About craigomatic

Update: I'm starting to get some weird behavior on my 800 series running 8.1.9, like management goes to 100% for an extended period of time, making the device unmanageable. Did I read about a memory leak? These have all been running > 30 days. I'm upgrading to 8.1.9-h4 immediately. ... View more

thanks luigi, i'll test in the lab. appreciate the feedback! ... View more

I've been on 8.1.9 on 3020s, vm-300s, 820s, 850s, 220s with no issues. I believe that is the recommended support version.   Probably want to install the latest 8.0 version, reboot, download 8.1, download 8.1.9, install 8.1.9, reboot.   Good luck   https://live.paloaltonetworks.com/t5/Customer-Resources/Support-PAN-OS-Software-Release-Guidance/ta-p/258304 ... View more

So do you think there is an issue with the parser? What PANOS version are you running? I still have not moved forward in implementing due to the high risk/low payoff and there seems to be a question whether this is really happening. Sorry it happened to you but I'm also glad I'm not crazy. ... View more

Luigi,   Just tried in 8.1.5 and was unable to reproduce error in my testing environment.  I will roll out to production cautiously and will update ... ... View more

Luigi,     PANOS release 8.1.4.   set device-group ACME  external-list edl-phishing-sites type url recurring hourly set device-group ACME   external-list edl-phishing-sites type url certificate-profile minemeld_cert_profile set device-group ACME   external-list edl-phishing-sites type url url https://10.X.X.X/feeds/phishing-url   Issue can be replicated by changing the last line:   set device-group ACME  external-list   edl-phishing-sites type   url   recurring hourly set device-group   ACME     external-list   edl-phishing-sites type   url   certificate-profile minemeld_cert_profile set device-group   ACME     external-list   edl-phishing-sites type   url   url   https://10.X.X.X/feeds/phishing-url?v=panosurl   Then most/any url categories will be defined as edl-phishing-sites. I saw google.com, bing.com, yahoo.com being classified as such.   Here's the URL filtering profile, which includes the edl:   set device-group ACME profiles url-filtering ACME-PAN-URL-Policy credential-enforcement block [ abortion abused-drugs adult alcohol-and-tobacco auctions command-and-control copyright-infringement dynamic-dns extremism gambling games hacking home-and-garden hunting-and-fishing internet-communications-and-telephony malware nudity parked peer-to-peer phishing proxy-avoidance-and-anonymizers questionable weapons web-advertisements edl-phishing-sites shortened-urls ]   Here's a policy we were using specifically to block matching category:   craigomatic@PNRM01# show | match openphish-alert set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert target negate no set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert to untrust set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert from [  trust ] set device-group ACME-LOCATIONS pre-rulebase security rules openphish-alert source any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert destination any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert source-user any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert category edl-phishing-sites set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert application [ ssl web-browsing ] set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert service application-default set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert hip-profiles any set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert action drop set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert log-setting lf-pnrm-siem set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert disabled no set device-group ACME -LOCATIONS pre-rulebase security rules openphish-alert tag Let me know if you need more info. I was able to reproduce this on my lab PA-220. I can ship you that config if that would be helpful.   ... View more

OK I sent it ... please let me know if you do NOT receive. There are four attachments but they are small txt files. ... View more

Hi Luigi,   Did you get everything you need to reproduce the error? Let me know and I can provide you with my config. Thanks ... View more

Sure it's on the way. Also included the MineMeld config. ... View more

@lmori, thanks for your response.   I'm using the EDL URL category in the "category" field as follows:   set device-group LOCATIONS pre-rulebase security rules openphish-alert target negate no set device-group LOCATIONS pre-rulebase security rules openphish-alert to untrust set device-group LOCATIONS pre-rulebase security rules openphish-alert from [ trust ] set device-group LOCATIONS pre-rulebase security rules openphish-alert source any set device-group LOCATIONS pre-rulebase security rules openphish-alert destination any set device-group LOCATIONS pre-rulebase security rules openphish-alert source-user any set device-group LOCATIONS pre-rulebase security rules openphish-alert category edl-phishing-sites set device-group LOCATIONS pre-rulebase security rules openphish-alert application [ ssl web-browsing ] set device-group LOCATIONS pre-rulebase security rules openphish-alert service application-default set device-group LOCATIONS pre-rulebase security rules openphish-alert hip-profiles any set device-group LOCATIONS pre-rulebase security rules openphish-alert action drop set device-group LOCATIONS pre-rulebase security rules openphish-alert log-setting lf-pnrm-logr-alienv set device-group LOCATIONS pre-rulebase security rules openphish-alert disabled yes set device-group LOCATIONS pre-rulebase security rules openphish-alert tag   This particular feed is using the openphish URL feed.   I can't attach a .txt file so that's why it was a pdf. Here is the dump of the edl WITHOUT the ?=panosurl flag.   BTW before I do this, do you really want me to paste >2000 lines into this thread? Here's a sneak preview:   vsys1/edl-phishing-sites: Next update at : Fri Jan 4 09:00:36 2019 Source : https://10.X.X.X/feeds/phishing-url Referenced : Yes Valid : Yes Auth-Valid : Yes Total valid entries : 2108 Total invalid entries : 74 Valid urls: http://venuesearch.in/include/santan/details.htm http://venuesearch.in/include/santan/questions.htm http://fgs.ge/wp-admin/css/css/bp/2f10f/cyberplusauthentification/final.php http://fgs.ge/wp-admin/css/css/bp/2f10f/cyberplusauthentification/num.php http://etajerki.ru/sites/all/modules/ckeditor/ChaseBank/Chase%20Bank/securechase/chaseonline.chase.com/Logon.aspx/confirmyouridentity.php http://etajerki.ru/sites/all/modules/ckeditor/ChaseBank/Chase%20Bank/securechase/chaseonline.chase.com/Logon.aspx/unabletologon.html http://etajerki.ru/sites/all/modules/ckeditor/ChaseBank/Chase%20Bank/securechase/chaseonline.chase.com/Logon.aspx/verifyyouraccount.html http://30dayaffiliatechallenge.com/wp-content/plugins/revslider/admin/views/system/.../china/?login=jim@thejimburkefamily.com http://cesy.edu.mx/wp-admin/css/colors/chase/chase/home/auth/index.php http://city-sm.ru/administrator/components/com_installer/helpers/mtch/match http://d2gconsult.com.br/1c543ee7f3c60f6a7047d71b999da39dMzQzZjEzYjRmNmQ2MzNmYmJkZDMyNjc2NGNlMjRjMTM=/myaccount/websc_login/?country.x=&locale.x=en_ http://imroadrunner.com/dev/www.loginalibaba.com/alibaba/alibaba/login.alibaba.com.php?email=anko@anko.com.tw http://ledutech.org.br/logs/js/fix/f8870 http://msrebeco.cl/A1/dl/DHL.htm http://nygift19.com/atb/index.html http://nygift19.com/atb/questions.html http://nygift19.com/bnc/National%20Bank%20Online.html http://nygift19.com/cibc/index.php http://nygift19.com/cibc/question.html http://seediest-aids.000webhostapp.com/2/authws/1/login.php http://venuesearch.in/include/santan/ssanta.htm     ... View more

I was able to reproduce this at will on several systems running PANOS 8.1.4.   name@fw(active)>  request system external-list show type ip name edl-phishing-sites  vsys1/edl-phishing-sites: Next update at : Thu Dec 27 16:00:02 2018 Source : https://10.x.x.x/feeds/phishing-url?v=panosurl Referenced : Yes Valid : Yes Auth-Valid : Yes Total valid entries : 2013 Total invalid entries : 59   Went through the entire text and did not find a string or consecutive wildcards together. Can't figure out why this would have recategorized pretty much every common domain as edl-phishing-sites. Thankfully I deny all traffic to those sites with my policy. We had a connectivity issue for about 5 minutes until I could back everything out. What a pita.   Attached the output of the "request system external-list" command. Sorry came out really huge when I converted to pdf. ... View more

Thanks for the post; although I found it after I had experienced the same thing; however, my list did not include a *.com or *.it.   name@fw(active)>  request system external-list show type ip name edl-phishing-sites  vsys1/edl-phishing-sites: Next update at : Thu Dec 27 16:00:02 2018 Source : https://10.x.x.x/feeds/phishing-url?v=panosurl Referenced : Yes Valid : Yes Auth-Valid : Yes Total valid entries : 2013 Total invalid entries : 59   Went through the entire text and did not find a string or consecutive wildcards together. Can't figure out why this would have recategorized pretty much every common domain as edl-phishing-sites. Thankfully I deny all traffic to those sites with my policy. We had a connectivity issue for about 5 minutes until I could back everything out. What a pita. ... View more

Had the same issue, unable to complete installation due to missing DLL. Tried installing and running msi as admin from the command prompt (Windows 10) to no avail. This was compounded by the issue that the GP uninstall did not work, and neither did the Windows Remove Software work. All failed because of missing DLL.    Support suggested to download/install the following DLL package from Microsoft   https://support.microsoft.com/en-in/help/3138367/update-for-visual-c-2013-and-visual-c-redistributable-package   After installing and rebooting (required), the installed Global Protect program began working. This resolved my issue.    So if you are rolling out with SCCM, check that the DLL is present, if not, this is an exe file that will require a reboot, then install the GP msi.    ... View more

You may have figured this out by now.   I'm using stdlib.feedHCWithValue.    You can probably change the confidence level but you must use WithValue due to the list format.   ... View more