About jhochberg

@Timotheous ,   Thanks for your question!   As I'm sure you're aware, Minemeld is an open-source solution that is available to anyone who wants to run it. Due to it's open-source nature, there is no official support for it. I think it's best to look at your requirement(s) and determine whether it makes sense to build something on your own, or look at other methods/solutions to achieve the desired outcome.   That said, there are a couple of things that I'd recommend you take a look at:   1. Demisto - Palo Alto Networks acquired Demisto earlier this year and the product is a comprehensive Security Orchestration, Automation, and Response (SOAR) solution. Demisto has an incredibly vast ecosystem of products that it integrates with including Palo Alto Networks Next-Generation Firewall, Minemeld, and ServiceNow. You can create "playbooks" to automate SOC processes and standardize workflows. There's a "community edition" as well as an "enterprise edition". The community edition is supported through the Demisto community - the enterprise edition:   This link will allow you to view the Demisto Data Sheet: Demisto Data Sheet    2. Palo Alto Networks AutoFocus is an officially supported threat intelligence platform that provides access to Palo Alto Networks' massive repository of threat intelligence and is consumable as a feed very similar in nature to Minemeld. There's an option for an AutoFocus-hosted version of Minemeld that removes the need for you to operate and maintain a locally hosted version of Minemeld.   This link will allow you to access the AutoFocus Data Sheet:   AutoFocus Data Sheet   Additionally, this is a link to information on the AutoFocus-hosted version of Minemeld - a chapter within the AutoFocus Administrators Guide:   AutoFocus Hosted Minemeld   ServiceNow offers an integration with AutoFocus:   ServiceNow Store: Palo Alto Networks AutoFocus for Security Operations   ServiceNow: Palo Alto Networks - AutoFocus Integration Overview   And here are details on how to configure the ServiceNow integration with AutoFocus:   ServiceNow: Activate and Configure Palo Alto Networks AutoFocus Integration   Please let me know if you have any additional questions.   Thanks for your interest in Palo Alto Networks!   -JeffH   Jeff Hochberg | Senior Solutions Engineer - Product Partnerships Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

Hello again,   One thing I forgot to mention...   It is common for customers using SAML to layer Identity Providers. In many cases, I've seen customers leverage both Duo and Active Directory Federation Services.   You can read more about this on the Duo Security site - scroll down to the bottom of the following page:   Duo Protection for Palo Alto Networks SSO   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.   ... View more

@singhup thanks for your response!   @HengTIDC please try the recommended solution and let us know if that works for you.   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

EXCELLENT! I'm glad that worked for you!   If you would please be so kind as to select the 'Accept as Solution' button, that would be great!   Thanks for the follow-up!   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

Hello,   Thanks for your question! It's an excellent question and is something that I've heard many times before from people moving to SAML-based authentication.   When authenticating against a SAML Identity Provider, whether it's Duo Security, ADFS, or other, the Identity Provider (IdP) generates a SAML assertion upon successful authentication, sends it to the user's browser, redirects the browser to the Service Provider (SP) - in your case the SP is Palo Alto Networks GlobalProtect, then the browser submits the SAML assertion. At that point, the user is authenticated and permitted access based on the policy configured in GlobalProtect.   Here's the catch! The Service Provider trusts information within the SAML assertion provided it comes from a trusted Identity Provider and the assertion is signed appropriately and has not expired. The Service Provider parses the contents of the assertion and looks for the attribute/value pairs contained within, at which point it can use them in the authentication process.   If the IdP doesn't send the attribute/value pairs you want to use in policy, then it's not possible to use them. I suspect this is the case you are running into.   My recommendation would be to review the Duo Security documentation and add the attribute/value pair details to the application within the Duo Security admin portal. If you're looking for the AD domain name, there should be an option to insert that info in the assertion. Likewise, if you're looking for AD group membership, there's an option to insert that into the SAML assertion.   Once you have the desired attributes in the assertion, you can configure authentication policy within GlobalProtect to parse the assertion and look for the desired values, then apply them to the policy as required.   I hope that's helpful! Please let me know if this solves your issue or if you need more assistance.   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

Hello,   Thanks for your question! This is an awesome use-case however, it's not one that we natively support at this time. There are other customers that have expressed interest in this capability.   If there's a chance you're running in a hybrid mode and have a Windows Server running AD and synchronizing with Azure AD then, of course, you can use the User-ID agent to communicate with the domain controller. SAML authentication works great with GlobalProtect, but it is not intended for use with User-ID.   If you'd like, you can contact me directly (email is first initial last name - no spaces or hyphens [at] paloaltonetworks[dot]com and provide me with your contact information, I'd be happy to add you to the enhancement request list.   Thanks for reaching out!   Best regards,   -JeffH   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA Mobile: 404.432.1112 | www.paloaltonetworks.com   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.     ... View more

Hello,   Unfortunately, this forum isn't intended to help you with configuring a system from the ground up. Have you reviewed the VM-Series Deployment Guide? There's an entire section devoted to deploying VM-Series in AWS and it's very comprehensive.   There are also numerous resources on the Palo Alto Networks website that cover auto-scaling within AWS and even sample scripts to use specifically designed for use in AWS.   Set Up the VM-Series on AWS https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-aws.html#   VM-Series Auto Scale Template for AWS Version 2.0 https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/auto-scale-vm-series-firewalls-with-the-amazon-elb/autoscale-template-version2_0.html#   Cloud Integration - AWS Scripts and Templates (right side of the page) https://live.paloaltonetworks.com/t5/Cloud-Integration/ct-p/Cloud_Templates   The other option would be to contact technical support and request configuration assistance from them. If you selected one of the Pay-As-You-Go options, it should automatically include technical support and they can assist you with the VM-Series setup.   I highly recommend reviewing the resources available via the links I provided above before pursuing any additional options. I think you'll find there's a wealth of great self-service information available.   Please visit   https://support.paloaltonetworks.com   or call:   US: 866 898 9087; Int'l: +1 408 738 7799 EMEA Support: +31 20 808 4600 APAC Support: +65 3158 5600   Good luck!   -JeffH   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA Mobile: 404.432.1112 | www.paloaltonetworks.com   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

Hello,   You might want to try to perform the import from the command line to see if that helps. You will need to have an SCP or TFTP server available on which to host the metadata file.   scp import idp-metadata profile-name ADFS-SAML-PROFILE from <USERNAME>@<SCP/TFTP SERVER ADDRESS>:logs\FederationMetadata.xml   The aforementioned example assumes you are using an SCP server.  Substitute 'scp import' with 'tftp import'. Remember, you do not need to provide a username when using TFTP as TFTP does not permit for authentication.   Please let me know if that works for you.   -JeffH   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA Mobile: 404.432.1112 | www.paloaltonetworks.com   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.   ... View more

Hello,   I do not know enough about WLC CAPWAP connections to even begin to assist with debugging this. More than likely, you would have to take packet captures to see what is going on at layers 2 and 3 to debug this issue.   This type of question really needs to be worked through a support case. Have you opened a case with Palo Alto Networks Tech Support?   Please visit https://support.paloaltonetworks.com or call:   US: 866 898 9087; Int'l: +1 408 738 7799 EMEA Support: +31 20 808 4600 APAC Support: +65 3158 5600   Thank you,   -JeffH   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA Mobile: 404.432.1112 | www.paloaltonetworks.com   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.   Please let me know if you run into any issues with opening a support case.   -JeffH ... View more

I could only submit 3 attachments on the last post. There is one additional attachment on this post.   I hope this is helpful! ... View more

Hi Igor,   Apologies but I do not understand what you mean:   "No, I have one PaloAlto in my office that connect to FW on DC via IPsec Tunnel but when I go home I take with me the firewall to connect from home"   Let me try to break this down:   1. You have a firewall in your data center - what kind of firewall is in the data center? Is it another Palo Alto firewall? Or something else? Is it safe to assume that the firewall in the data center has a static IP address? 2. You have a Palo Alto firewall in your office - you then take that firewall home with you and you want it to be able to connect to the same firewall at the data center?   This is what you need to do...   The Palo Alto firewall that you bring to your office and back home - that firewall must initiate the connection to the data center firewall.   If the firewall in the data center has a static IP address, you can define the "Peer" by IP address in the Palo Alto firewall you move between locations.   If the firewall in the data center has a dynamic IP address, you should configure that firewall to perform a Dynamic DNS registration. That way, you can configure the "Peer" by the fully qualified domain name instead of by IP address.   In either case, the VPN must be configured for "aggressive" mode instead of "main" mode. You can only use "main" mode if the peer IP addresses are static on both ends of the VPN tunnel.   I created some sample configurations - take a look at the screenshots attached to this message.   ... View more

Fascinating! Thank you for the additional context.   There's plenty to be said for having total control of your solution end-to-end.   And, of course, I'm glad you were able to rule out the firewall as the issue!   All the best!   -JeffH   ... View more

Ayman,   Thank you for the additional context.   Candidly, it's difficult to recommend any "best practices" here because of what's lost by deploying a proxy between the users and the firewall.   Out of curiosity, why would you not leverage the URL-Filtering and User-ID capabilities present in the firewall? In doing so, you are able to leverage Active Directory authentication and authorization for per-rule enforcement.   You would greatly simplify your environment and have a lot more visibility from one location if you collapsed these functions into the firewall.   Not to mention, if you're looking to take advantage of the inspection capabilities within PAN-OS, by deploying a proxy behind the firewall, you lose the ability to leverage SSL-Decryption. Given the vast majority of HTTP traffic is SSL encrypted, all of that traffic would pass through the firewall and not be inspected.   And, unless the proxy supports WCCP (or similar), the firewall logs would show all outbound access coming from the egress IP address on the proxy server.   The only advantage I see in deploying a proxy is in taking advantage of caching for increased performance - I don' t know that the performance gain is worth the sacrifices made to the overall security posture.   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

Hello,   This is a very interesting issue. I did a little bit of research on this and found something that I think is worth trying.   There's a capability within PAN-OS called "Application Override" whereby you can force the firewall to alter how it performs application/protocol enforcement.   Please look at the following article in the Palo Alto Networks Knowledge Base:   SIP Application Override Policy https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClouCAC   Try that first. If that helps, then I would suggest trying to re-enable the SIP ALG to restore the enhancements it provides.   Please come back and let me know if this is helpful!   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.   ... View more

Hello,   There are no official integrations with Cisco's IPS solution.   If you're interested in doing some custom integration, the Palo Alto Networks APIs are well-documented.   PAN-OS and Panorama API Guide (9.0) https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-panorama-api.html   There is a drop-down selector on that page where you can view the documentation for earlier versions of PAN-OS.   Starting with PAN-OS and Panorama, there is a new REST API that co-exists with the XML-based API!   Thanks for your question!   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.   ... View more

Hello Igor,   If I understand correctly, you have two Palo Alto firewalls, each of which has WAN interfaces that obtain their IP addresses via DHCP. Is that correct?   Next, you require the ability to configure site-to-site VPN between these firewalls but do not want to have to make configuration changes each time the firewalls are moved, or if the DHCP-assigned IP address changes. Is that also correct?   If my understanding of both cases is correct, then you can accomplish this through two steps:   1. Dynamic DNS - you will need a DNS provider that supports Dynamic DNS registration - the site-to-site VPN connectivity can be configured such that the firewalls do not need to know the IP address of the remote gateway. Ensure that DDNS is enabled on the external/WAN interface:   Configure Dynamic DNS Registration for Firewall Interfaces https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/configure-dynamic-dns-for-firewall-interfaces   2. IPSec Site-to-Site VPN in Aggressive Mode via FQDN - when you go to configure the IKE Gateway objects define the remote gateway by FQDN as opposed to by IP address.   IKE Gateway General Tab (specifically the Local and Remote Identification settings)   https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-ike-gateways/ike-gateway-general-tab.html#   The documentation specific to IKE Gateway settings for PAN-OS 8.1 is labeled differently on the Documentation portal:   FQDN Support for IKE Gateway Peer IP Address https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/networking-features/fqdn-support-for-ike-gateway-peer-ip-address   Please come back if you have any additional questions. Thanks again for reaching out!   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.   ... View more

Hello,   The message body of this post (TACACS issue) doesn't seem to correlate to the subject line (Policy Based Forwarding).   Have you opened a support case regarding the TACACS message you posted?   Which version of PAN-OS are you running on your firewall?   I know there was at least one case where a bug was identified based on how the firewall was sending an invalid message to the TACACS+ server - the resulting behavior was logged the same as you depict in your post. That particular issue was fixed in PAN-OS 8.0.15.   Please keep in mind that there will always be cases where further investigation is required in order to obtain the root cause before a final resolution is determined. If you are still experiencing this issue, I would recommend that you open a support case to get assistance with this.   Thanks for your post!   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

Hello!   Thanks for posting such a great question! Yes, it should be possible to configure this. The User-ID facility within PAN-OS offers administrators the ability to capture user identity information from syslog events.   You effectively send a syslog stream to the firewall, then configure a syslog parser to extract the user/IP mapping information from the events. The parser requires defining matching criteria either via RegEx or a Field Identifier. More details and step-by-step configuration is available below.   Configure User-ID to Monitor Syslog Senders for User Mapping   https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping.html   There are two methods in which you can configure this:   1. Via the PAN-OS Integrated User-ID Agent   https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping/configure-the-pan-os-integrated-user-id-agent-as-a-syslog-listener.html#   2. Via the Windows User-ID Agent   https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping/configure-the-windows-user-id-agent-as-a-syslog-listener.html#   Please let me know if you have any additional questions!   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

Hello,   Could you provide a little bit more context around what you are trying to accomplish?   Are you interested in caching responses to HTTP requests from internal users? Or are you looking to deploy a caching solution in front of a web server sitting behind a Palo Alto firewall?   Thank you,   -JeffH   Jeff Hochberg | Sr. Systems Engineer - Technical Business Development Palo Alto Networks | Atlanta, GA |  USA Mobile: 404.432.1112 | www.paloaltonetworks.com   The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited. ... View more

Hello,   I believe you will need to modify the URL you supplied - substituing 'api' for 'sdk'. The URL for the API interface is:   https://<IPADDR>/api   Supplying /sdk will definitely give you a 404 error.   Please try again with the suggested URL. I expect you'll see different results.   -JeffH   Jeff Hochberg Sr. Systems Engineer - Technical Business Development Palo Alto Networks  Atlanta, GA jhochberg@paloaltonetworks.com     ... View more