About rgreens

rgreens · ‎11-05-2019

As of Threat Version 8206-5743 (10/31/19) we are still seeing the issue. This seems to be the latest version, is there another version available?

rgreens · ‎09-18-2014

The issue is with AD in the fact the Palo Alto's are only using "simple bind" with the LDAP lookup. From what I found the AD should use lastlogonTimeStamp instead of lastlogon for "simple bind." However it appears it is still not accurate. Showed a user last logged on 7 days ago, but the are currently logged on.

rgreens · ‎09-11-2014

ajbool, correct. I can see in the Palo Alto the last login for Global Protect, but in the Domain Controllers in doesn't update the last login information.

rgreens · ‎09-11-2014

We have a few vendors who have AD accounts, but only connect to Global Protect to SSH to specific servers. They don't use any other domain resources. When we look in the domain controllers there is no last login information. So our policy to disable unused accounts after 21 days keeps disabling active accounts. Anyone know how to get it to pass this information? Thank you, Randy

rgreens · ‎04-09-2014

Nothing in the threat log either.

rgreens · ‎04-09-2014

I have applied it but when we test our websites using Test your server for Heartbleed (CVE-2014-0160) it reports our sites as vulnerable.

rgreens · ‎01-20-2014

Is there any way to remove a parameter to a security rule via the CLI? As an example, if I created the following rule: set rulebase security rules "Test" from inside Now I want to change inside to outside. If I use: set rulebase security rules "Test" from outside, I end up with "from [ inside outside ]" I would prefer not to have to delete the rule and recreate it as I have a bulk change to do and the CLI will be faster than GUI. Thank you, R

rgreens · ‎01-20-2014

Diego, I haven't found a resolution. I am still seeing a lot of the msreg.gale.com. Based on what I can find in Google (not much) I believe this has something to do with Microsoft Word 2007 and language translation. I am seeing others as well, that are listed as Generic, not malware/virus/trojan etc. Update: After a little more research it is referenced the same time as the website "Research Web Service." I have also verified this is coming from Microsoft Word 2007, when someone does the Research feature, i.e. word lookup or translation. Does anyone know of a way to not log this as it is filling up our logs ~150 queries/hr. R

rgreens · ‎01-10-2014

Thanks for confirming this and I have seen it get removed in AV-1186. However with the addition of AV-1187 we are now getting another, I believe false positive of ThreatID 4034267, generic:msreg.gale.com

rgreens · ‎01-08-2014

Since 2013/12/26 I have been seeing a large number of Suspicious DNS Queries (generic: xml12es.farolatino.com), threatid 4011926. After researching the computers that are getting this, they all seem to be going to Microsoft sites prior to this query. From what I have read this seams to be coming from Microsoft Media Player. They use this site for their online media catalog. Has anyone else seen this?

rgreens · ‎10-18-2012

Never did find a solution. It appears there is a vulnerability inherit in Global Protect. I know Cisco does prevent this and was very surprised GP doesn't. To me this is a critical issue, because it allows the systems to be compromised.

rgreens · ‎10-11-2012

Thanks for the reply, as part of my ticket I had included the .pcap file from one of the "threats". The issue is still happening, but the bizarre thing is only happening with a few users, most of the users have been able to do updates, myself included. As for the Wildfire that is what I thought from reading about it in the forums, but the fact there was no traffic reported for anything for 8 days had me a little concerned.

rgreens · ‎10-11-2012

We use Total Defense for an antivirus program. It appears that one of the executable (both the 32 bit and 64 bit versions) in the latest update is being flagged as a virus, Virus/Win32.WGeneric.bnrd, the other executable files are fine. When I look at the Data Filtering log for Wildfire I see it says that it was forwarded. But when I look at the Wildfire report there is no report of that specific executable in the history and I don't see any files in Wild Fire reports in the last 7 days. So I believe I have a two fold issue, one the false positive doesn't allow our users to the the latest update and the fact nothing seems to be reaching Wildfire. I opened a ticket 8 days ago when I first saw the problem, but they want a copy of the executable. Unfortunately I can't find it because it is never getting to Wildfire and the installation files are inside a .pkg file and can't find a way to extract it.

rgreens · ‎10-10-2012

I upgraded my passive unit from 4.1.6 to 4.1.8 after the reboot I can't login using my domain credentials. I still can with the active unit still on 4.1.6 and I can login with the local admin account. Everything is setup the same, and LDAP lookups seem to still be working. All I see in the logs is: general auth-fa 0 User 'DOMAIN\USER' failed authentication. Reason: Invalid username/password From: X.X.X.X. Any suggestions or I am going to revert.

rgreens · ‎06-21-2012

The only way I can get it to work correctly as a test is to remove the local subnet from the GP client's routing table, i.e. from Windows: route delete 192.168.1.0 mask 255.255.255.0. Then I can't reach other devices on the local subnet and vice versa. Is this a bug in the the client? This is also only a temporary fix, next reboot and it would be back. Also not feasible to do. The routing table also does include to default routes both of which are pointing to the VPN address and the local NIC interface.

Member Since	‎03-26-2012 08:02 AM
Date Last Visited	‎02-03-2025 02:14 PM
Posts	18
Total Likes Received	3

Online Status	Offline
Date Last Visited	‎02-03-2025 02:14 PM

About rgreens

Re: Tofsee TLS Fingerprint Detection

Re: Global Protect not passing last login information?

Re: Global Protect not passing last login information?

Global Protect not passing last login information?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Rule change via CLI

Re: Legit Suspicious DNS Query?

Re: Legit Suspicious DNS Query?

Legit Suspicious DNS Query?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Re: Tofsee TLS Fingerprint Detection

Re: Global Protect not passing last login information?

Re: Global Protect not passing last login information?

Global Protect not passing last login information?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Rule change via CLI

Re: Legit Suspicious DNS Query?

Re: Legit Suspicious DNS Query?

Legit Suspicious DNS Query?

Re: GlobalProtect access to local LAN devices

Re: False Positive Virus

False Positive Virus

Upgrade caused AD admin authentication to fail

Re: GlobalProtect access to local LAN devices

Unlock your full community experience!

About rgreens