This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About Gareth.Doyle
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About Gareth.Doyle
03-11-2022
61Posts
14Likes
5Solutions
Mar 11, 2022Last Visited
User
Activity
User
Profile
Latest posts by Gareth.Doyle
| Subject | Views | Posted |
|---|---|---|
| 592 | 03-03-2022 09:16 AM | |
| 648 | 03-03-2022 06:35 AM | |
| 723 | 03-02-2022 09:43 AM | |
| 829 | 02-23-2022 01:43 PM | |
| 358 | 01-04-2022 10:08 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 02-23-2022 01:43 PM | |
| 1 Like | 01-02-2022 01:54 PM | |
| 1 Like | 01-04-2022 10:08 AM | |
| 1 Like | 01-03-2022 04:07 PM | |
| 1 Like | 06-11-2021 09:32 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 01-05-2018 02:57 PM |
| Date Last Visited | 03-11-2022 11:33 PM |
| Posts | 61 |
| Total Likes Received | 14 |
03-03-2022
09:16 AM
Thanks, Adrian. We have some cluttered (and extensive) URL categories because of a multitude of instances of abc.com/ and abc.com/* being in the lists for some reason. Likely just lack of proper knowledge on someone's part. Thanks.
... View more
03-03-2022
06:35 AM
Is anyone able to confirm this for me by chance? I'm trying to do some testing, but being able to find independent confirmation would be a nice comfort to me. In a Custom URL category list, is an entry like: abc.com/ equivalent to: abc.com/* ? Thanks! Thanks!
... View more
- Tags:
- pan-os
- URL filtering
03-02-2022
09:43 AM
Forgive me for this question as automation is an on-going learning thing for me. I'm trying to determine the best way to automate the process of changing the password for a local account on my firewalls en masse rather than logging into each one individually and doing it manually. Initially I thought Ansible, but after looking I am not sure there is the ability to do that with current modules. Is it possible to do this through Ansible, XSoar, API calls, etc...? Thanks!
... View more
02-23-2022
01:43 PM
1 Kudo
There is a line wrap option in SecureCRT. I have not used it personally, but it may help your problem. *** EDIT *** I just used it and it completely removed all line wraps when I tried it. Options > Session Options > Terminal > Emulation > Modes. It is the second check box from the top on my version.
... View more
01-04-2022
10:08 AM
1 Kudo
While it isn't the exact behavior I want, I determined that if I added 1e100.net and *.1e100.net to the custom URL category I created, then add that to the block rule, it blocks all youtube traffic. Granted, this will also block any google related traffic, but it is configured just for the gaming console sources, so I'm not concerned at this point.
... View more
01-04-2022
05:55 AM
@BPry wrote: @Gareth.Doyle, You can't install a certificate on an Xbox (I would assume Playstation as well) which means you won't be able to inspect this traffic at all. I would setup a reservation for the gaming systems and exclude them from decryption (the performance hit on gaming would also likely be pretty bad). Yeah, unfortunately that is the only traffic I want to decrypt, haha. I might try it and see what the results are anyway.
... View more
01-03-2022
04:07 PM
1 Kudo
The URL category did not work. I'm not sure what URLs the gaming console is reaching out to, but none of them are similar to what typical computer connectivity uses. I'm going to block QUIC traffic and that might help some, it definitely will for decryption as QUIC traffic cannot be decrypted. I don't want to decrypt game traffic, only things from the gaming console such as YouTube and internet browsing traffic. This the decryption is needed.
... View more
01-03-2022
12:07 PM
Yeah, I thought about that, but from the cursory lookups I did I don't think there's a way to do that on consoles like Xbox and PS4.
... View more
01-02-2022
04:30 PM
Hey, I appreciate that long reply! I understand how the process works, but typically I work in an Enterprise environment where we use our Enterprise root certificate and install that cert chain on all pertinent devices and key stores. I didn't want to install a public cert, I wanted to get my own cert from a CA and use that as the decryption cert to create the proxied connection. I haven't tried the URL filtering.to resolve blocking YouTube and those types of things from the gaming consoles, I'll give that a try.
... View more
01-02-2022
01:54 PM
1 Kudo
I have a PA-220 at home and want to use it to obviously protect my home, but also to help prevent my children from accessing things I feel inappropriate. Obviously with encrypted traffic from things like gaming consoles and phones this is harder to do and decryption is required. My question is, what is the best way to implement decryption on traffic from these devices without breaking connectivity due to MITM issues? Can I get a cert from a CA and use that as the proxy forwarding certificate or is there something in particular I need to do to implement this? Thanks!
... View more
11-01-2021
05:51 AM
My organization was tasked with collecting a series of debug logs on one of our firewalls every 20-25 minutes for several days due to an issue which PAN was having trouble diagnosing and/or determining the cause of. These commands took approximately 5 minutes to run to completion, so you can imagine it was not a fun weekend for the team members involved. We attempted several script efforts, but none of us are terribly proficient at scripting (a skillset we are in the process of developing). I am convinced this must be something that can be automated as it isn't a complicated process. I thought I would post here and see if anyone would refute that or if there were suggestions, ideas, or even examples of a similar process that was automated. There are 24 commands in all, some of them requiring interaction to display the end of the log output or q to exit the display. Any thoughts would be appreciated in the event that a similar task is required in the future. Thanks!
... View more
- Tags:
- 7080
- automation
07-19-2021
11:05 AM
Hey, @BPry , thanks for responding. So this traffic is going from a trusted zone to another trusted zone. When we migrated from one firewall to the PA we didn't want to inhibit this traffic (some is user support, some is server support, other is server to server service communications, etc...) so we added what is essentially a "trust to trust any" policy. We are now in the process of refining things and bringing them more into line with the capabilities of a NGFW (e.g. app ID, decryption inspection) and also cleaning up overly broad policies such as the "trust to trust any" policy. This is part of the process of removing that policy, so eventually this deny policy I plan on creating can be removed, but in the interim I would like to block the off beat traffic. I've learned my "do it all at once" lessons in the past and like to do the step by step approach these days.
... View more
07-19-2021
06:18 AM
After parsing some logging I've discovered some trends in users utilizing non-standard ports for some App IDs and I want to prevent that. The first thing that comes to mind if to create a policy only allowing the app-default port, but the issue is currently this traffic is hitting a more general permit rule at the bottom of the policy stack. We are under going a longer grooming process in which we hope to have this cleaned up, but I want to prevent this non-application-default port access before then. My next thought was to create a policy that allows app-default connectivity and list all of those applications in that policy, then a deny policy immediately below that for "any" service with all of the same applications. Does this seem to best route to anyone or does anyone have any thoughts on a cleaner way to accomplish this? I wish there was a "negate" option in the service so I could create a deny for any non-app-default and accomplish this in one policy rather than two, but as far as I know that is not an option. Thanks!
... View more
06-16-2021
12:09 PM
Yeah, but then I have to bypass decryption on AWS, Azure, and GCP IP blocks... That seems entirely unreasonable.
... View more
06-16-2021
06:21 AM
My organization is in the process of moving from one VPN solution to GlobalProtect. We are seeing several applications being unable to run certain features, or run successfully at all, and the error logs appear similar to this (I say similar because this specific message is from one application, others may vary, but all are similar): sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target A second one: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Our workstation team has tried implementing our organization's root and intermediary certificates into a specific Java cert store according to some information they found online, but the error persists. The only change was moving to GlobalProtect. I have found that bypassing our decryption policies on the Palo Alto fixes this issue, but bypassing decryption for things that often reach out to cloud resources (thereby bypassing decryption to huge chunks of the internet) is not fully acceptable. Has anyone experienced anything like this and/or have any suggestions? Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-11-2022
11:33 PM
|
Likes From
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks