This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Fr4nk4
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Fr4nk4
02-03-2021
21Posts
1Like
1Solution
Feb 03, 2021Last Visited
User
Activity
User
Profile
Latest posts by Fr4nk4
| Subject | Views | Posted |
|---|---|---|
| 3014 | 05-28-2020 11:43 AM | |
| 3007 | 05-20-2020 04:39 PM | |
| 6429 | 04-21-2020 10:00 AM | |
| 6677 | 04-13-2020 04:22 PM | |
| 2972 | 02-07-2020 11:37 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 12-19-2019 11:37 PM |
User Badges
Community Statistics
| Member Since | 01-26-2018 09:42 AM |
| Date Last Visited | 02-03-2021 01:05 PM |
| Posts | 21 |
| Total Likes Received | 1 |
05-28-2020
11:43 AM
Does anybody know how to mitigate this vulnerability? This is being detected on our PA-3020 series firewalls running PAN OS 8.1.13.
... View more
05-20-2020
04:39 PM
We have a PA-3020 firewall pair that has multiple IPsec tunnels to a VM series pair in AWS. We have 4 IPsec tunnels that we run to the firewalls. They are: Tunnel A - On Prem to AWS FW1 over Direct Connect Tunnel B - On Prem to AWS FW2 over Direct Connect Tunnel C - On Prem to AWS FW1 over Public Internet Tunnel D - On Prem to AWS FW1 over Public Internet We also have BGP routing in place and peer with the AWS FW1 and FW2. If I test killing BGP on FW1 in AWS, our PA-3020 automatically routes traffic to Tunnel B, and within 15 seconds, we are sending traffic to/from FW2. That part works perfectly. However, if I down Tunnel A from the AWS side, we stay down indefinitely. BGP knows to send traffic to Tunnel B, but communication over Tunnel B does not occur. Security policies on the on prem firewall and AWS FW1 and FW2 allow for BGP and IPSec communication for all the tunnels. I have tried Static Route monitoring, where you create the same route for the AWS traffic, but create different Metrics for each route which would use different tunnels. For example: 172.16.0.0/16 Route A 172.16.0.0/16 via Tunnel A Metric 10 Route B 172.16.0.0/16 via Tunnel B Metric 15 Route C 172.16.0.0/16 via Tunnel C Metric 20 Route D 172.16.0.0/16 via Tunnel D Metric 10 I have also enabled tunnel monitoring, and allowed pings to/from each firewall. I know that the static routes are no longer required since we use BGP, but what would be the preferred method in order to get the on prem firewall to automatically use Tunnel B if Tunnel A went down? Would a PBF profile be in order?
... View more
04-21-2020
10:00 AM
I've posted this on a couple forums now, and it seems like this is an issue regardless of which VPN solution you use. That option to register this connection's address in DNS is a default option in our Windows 10 image. We got around it by looking up the GP IP for the user, edit our hosts file entry with the GP IP and the FQDN, and then issuing the following commands to remotely connect to the computer and uncheck that DNS option. We eventually put this into a script, and now a GPO. #Connect remotely to multiple computers using admin Account Enter-PSSession –ComputerName mycomputername –Credential domain\username #Check to see if DNS registry option is checked Get-NetAdapter Ethernet | Get-DNSClient Get-NetAdapter Wi-Fi | Get-DNSClient #Sets the DNS Registry option on Ethernet interface to False (turns off) Get-NetAdapter Ethernet | Set-DNSClient –RegisterThisConnectionsAddress $False Get-NetAdapter Wi-Fi| Set-DNSClient –RegisterThisConnectionsAddress $False #Force ipconfig /registerdns Register-DnsClient
... View more
04-13-2020
04:22 PM
Like many organizations, we have had to enable VPN access for more individuals during the COVID-19 crisis. We recently noticed that about half of the 42 machines display their home's local LAN IP address in our DNS server. This is in addition to the IP address that GlobalProtect issues. One of my sysadmins pointed out a way to fix this is to disable the Register this connection's addresses in DNS feature on the Ethernet or wireless NIC adapter in Windows 10 (not the PANGP adapter). This would stop the adapter from sending the 192.168.x.x IP to our DNS server and adding it to the A record. Is there another way to get around this?
... View more
02-07-2020
11:37 AM
I talked to Palo Alto TAC, and this looks like it is fixed in 8.1.12 and 9.0.5. This is in the 8.1 Addressed Issues page, and the bug ID is PAN-126534.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks