This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About jlieberman
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About jlieberman
06-02-2021
18Posts
0Likes
0Solutions
Jun 02, 2021Last Visited
User
Activity
User
Profile
Latest posts by jlieberman
| Subject | Views | Posted |
|---|---|---|
| 7187 | 10-14-2020 04:32 PM | |
| 4047 | 09-28-2020 05:16 PM | |
| 6503 | 09-25-2020 02:39 PM | |
| 4603 | 09-24-2020 04:43 PM | |
| 4605 | 09-24-2020 04:40 PM | |
| 6556 | 09-24-2020 04:30 PM | |
| 6757 | 09-24-2020 01:24 PM | |
| 4728 | 09-24-2020 11:05 AM | |
| 5063 | 05-06-2020 12:54 PM | |
| 5473 | 05-02-2020 10:55 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 11 Likes | |||
| 3 Likes | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 04-12-2018 08:33 PM |
| Date Last Visited | 06-02-2021 08:36 AM |
| Posts | 18 |
10-14-2020
04:32 PM
Has anyone worked out a way to install minemeld in Ubuntu 18.04?
I was using https://live.paloaltonetworks.com/t5/minemeld-articles/manually-install-minemeld-on-ubuntu-16-04/ta-p/253336 to install Minemeld into Unbuntu 18.04.
When I get to Step 9 and run the following cmd to check that minemeld is installed and running I get the following
sudo: /opt/minemeld/engine/current/bin/supervisorctl: command not found
I cannot get past this.
Any help would be greatly appreciated.
... View more
09-28-2020
05:16 PM
I've no idea why, but it seems that my URL-filtering DB started working today.
... View more
09-25-2020
02:39 PM
@OtakarKlier I tried that method for us.pool.ntp.org but it isn't catching the IPs that end up being used. I think this pool uses a different method because they pick a random address from a pool of 600+. The pool can change from 1 day to the next. I think I might just push them to use nist instead since that is a more reliable source that I can lock down.
... View more
09-24-2020
04:43 PM
@aleksandar.astardzhiev as can be seen at https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNx4CAG Additional Information The below commands do not work on OS 9.0.x but will work on prior OS versions and will fix the Pan-DB 0000.00.00.000 issue: > request url-filtering download paloaltonetworks region <region_name>
> request url-filtering download status vendor paloaltonetworks
... View more
09-24-2020
04:40 PM
@aleksandar.astardzhiev Thank you for the prompt reply but that seed file is a thing of the past and no longer used in PANOS 9.0 and later. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/url-filtering/troubleshoot-url-filtering/pan-db-cloud-connectivity-issues.html
... View more
09-24-2020
04:30 PM
Thank you for the prompt reply. I have already tested both methods and neither work. I thought the FQDN approach might work but it did not. That is when I tried the 2nd approach and then quickly saw that no URL is being identified. Your explanation makes perfect sense. The problem with the FQDN approach is simple. If you go and resolve us.pool.ntp.org you will get maybe 4 IP addresses back. But really there are 549 active servers in that zone. https://www.pool.ntp.org/zone/us . When you use pool.ntp.org, it will determine which is the closest server to you and use that one. These change daily and there is no way for me to specify a single IP as it might not be valid tomorrow.
... View more
09-24-2020
01:24 PM
I have a requirement to allow the internal NTP servers to sync with ONLY US.pool.ntp.org. I have tried creating the rule 2 different ways. Create a address object using FQDN for us.pool.ntp.org and use that in the rule destination. This doesn't work as there are like 500+ ips behind that pool Create a custom URL category for us.pool.ntp.org and use that as criteria in the rule. This doesn't work either. It seems the traffic is not being given a URL category. I see it listed as ANY. How best can I create this security policy to limit NTP updates to the us.pool.ntp.org?
... View more
09-24-2020
11:05 AM
The firewall is running 9.1.4 (5250). The mgmt interface does not have general internet access so service routes have been configured for the following to use the external interface (internet connected): DNS EDL NTP Palo Alto Networks Services URL Updates Policy is created to allow outbound traffic to the internet sourced from the external IP (NAT in place as well). NTP is working NTP state: NTP synched to 1.us.pool.ntp.org NTP server: 0.us.pool.ntp.org status: available reachable: yes authentication-type: none NTP server: 1.us.pool.ntp.org status: synched reachable: yes authentication-type: none Support check is good Contact Us https://www.paloaltonetworks.com/company/contact-us.html Support Home https://www.paloaltonetworks.com/support/tabs/overview.html Manage Cases https://support.paloaltonetworks.com/pa-portal/index.php?option=com_pan&task=viewcases&Itemid=100 Click the contact link at right. May 30, 2021 Premium 24 x 7 phone support; advanced replacement hardware service but URL DB is not being updated PAN-DB URL Filtering License : valid Cloud connection : not connected URL database version - device : 0000.00.00.000 URL protocol version - device : pan/0.0.2
... View more
05-06-2020
12:54 PM
I can confirm what @mivaldi has said. After removing the exception, traffic to the domain is no longer being flagged.
... View more
05-02-2020
10:55 AM
This morning I starting noticing that my threat logs are filling up with sinkhole actions for the following Suspicious DNS Query (search-api-disney.svcs.dssott.co) Suspicious DNS Query (dssott.com) Threat Type spyware Threat Name DNS Tunneling Domain ID 109001001 (View in Threat Vault) Category dns-security Content Version AppThreat-0-0 Severity high Repeat Count 1 File Name URL Suspicious DNS Query (search-api-disney.svcs.dssott.co) To get the site working again I have added a DNS signature exception for thread-id 109001001 Is it possible to except certain domains rather than the entire threat-id? I fear that I am excepting more than just the domains I'm interested in.
... View more
04-26-2020
12:42 PM
I am seeing lots of alerts for Name: Non-RFC Compliant SSL Traffic on Port 443 Unique Threat ID: 56112 to 31.13.70.50 which belongs to Facebook. However, the device (android mobile phone) that is causing the alerts does not have facebook app installed.
... View more
12-21-2019
07:43 PM
I have applied the above config and restarted mysql but still see
Verify that the Log_bin flag in MariaDB is set to off
For me the answer was that the conf file that needs editing is called /etc/mysql/my.cnf
now all green!!
... View more
12-04-2019
11:41 AM
Thank you Sven for the tips.
You mention existing scripts. When can I find those? Any chance to test out the beta script as well. Would be happy to report on my experience with it to help with the debug and improvement.
Thank you for your time on this matter,
... View more
11-19-2019
01:25 PM
Looks like I am able to get an html output with tables using the SonicReader v0.5.
Still looking for any other tips that would help a migration from SonicWall to PAN.
... View more
11-19-2019
01:14 PM
I am starting a sonicwall to PAN migration and I am having issues getting the sonicwall.exp file into a csv file. I open the .exp file in the SonicReader v0.7 and get an error " Could not properly parse configtext; Hashes are empty!" . I still am able to view the raw text. When I try and view the HTML report I just see "Please wait. Processing..." and never get a html file.
How to proceed with this? Is there another way to get the .exp or raw text file into a tabled format that could be used as a csv to import into expedition?
Any help on this would be greatly appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-02-2021
08:36 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks