About oschuler

Hi all,   I managed to install MineMeld on-prem and are playing around with it now. As a first task I'd like to setup a domain feed delivering SpeedTest.net hosts from countries we deployed Palo Alto firewalls.   Setting up the miner, a domain aggregator and an output worked, no problem there. We download the full hosts list from http://c.speedtest.net/speedtest-servers-static.php and pass it through to an output feed. However, I don't need all the 7k+ hosts mined. Only those with specific two-digit country codes, such as "CH" or "US". That information is also present in the mined XML file and I tried to fetch this information using "fields" in the input config (field 'countrycode'):   age_out:   default: null   interval: 631   sudden_death: true attributes:   confidence: 100   direction: inbound   share_level: green   type: domain fields:   country:      regex: country="([\w\s]*)"     transform: \1   countrycode:     regex: cc="(\w){2}"     transform: \1 ignore_regex: ^\<settings\>|^\<servers\> indicator:   regex: host="(.*):8080"   transform: \1 interval: 3307 source_name: speedtest.hosts url: http://c.speedtest.net/speedtest-servers-static.php   Now I want to filter for this 'countrycode' field in the output node and created a new prototype for this (condition #2):   infilters: - actions: - accept conditions: - __method == 'withdraw' name: accept withdraws - actions: - accept conditions: - countrycode == 'CH' - share_level == 'green' name: accept share level green - actions: - drop name: drop all   Result: 0 indicators in that output feed. Thanks for any hints on this. I'd like to avoid creating a miner for every country.   Thanks, Oliver ... View more

Hi all, We're evaluating new IT hardware for some small/mid-sized branch offices in Asia. If we compare the PA-200 and PA-500 (Link) we don't see a technical limitation when using PA-200s instead of PA-500s. Most branch offices don't have Internet connections with more than 50 Mbps, but sometimes 100+ users. Is there a recommendation on the amount of users where a PA-200 would be suitable and when a PA-500 should be considered? Thanks, Oliver ... View more

Dear folks, A few weeks ago we noticed a strange error message in our Panorama management software. If we navigate to "Panorama \ Device Deployment \ GlobalProtect Client" we receive the following error message: We close the message box but the area stays empty. We can't deploy GP clients through Panorama anymore. The same error message appears if we click on "Device Deployment \ Software" or "... \ SSL VPN Client". However, the entry "... \ Device Deployment \ Dynamic Updates" works as it should. Any idea how we can fix or troubleshoot this issue? Thanks, Oliver ... View more

Hi all, While trying to setup LSVPN on our HQ Palo Alto device, we ran into a U-Turn NAT issue. Let me first explain the setup: We setup an OCSP responder using a loopback Interface on the PA firewall. The private IP address of that loopback interface is 10.99.99.1/32. The private IP is not being used outside the firewall. Instead, all "clients" in the External AND Trusted cloud connect to "ocsp.company.com" which resolves to 100.1.1.1 in both clouds. Now access to "ocsp.company.com" from the External cloud is easy. That works well. However, so far we didn't manage to create a working U-Turn NAT rule for access from the Trusted cloud. Any ideas how this could be accomplished? What we tried so far (not successful): (We couldn't easily visualize the fake IP address in the "Source Translation" section in the first rule. But we tried with 10.1.1.1/24 as Source Translation IP.) Thank you in advance. Regards, Oliver ... View more