signature.

MP18

Lets see what is causing this?

MP18

Hi BPry, Yes i was talking about pan(w). Seems when i close the web gui i can still access the stats. curious to know how does this work in background to pull the stats from PA? Is there any way we can see the logs in PA that shows us chrome extension pan(w) is pulling stats from the PA? Regards

MP18

like it. very usefull do i need fw gui open to get the stats? will close the fw gui does it still gets stat from the fw?

MP18

Thanks a lot Kiwi

MP18

We have ssl inbound decryption configured and from outside we are able to exploit the vulnerabilty. Need to know why PA allows the connection for that signature. Vul threat id is 57230 Name Telerik Web UI

MP18

Let us know if you have open Tac case for this? Curious to know cause for this issue

MP18

Hi everyone, Need to confirm if Diffie Hellman is used in Global protect VPN - IPSEC.? As per my knowledge it is not used. Regards Mike

MP18

Yes it will impact the Prod traffic if you restart the data plane.

MP18

Many Thanks for the update Bpry.

MP18

We open the TAC case as we were able to exploit the vulnerabiity even though PA ssl decrypt is enabled. Yes you were spot on you can not see the get/post messages on the PCAP on firewall or debug ssl proxy. But PA should able to see the threat signature and block it when ssl decryption is enabled.

MP18 · ‎04-21-2020

The issue is that we have cert with name like *.city.ca and it has multiple sub domains like maps.city.ca All the urls with domain *.city.ca point to single IP address. When i do the pcaps for the city.ca i see the post and get message on the fw pcaps. When domain is maps.city.ca then i do not see the get and post info in pcaps of the fw. I also tested with creating custom url for maps.city.ca and then adding that to decryption rule same thing.

MP18 · ‎04-20-2020

We have configured the SSL inbound decryption. When we do the PCAPS on the PA we do not see POST message on the re and tx pcaps. Need to know is this default behaviour? On traffic logs we see decryption flag as checked. Also from CLI i verify that PA is decrypting the traffic.

MP18 · ‎04-20-2020

Also i tested this on port 443 it always shows traffic as decrypted. is this default behaviour? How can i check if client is using RSA ? doing pcap on the PA

MP18 · ‎04-18-2020

Hi Bpry, If the Connection is using RSA keys then we should not see checked decrypted flag under traffic logs right? And when the connection is using DHE we should see decrypted flag checked under the traffic logs right? So this way we can see if connection is RSA or DHE right? Regards MP

MP18 · ‎04-18-2020

Hi BPry, Many thanks for confirming this as it is good to confirm with you as I am going to do this change is next few days. Best Regards

MP18 · ‎04-18-2020

In addition to what Mayur said Also verify that DNS server and update server is configured under device, setup and services.

MP18 · ‎04-18-2020

Can you please put the info on the show system info? Also verify that under device, setup and services verify server identity is checked or not? Can you successfully do any other updates like antivirus updates?

MP18 · ‎04-18-2020

Hi Everyone, Hope everyone is staying home and Safe. I need to import the certificate and the private keys to the firewall from the web servers. We have this certificate say *.city.ca and this is associated with few websites like maps.city.ca. or recruiting.city.ca All these urls have same public IP address say 209.x.x.x When I import the certificate *.calgary.ca to PA. with private key it should be fine right? Also for decryption policy I will put destination address as 209.x.x.x and then PA should decrypt the traffic for all the urls as they point to same IP address right? Regards MP

MP18 · ‎04-18-2020

Hi Everyone, Learned something new from you today. We are going to enable SSL decryption for Inbound traffic coming from Internet to our web servers. Need to know when does PA intercept the traffic coming form Internet to the web server which is hosting the website? During 3 way TCP handshake or when first Data packet comes? Regards MP

Date Registered	‎10-07-2017 08:47 PM
Date Last Visited	a week ago
Total Messages Posted	1,098
Total Likes Received	23

Online Status	Offline
Date Last Visited	a week ago

Strata

Prisma

Cortex

About MP18