About bgranholm

bgranholm · ‎06-24-2014

Thanks Steven, that is perfect!

bgranholm · ‎06-24-2014

Does anyone know if there is a way to block traffic sourced from a specific OS in our network? We were discussing legacy Windows XP machines. Since they are no longer supported or being updated it would be nice to be able to block them from the internet but allow internal connections to them. (We have a couple of legacy programs we need to keep for customers that either dont exist any more or were never updated to run on anything but windows XP) We were thinking that we could just block them at the firewall but the firewall doesn't recognize OS that I know of. We could certainly give them static IPs and block them based on that but it would be nice to be able to block traffic to any Windows XP machine on our network just by virtue of its OS. Any thoughts? Thanks, Ben

bgranholm · ‎05-13-2014

So far Cisco's only real help has been clearing cache and trying newer versions of the client software. But they have escalated it to engineers, so maybe that is a good sign?

bgranholm · ‎05-05-2014

I opened a ticket with Cisco on this one. Seems to me that if file transfer works and desktop sharing and chat all work, then image transfer should work and that would be on their end, hopefully. Maybe that functionality isn't using the windows certificate repository and that is the issue. I will open a case with Palo Alto only if Cisco cannot hash this out.

bgranholm · ‎04-30-2014

We currently use Cisco Webex for desktop sharing, video conferencing and IM. Our environment has mostly people using the old Webex connect client and a few 'pilot' users of the Cisco Jabber client. Recently we implemented SSL Decryption and everything in the webex environment worked fine for the Webex connect client but people using the jabber client cannot send or receive images over IM. I have started a case with Cisco on this, however, their documentation leads me to believe images used to be sent insecurely in the old client and securely in the new client. I was wondering if there is anyone out there with experience with both Cisco Jabber and SSL Decryption who might be able to shed some insight into this issue? TIA, Ben

bgranholm · ‎04-22-2014

Here is what we ended up doing based on the recommendations of our SE. We created a custom URL category for whitelisting, Then put a new no-decyrpt SSL policy first which keys on the Custom URL Category. This way, if/when we discover new urls that have issues, we can just add them to the whitelist. Thanks for all your advice/assistance on this!

bgranholm · ‎04-21-2014

If you go to http://www.sap.com and click the login in the upper right, that brings up a login dialog box. The exact URL it is going to is: https://www.sap.com/content/sapcom/global/usa/en_us/registration/login.html It is important to note, this works fine when you go to that url directly. Only when clicking on the link on the main page does it not work.

bgranholm · ‎04-21-2014

So, I have just implemented SSL Decryption in our environment and we hit a website that appears to not work properly because of it. (It's sap.com, click on the login link in the upper right.) We don't see any errors in the firewall but the login prompt doesn't come up for us. The question is, is there any way for me to whitelist *.sap.com from SSL Decryption?

bgranholm · ‎11-22-2013

So how does the Firewall classify this traffic now? unknown-udp or unknown-tcp?

bgranholm · ‎11-22-2013

Has anyone implemented EDNS on their network? How does the firewall treat it? Is it just as DNS? Does it block it because the packets are too big? Does anyone know if there is a plan to make it its own discreet application? Thanks for the info... Ben

bgranholm · ‎05-16-2013

I apologize as apparently I was not being clear enough. In the traffic logs, this rule is blocking ALL unknown-tcp and udp traffic, even the traffic that has a Destination Country of US. Here is my rule with the non-public bits removed in set notation. It is in our security post-rules for our Internet traffic. "Block unknown to non-US" from any "Block unknown to non-US" to any "Block unknown to non-US" source "<Internal Private Address Space>" "Block unknown to non-US" destination US "Block unknown to non-US" source-user any "Block unknown to non-US" category any "Block unknown to non-US" application unknown-tcp "Block unknown to non-US" application unknown-udp "Block unknown to non-US" service any "Block unknown to non-US" hip-profiles any "Block unknown to non-US" negate-source no "Block unknown to non-US" negate-destination yes "Block unknown to non-US" action deny

bgranholm · ‎05-16-2013

Our customer's IP space was internal space, they are the source. The destination was definitely an IP in the US and it still got blocked.

bgranholm · ‎05-16-2013

I don't want to create policy sprawl, I would rather keep it in one rule.

bgranholm · ‎05-16-2013

Hi all! I have a new policy that I pushed yesterday that was a total failure and any help you can offer would be appreciated. We have a policy that looks like this: Source <Internal IP addresses> Destination <Negate Region US> Application <unknown-tcp, unknown-udp> DENY However, it is catching and DENYing all unknown-tcp and unknown-udp regardless of Destination Country. We have some internal applications used by our customers that this blocks as I haven't been able to classify all applications we use in house as of yet. This logic seems like it should be working, am I doing something wrong? Thanks, Benc

bgranholm · ‎05-10-2013

Yes, I did mean that and in custom reports which use the same filter structure. Maybe RFC 1918 space is a bad example. We have a branch structure in our organization and we have branches ip addresses defined in the addresses and address groups, and those branches are also grouped together with their own address groups. It would be VASTLY easier to write filters for these groups when they are often not contiguous IP space rather than these extremely long strings of filtering when it could be as simple as addr in <Group Name>. This would be a great feature.

Member Since	‎09-19-2012 07:58 AM
Date Last Visited	‎01-25-2016 03:57 PM
Posts	25
Total Likes Received	4

Online Status	Offline
Date Last Visited	‎01-25-2016 03:57 PM

About bgranholm

Re: Blocking OS specific traffic?

Blocking OS specific traffic?

Re: SSL Decryption and Cisco Jabber client

Re: SSL Decryption and Cisco Jabber client

SSL Decryption and Cisco Jabber client

Re: SSL Decryption Whitelisting

Re: SSL Decryption Whitelisting

SSL Decryption Whitelisting

Re: EDNS?

EDNS?

Re: SSL Decryption Whitelisting

Re: Is there any way to filter on an address group?

Re: EDNS?

Is there any way to filter on an address group?

Re: Blocking OS specific traffic?

Re: Blocking OS specific traffic?

Blocking OS specific traffic?

Re: SSL Decryption and Cisco Jabber client

Re: SSL Decryption and Cisco Jabber client

SSL Decryption and Cisco Jabber client

Re: SSL Decryption Whitelisting

Re: SSL Decryption Whitelisting

SSL Decryption Whitelisting

Re: EDNS?

EDNS?

Re: What am I doing wrong? This policy to block unknown traffic to countries outside the US.

Re: What am I doing wrong? This policy to block unknown traffic to countries outside the US.

Re: What am I doing wrong? This policy to block unknown traffic to countries outside the US.

What am I doing wrong? This policy to block unknown traffic to countries outside the US.

Re: Is there any way to filter on an address group?

Unlock your full community experience!

About bgranholm