About jambulo

jambulo · ‎04-06-2020

Has anyone found a fix for this? I can confirm, with full tunnel VPN MS Office thinks there is no internet. With split tunnel VPN MS Office can see that there is an internet connection.

jambulo · ‎02-14-2020

Not sure if this is still being updated/supported, but you can try the Pan(w)achrome Chrome plugin.

jambulo · ‎02-14-2020

In the last few days we've been getting a ton of FP's. None of these files are related in any way, but one commonality we did find was Wildfire was keying on these 2 things: 1) Http request without User-Agent 2) HTTP GET requests to x.x.x.x/wpad.dat (x.x.x.x being the same IP every time). Also, our WF500 appliance is reporting all of these FP's. If we upload the same file to the WF cloud, the files come back as benign. I have a ticket open with support and they have escalated it to engineering.

jambulo · ‎08-09-2019

I have a similar issue with GlobalProtect 5.0.3 and Duo MFA. Not sure if everyone is aware how Duo MFA works with GlobalProtect, but instead of enter in a one-time passcode, you can enter in the number "1" and Duo will send a push notification to your mobile device. Well, I entered in "1", never got the push notification(not sure why), but this caused the GlobalProtect client to get stuck at "Still Working...". I waited 25 minutes and the client never timed out, it just kept trying.

jambulo · ‎02-28-2019

From what I understand, Palo Alto has templates on Github you can use to deploy the PA in an existing Azure environment(without using the marketplace). https://docs.paloaltonetworks.com/vm-series/7-1/vm-series-deployment/set-up-the-vm-series-firewall-in-azure/use-the-arm-template-to-deploy-the-vm-series-firewall.html#

jambulo · ‎02-28-2019

You can create a Custom URL Category with an entry of "*.*" (not including the quotes). This will log URL's without the license. It just will not(obviously) categorize them.

jambulo · ‎08-21-2018

Are the subnets equal to each other? Not sure what you mean. Will you generally allow traffic between the subnets? Generally will not allow traffic between subnets. Are the subnets contain different group of servers? (One subnet for linux and one for windows for example) Subnets can contain different types of servers, but mainly are separated by the functions that the servers provide. Do you plan to configure generic zone firewallrules or do you configure specific rules for each server? Specific rules for each server.

jambulo · ‎08-17-2018

If you have a DMZ behind the Palo and it contains multiple VLANs or sub-interfaces, would you create multiple Zones(one for each VLAN)? Or create a single "DMZ" zone and apply that to all of the VLANs?

jambulo · ‎07-30-2018

You can do this with a single Portal. You could put the Portal on a loopback interface on the Palo(with a private IP). Internal users will access the Portal via internal IP, external users would NAT to the internal IP.

jambulo · ‎07-27-2018

We use our SNMP monitoring tool to send HTTP request to the Portal/Gateway. If it does not get a response, we get alerted.

jambulo · ‎06-26-2018

I would do... - LDAP only on the Portal - RADIUS(OTP) on the Gateway ...Enabling 2-factor on the Portal may cause your users to have to enter in a OTP even when on your internal network. Is your OTP solution capable of authenticating LDAP as well? (ex. LDAP+OTP over the RADIUS protocol).

jambulo · ‎05-16-2018

I had this same issue, but with GP 4.1 only(and on Win 7 and 10). This little bug was pretty detrimental for us, since we are "enforcing" a Global Protect connection. The Global Protect service seemed like it was half-way running. Global Protect could not connect to the Portal/Gateway, which would then block ALL network traffic(because we are enforcing a Global Protect connection). I opened a ticket with support, but after a little while of troubleshooting, we just instructed our users to downgrade back to 4.0.x.

jambulo · ‎03-16-2018

I have tested GP 4.1 on Windows 7 and 10, the agent saves the password most of the time. There are some times where the GP agent will prompt me for my password again. I don't think this is related to GP 4.1 though, as it was happening on the older version as well.

jambulo · ‎03-16-2018

@reaperOk, so at no point in the disable process, will the user, or firewall admin, need to enter in this Agent User Override Key? Are you saying this "user override key" is just being used to validate the connection(much like an SSL certificate on a web server is used to validate the connection)?

jambulo · ‎03-15-2018

@reaperSo what's the difference between "User Agent Override Key" and the "Generate Ticket" button(under Portals)? Would you be able to explain to me the process of disabling GP when "allow with ticket" is enabled?

jambulo · ‎03-09-2018

I have discovered an issue that only applies if you have Always-On enabled and enforcing a GlobalProtect connection for network access. What happens is... 1. User logs into Windows. 2. GlobalProtect connects to Portal/Gateway. 3. GlobalProtect prompts for authentication. 4. If the user does not authenticate within 10-15 seconds of receiving the auth prompt, GlobalProtect will minimize(in the system tray) the auth prompt, and display the "Traffic Blocking Notification" message. I have noticed that this only happens when you do a fresh logon into Windows. When switching between an "internal" and "external" network, the auth prompt is not effected. A fresh logon into Windows gives you a balloon type auth prompt next to the system tray. Switch between internal/external networks gives you a pop-up window for the auth prompt.

jambulo · ‎03-09-2018

In the GlobalProtect Portal config(under the Agent tab), there's a setting for "Agent User Override Key". I'm finding conflicting information on what this might be used for. The firewall's help file says this field is used for disabling GlobalProtect with a Ticket.... "after a user attempts to disable GlobalProtect, the endpoint displays an 8-character, hexadecimal, ticket request number. The user then contacts the firewall administrator or support team (preferably by phone for security) and provides this number. The administrator or support person types the hexadecimal ticket request number into the Agent User Override Key field (in the GlobalProtect agent configuration Agent tab) so they can see the ticket number (also an 8-character hexadecimal number). The administrator or support person then provides this ticket number to the user who then enters the ticket number into the challenge field to disable the agent." ...but, the online GlobalProtect admin guide gives different instructions for disabling GlobalProtect with a Ticket... "the disconnect action triggers the agent to generate a Request Number. The end user must then communicate the Request Number to the administrator. The administrator then clicks Generate Ticket on the Network GlobalProtect Portals page and enters the request number from the user to generate the ticket. The administrator then provides the ticket to the end user, who enters it into the Disable GlobalProtect dialog to enable the agent to disconnect." (https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-portals/define-the-globalprotect-client-authentication-configurations/customize-the-globalprotect-agent#id0cd8a407-0254-4fca-89a1-fc143b3ab483) ...it looks like the online admin guide might be more accurate. So then, what is the purpose of the "Agent User Override Key" field?

jambulo · ‎03-07-2018

What are you using for the first factor(what is your Duo Auth Proxy pointing to for the first factor)? Active Directory? If using AD for the first factor, and Duo for the second factor, try this... - Create an Authentication Profile in PA that uses LDAP and points to your Domain Controllers. - Apply this LDAP Auth Profile to your Portal. - Create an Authentication Profile in PA that uses RADIUS and points to your Duo Auth Proxy. - Apply this RADIUS Auth Profile to your Gateway. ...with this configuration, users will authenticate to your Portal via AD only, and to your Gateway via Duo MFA. I believe, after authenticating to the Portal, the GP agent will take the username/password used to authenticate to the Portal, and send them to the Gateway. The expected behavior here is, the user should only have to enter in their password once, and their OTP once. Or, if you save user credentials in GP, the only thing the user has to do is authenticate against the second factor.

jambulo · ‎09-15-2017

We have File Blocking enabled(mainly to log specified file types) and Data Filtering enabled(to alert/block when it detects a predeterminied string of characters). While uploading a file to a file hosting site(like tinyupload.com) the File Blocking and Data Filtering see's the file as expected. While uploading a file to Yahoo Mail or Gmail, File Blocking and Data Filtering fail to see the file. What is everyones experience with the Palo Alto's ability to scan/identify email attachments for services like Yahoo Mail and Gmail? Note: We have an appliance that is decrypting HTTPS traffic and then sending it to the Palo Alto on a Tap port.

jambulo · ‎04-10-2017

I need to resurrect this issue back from the dead. We monitor our PA's with SNMP, and when the Session Count and/or Connection Rate increases to a number above normal, it's always a struggle to find the source of the problem using the PA interface. Anyone have any tips? Here's an example: Our SNMP monitoring tool clearly shows a spike/hump in Open (TCP) Sessions... The ACC tab does not reveal that there were any indications of a spike in traffic.

jambulo · ‎02-28-2017

I run a PA-200 at home as well and have not come across any performance issues. I'm on PAN-OS 7.1.something.

jambulo · ‎02-28-2017

@AdamCoombsWe have all of the Palo Alto logs syslogging to our SIEM. In our SIEM, we have created rules to fire off an email alert and/or generate an "offense" based on what is in the syslog payload.

jambulo · ‎02-24-2017

We have been using a Palo Alto as an IDS sensor for about 5 years now. We also have Sourcefire running along side of it. They are both fed span and tap data from various locations. I can honestly say that the PA does a pretty good job at identifying informational type traffic as well as critical threats. We probably have gained more value out of the PA than Sourcefire.

jambulo · ‎07-25-2016

We pretty much configure and push everything in the Policies, Objects and Device tab using Panorama. Then we manually configure the items in the Network tab, mostly because our remote sites aren't generally the same. One thing I would suggest is to set up an emergency "back door" to the PA-200. Just in case it doesn't come online or the site-to-site tunnel(if you're using one) doesn't come up. You could give SSH or HTTPS access to the PA-200 and allow only your source IP. You could also ship a laptop(with client VPN) and a cellular hot spot with it, so you can remote into the PA-200(assuming a tech or someone can plug it in).

jambulo · ‎06-08-2016

I've been using this method for a while successfully...

jambulo · ‎05-21-2016

Im not sure why you're seeing this behavior. We have a similar rule and it works fine. Only difference is we have it set to App-Default for Service. Which should be fine because its "Standard Ports" are TCP/dynamic. You should give that a try.

jambulo · ‎04-22-2016

When allowing your users out to the internet, are you specifying each App-ID that they can use? Or do you allow anything on 80/443, then block the known bad App-IDs? Ideally, it would be nice to specify each App-ID allowed out to the internet, but that would be a management nightmare.

jambulo · ‎04-22-2016

What is the best practice for blacklisting potentially harmful Application ID's(from "trust" to "untrust" over 80/443)? I started blocking on specific App-ID's, but maintaining this blacklist per App-ID will be kind of cumbersome. I'm thinking about using Application Filters to block based on Application subcategory. The only issue here is if I wanted to block say the "encrypted-tunnel", it will block common applications like "ssl".

jambulo · ‎04-06-2016

I feel your pain. The Global Protect client UI has been horrible since it came out. We've complained about it for years to Palo Alto, even to a top Global Protect developer when he came down to visit.

jambulo · ‎11-18-2015

We've been getting a lot of hits on this Threat ID as well. I think if anything, this ID should be set to Informational or Low.

Date Registered	‎11-08-2010 11:51 AM
Date Last Visited	3 weeks ago
Total Messages Posted	106
Total Likes Received	22

Online Status	Offline
Date Last Visited	3 weeks ago

Strata

Prisma

Cortex

About jambulo