About GNS_Support

Hey there,   On version 6, there is no option to override and log the default rule. In order to have this logged, just simply create a new any to any deny all rule, set it to log at session end and place it at the bottom of your ruleset.    If you upgrade to 6.1 or higher you can override the 'interzone-default' rule which is now visible in the ruleset and set it to log.   hope this helps, Ben ... View more

One workaround would be use a separate web server to buy a wildcard certificate from Commercial CA with something like  *.yourdomain.com. Then export the certificate and private key file in PKCS or PEM format from that web server to PaloAlto firewall or Panorama. I think it may not be possible to generate CSR (Certificate Signing Request) from a PaloAlto firewall as I could not see any option to do that. Then the workaround like above helped. ... View more

Not with Titus, but with a similar protective marking product..... ... View more

In Device -> Setup -> Session you can setup various stuff regarding how the PA box will handle SSL stuff (page 35 in PA-4.1_Administrators_Guide.pdf): " Server CRL/OCSP * Enable - Select the check box to use CRL to check the validity of SSL certificates.Each trusted certificate authority (CA) maintains certificate revocation lists (CRLs) to determine if an SSL certificate is valid (not revoked) for SSL decryption. The Online Certificate Status Protocol (OCSP) can also be used to dynamically check the revocation status of a certificate. For more information on SSL decryption, refer to “Decryption Policies” on page 143. * Receive Timeout - Specify the interval after which the CRL request times out and the status is determined to be unknown (1-60 seconds). * Enable OCSP - Select the check box to use OCSP to check the validity of SSL certificates. * Receive Timeout - Specify the interval after which the OCSP requests times out and the status is determined to be unknown (1-60 seconds). * Block Unknown Certificate - Select the check box if you want to block certificates that cannot be validated. * Block Timeout Certificate - Select the check box if you want to block certificates when the request for  certificate information times out. * Certificate Status Timeout - Specify the interval after which certificate status requests time out (1-60 seconds). " And when you setup the decryption policy you have various options to play with (page 144): " Options Tab * Action - Select decrypt or no-decrypt for the traffic. * Type - Select the type of traffic to decrypt from the drop-down list: - SSL Forward Proxy—Specifies that the policy will decrypt client traffic destined for an external server. - SSH Proxy—Specifies that the policy will decrypt SSH traffic. This option allows you to control SSH tunneling in policies by specifying the ssh-tunnel App-ID. - SSL Inbound Inspection—Specifies that the policy will decrypt SSL inbound inspection traffic. * Category - Click Add to select the URL categories from the drop-down list. * Block sessions that cannot be decrypted - Select the check box to block any sessions that the firewall cannot decrypt based on policy rules. Decryption may fail if none of the cryptographic algorithms offered by the client and server are supported. " And when importing your certificate(s) for ssl-inspection/termination in Device -> Certificates you have these settings to choose from (a single cert can be flagged with multiple features): " The Certificates page allows you to generate the following security certificates: * Forward Trust - This certificate is presented to clients during decryption when the server to which they are connecting is signed by a CA in the firewall’s trusted CA list. If a self-signed certificate is used for forward proxy decryption, you must click the certificate name in the Certificates page and select the Forward Trust Certificate check box. * Forward Untrust - This certificate is presented to clients during decryption when the server to which they are connecting is signed by a CA that is not in the firewall’s trusted CA list. * Trusted Root CA - The certificate is marked as a trusted CA for forward decryption purposes. When the firewall decrypts traffic, it checks the upstream certificate to see if it is issued by a trusted CA. If not, it uses a special untrusted CA certificate to sign the decryption certificate. In this case, the user sees the usual certificate error page when accessing the firewall and must dismiss the warning to log in. The firewall has a large list of existing trusted CAs. The trusted root CA certificate is for additional CAs that are trusted for your enterprise but are not part of the pre-installed trusted list. * SSL Exclude - This certificate excludes connections if they are encountered during SSL forward proxy decryption. * Certificate for Secure Web GUI - This certificate authenticates users for access to the firewall web interface. If this check box is selected for a certificate, the firewall will use this certificate for all future web-based management sessions following the next commit operation. " ... View more

Regarding setting service then of course if you limit lets say web-browsing down to TCP80 (where the TCP80 is put in servicecolumn) then it wont be able to detect web-browsing which is passing at TCP8080 or any other port for this particular rule (because that will be dropped if you use a classic whitelisting setup of rules meaning a bunch of allowrules which in the end have a deny+log). But I think it can be sane to manually specify which ports you wish to limit because even if the grand feature of PaloAlto is application detection it doesnt mean that it will always succeed in detecting such applications not to mention that "service-default" might change over time. Also if you set a huge range of ports (or "any" for that matter) - before an application can be identified the traffic must be let through (depending on what the payload is). A simple test is to send "a b c" as a HTTP-request to a webserver hidden behind a PAN and you will notice that PAN will let this packet through to the server, but as soon as the server replies the reply will be not let back to the client (because it is when PAN gets the reply from the server it knows that the requst was HTTP and not something that just use TCP80 which means that the flow will be denied once it figured out the flow is not about web-browsing and your rule only allows web-browsing). So in my case I recommend to first setup the rule in PAN as you would with a normal SPI-based firewall. And then choose appid for that rule then finally go to the service column and change specific ports into either manully defined range/ports or "service default" or "any" for very chatty procotols (for example many Microsoftbased is badly constructed from a network point of view). One of the points of using a NGFW is to improve the security by setting up rules not only on port but also application. If you set "any" as service you will in many cases lower the security at least for the first few packets. ... View more

Thanks James.. That doc is spot-on. ... View more

Hello, We are unable to determine the compatibilty with other SSL-VPN clients due to the many different variables in play.  We are compatible with Cisco and Checkpoint though. ... View more

You could use NAT to publish a different port out as a service - then go to an Internal address and the 443 port.  You cannot change the SSL VPN port. Thanks James ... View more