Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About fhewiufhwefhwe
About fhewiufhwefhwe
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Online
37Posts
2Likes
4Solutions
Jul 16, 2020Last Visited
User
Activity
User
Profile
Latest posts by fhewiufhwefhwe
| Subject | Views | Posted |
|---|---|---|
| 24 | 39m ago | |
| 102 | Friday | |
| 85 | a week ago | |
| 232 | a week ago | |
| 255 | a week ago |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 | 2 weeks ago |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 |
User Badges
Public Statistics
| Date Registered | 07-16-2018 07:13 AM |
| Date Last Visited | 14 seconds ago |
| Total Messages Posted | 38 |
| Total Likes Received | 2 |
39m ago
External ipaddress 23.35.182.93 is getting incorrectly mapped to a rule "Permit Intranet Sites". The rule uses a Urlcategory for Intranet sites and the destination has trust/untrust zones with a negate on one specific destination address. What might cause the firewall to misapply rules if the dns to ipaddress mappings are effectively static? I also have noticed on more than a few instances of policies with UrlCategory being applied incorrectly, many of which are external ipaddresses.
... View more
Friday
Any one have a good handling on where to set dos counter thresholds for alerting via SNMP? Also trying to figure out what are the best ~50 sensors to monitor for the firewall via SNMP. pan tcp drop packet, pan flow dos pf strict ip, and pan flow dos pf icmperr look potentially interesting in my particular environment.
... View more
a week ago
Example of SNMP monitoring. That being said, it is painful / somewhat manual to setup.
... View more
a week ago
I did not mean the threshold under Reconnaissance Protection. I mean the threshold under Flood Protection. The defaults are 10,000 fro Alarm Rate and Activate, and 40,000 for maximum connections/sec.
... View more
a week ago
This article might help. I've been meaning to read it myself and figure out how to setup snmp monitoring for DoS. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOKCA0
... View more
a week ago
Have you tried increasing the thresholds under SYN Flood Protection then? How high is your firewall on resource utilization? I'm wondering if you might be able to use SYN Cookies instead of Random Early Drop action? Note that I have not tried this myself. I'm also thinking that you might want to setup SNMP monitoring the DoS counters on the firewall. I recently tried to configure this, but have not had success yet.
... View more
a week ago
DNS does use UDP, but can also use TCP over port 53 as well. Any way if you have site-to-site vpn or something similar, you may want some exclusions to Dos / Zone protections policies.
... View more
a week ago
Do you have source address exclusions under Reconnaissance Protection? You may want to include highly trusted items on your allow list there, such as internal DNS forwarders if you have them.
... View more
a week ago
Did you look under Objects -> Security Profiles -> Dos Protection? Th default block duration is 5 minutes..
... View more
2 weeks ago
Finally figured out the missing step from another article. I need to go to Device -> Setup -> Session -> Decryption Certificate Revocation Settings https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/certificate-management/set-up-verification-for-certificate-revocation-status/configure-revocation-status-verification-of-certificates-used-for-ssltls-decryption.html
... View more
2 weeks ago
Found a solution. When I added satellite tunnel and allowing authentication from local auth or certificate, the issue went away.
... View more
2 weeks ago
I am trying a possible solution from another user's post after being unsuccessful resolving this for a while https://live.paloaltonetworks.com/t5/general-topics/rdp-freeze-fix-globalprotect/m-p/335816/highlight/false#M84643 They said the following: We struggled with the RDP freezing issue with GlobalProtect for a long time. The initial "fix" was to disable UDP for RDP in the registry. This fixed the issue for many users but also slowed down the RDP performance. We thought the issue was with GlobalProtect but after troubleshooting with Palo Alto we were able to see that at some point the remote PC just simply stopped sending RDP packets. We opened a case with Microsoft and they gave us a registry fix to try that fixed all our RDP freeze issues and allowed us to re-enable UDP for RDP. Important: This regedit goes on the machine you are remoting into, not the machine you are remoting from. HKLM\SOFTWARE\Microsoft\Terminal Server Client UseURCP (Create this new DWORD with value of 0) You can use this from a command prompt as long as you have admin privileges on the box: REG ADD "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v UseURCP /t REG_DWORD /d 0 /f If you previously disabled UDP for RDP you can re-enable it.
... View more
2 weeks ago
Thanks for sharing. I hope this works. I've been taking packet captures on the firewall and the machine remoting into to try to figure this out.
... View more
2 weeks ago
Following https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIzCAK, I created an OCSP responded. When creating the user certificates, for signed by I tried both the Root and Intermediate certificate. I allowed HTTP_OCSP on both device->setup->Interfaces->Management as well as Network->Interfaces->Network Profiles->Interface Mgmt that corresponds to my interface. I also created a security policy to all ocsp from my machine to the firewall. From the CLI, when I typed in the command: debug sslmgr view ocsp all Nothing is coming back however. Any idea what could be the problem? Do I have to download the certificate and try to use it with vpn before the debug sslmgr view oscp all command will show anything?
... View more
06-03-2020
09:17 PM
Thanks, that makes sense.
... View more
06-03-2020
09:18 AM
In File Blocking Security Profile, I am blocking encrypted pdfs. Looking at the Data Filtering Logs, every few seconds office365-enterprise-access application is trying to download encrypted pdf and it gets denied. There also is not file name listed, so it's not clear how I can attribute this to a message and delete it. How are other people handling this? Is there a way to stop the constant retries without permitting download of encrypted pdfs? With very limited exceptions, I don't want users to be able to download encrypted files. If something is sensitive, I'd rather it was sent via a secure ftp site.
... View more
05-29-2020
10:26 AM
Thanks, I will take a look at PRTG. I already am forwarding logs to two Syslog servers, but also didn't see the alarms there.
... View more
05-29-2020
09:40 AM
I downloaded system logs to csv. While I see when I manually cleared logs that were near capacity, I do not see any warnings about logs being full. Do you happen to know the type, event, or description key word? I looked at everything with log in the description, and didn't see it.
... View more
05-29-2020
06:24 AM
Instead of seeing alarms when I login to the web GUI, how can I get alarms forwarded? I'd like to send to SysLogs and also receive via email.
... View more
05-26-2020
03:58 PM
As a workaround, I had to create a series of block rules with every file type except those I want to allow. This circumvented the issue with the truncated lists.
... View more
05-22-2020
06:17 AM
Thank you!
... View more
05-18-2020
11:16 AM
I'm trying to permit download of gif, jpeg, mpt4, png, svg, webp, and woff, and deny everything else in both directions. I tried 1) setting up a block rule for any file type in both direction and an allow rule for the file types above for download only 2) setting up the allow rule, and then updating the block rules manually selecting every single listed file type except those above Later on, I saw that the list of file types in the block rule got truncated (dangerously). For that reason, I went back to approach 1), where webp files are still being blocked. How can I safely get the rules to work properly?
... View more
05-18-2020
06:40 AM
Mine occurred after downloading renewed yearly subscriptions, or perhaps just the first time I noticed it. I am on 9.0.8.
... View more
05-17-2020
07:26 AM
Under Device -> Setup -> Management -> Device Certificate, I am unable to fetch the device certificate. A message box says get your one-time-password from the Customer Support Portal and enter it below. I tried my 2-factor OTP that I use to login to the support portal, but that doesn't work. How do I generate the OTP to get the device certificate? I get the error: Failed to fetch device certificate.OTP is not valid
... View more
04-15-2020
02:51 PM
GlobalProcect agent disconnects. Nslookup still points at internal network DNS resolvers specified by the gateway, not the OS dns resolvers such as 8.8.8.8 for google dns.
... View more
04-14-2020
12:02 PM
I am using GlobalProtect 5.09 with PanOS 9.0.7. While using dual monitors with a split-tunnel VPN, I find that when VPN disconnects dns resolution is still trying to use internal dns servers. I am forced to reboot my desktop at home multiple times per day when using remote desktop with two monitors, or to use rdp on a single monitor. The dual monitor remote session freezes multiple times per day, often requiring me to signout of windows. After the signout, I no longer have DNS resolution and have to reboot. Same thing happens with VPN disconnects. Any workarounds? Should I use external DNS as a secondary in the GlobalProtect gateway settings? I also had the same problem with the prior version of GlobalProtect client and PanOS.
... View more
- Tags:
- globalprotect
03-24-2020
05:53 AM
Forced to use the exception route. No option to get a human to look at the url, only the possibility to change it from travel to CDN.
... View more
03-23-2020
04:07 PM
thumbnails.trvl-media.com used by www.hotels.com to host its images is classified as a high risk site If this is a false positive, how do I get Palo Alto DNS Service to take a second look or find out why it's classified as high risk? How are other people using the high risk category? Are they using url blocking, sink-holing, or custom file blocking policies because of false positives?
... View more
Contact Me
| Online Status |
Online
|
| Date Last Visited |
14 seconds ago
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
