About nickcx1

nickcx1 · ‎03-06-2014

Hi All, PanOSS 5.0.10 The following site (amongst others) hosts a malicious file that I want to block: Download Genieo. The file is a .dmg and I want it blocked to my Mac user estate. Rather than block the URL I thought I would give Custom Signatures > Vulnerability a go. I am following the document Creating_Custom_Signatures-RevA (page 43). File name is InstallGenieo.dmg with Hex of 0000000: 789c 730d 6262 6060 883f cf30 0a46 2400 x.s.bb``.?.0.F$. 0000010: 0087 f401 c878 9ced d43b 0ac2 4010 06e0 .....x...;..@... 0000020: 8885 d7f0 0e1e 20da 888d 10f0 004b c020 ...... ......K. 0000030: 8baf I have created a custom vulnerability Configuration like so: and Standard Signature, And Condition (Transaction) like so: Once pushed from Panorama to my devices I don't see it in the logs as Alerting. I'm sure I'm missing something but being my first attempt, I'm not sure where. Should I add it to the Vulnerability Protection under Security Profiles or something..? Or am I doing this incorrectly in the first place...?:) Any hints would be great, Thanks

nickcx1 · ‎02-19-2014

Thank you all - just what I needed to know. Easily better than our support company...

nickcx1 · ‎02-18-2014

Hello, Thank you for the advisory. I think the link provided will fix it. I have a question though: The firewalls are managed by Panorama, and the policies are centrally deployed. If I move to PAN-DB what will happen to policies that currently use the Brightcloud URL categorisation? For example botnets, abused-drugs or malware-sites. Will those policies with these categories referenced continue to be valid? Thanks.

nickcx1 · ‎02-18-2014

Delayed reply.. Thanks for the suggestions. After having a PA engineer look at the device they concluded that the device was just not up to the job for us. The logging was minimal on policies but the sessions were just too high. We swapped out for the (much better) 3020s and the problem has gone. Thanks again.

nickcx1 · ‎02-18-2014

Hello, I have recently re-licensed our filtering and received the Activation Code a new PAN DB URL filtering license. Previously, my 3020 was using a trial Brightcloud. I have activated the license in the PAN portal as I normal would but when I come to Activate the license on the firewall it fails. System log shows the following. Other licenses are ok (threat/av etc) Any help would be appreciated! PANOS 5.0.10, PA3020.

nickcx1 · ‎12-20-2013

PA2020 4.1.14, 500 users. Recently we have added ~100 more users to our PA2020 and are seeing huge slow-downs for internet. Session stats show our device has a high packet rate and through put. We have been advised that~20,000 packet rate / 120 mb throughput are the limits and anything encroaching 80% of the limit will result in a slow down. Device is up : 1 day 14 hours 3 mins 38 sec Packet rate : 34580/s Throughput : 115023 Kbps Total active sessions : 8801 Active TCP sessions : 8644 Active UDP sessions : 33 Active ICMP sessions : 0 Any suggestions on how to further troubleshoot whether a specific user/rule is responsible or - grabs straws - ANYTHING else I can work through?

nickcx1 · ‎11-12-2013

Hi, I want to put together a policy to manage our user's access to online storage. We would like to restrict access to all but a few storage companies (DropBox, Hightail) and wondered how others manage such a task. Also, I'd like to accurately pull a report on the applications that fall under this umbrella. The difficulty I see is that not all of them come under storage-backup with file-sharing and internet-utility being two others. Thanks in advance,

nickcx1 · ‎10-23-2013

Thank you for the reply - that will be very useful. I take it that that only way to passively report on useragents would be to then add the custom applications to my standard web access policy? Or is there a better way to get that information? Thanks again

nickcx1 · ‎10-22-2013

Hi, PanOS 4.1.14. Is it possible to report on user agent connecting via my 2020? To be able to report on Firefox, Chrome or IE versions for example would be useful . Further still..(and I doubt this..) to instigate a policy based on a user agent? Thanks all Nick

nickcx1 · ‎10-11-2013

Thanks both for the confirmation and for the extra info. I suppose I should soon bite the bullet and upgrade to 5. For the meantime I have set up my FTP user's homes directory to route to my required location. Not pretty, but it will do for now.

nickcx1 · ‎10-10-2013

(Think I know the answer to this already but...) Panorama 4.1.14 We have a NAS that I would like to push automated exports to from Panorama. I would like to ftp export to a specific path (we don't use user Home paths) but can't seem to do it. Only the hostname is allowed. I gather SCP via the CLI would allow me to do this but I think not in an automated fashion. I've tried the same format as per SCP but it doesn't work. Anyone else backup using scheduled exports from Panorama to a NAS. Thanks,

nickcx1 · ‎10-02-2013

Worked it out: debug dataplane reset ssl-decrypt notify-cache source <IP ADDRESS>

nickcx1 · ‎10-02-2013

Hmm, that doesn't seem to clear the Opt-out choice. Any other suggestions; I'm testing against a single machine - I'm sure it must be possible? I do a similar thing to clear the test user's Captive portal mapping to force reauthentication when I was testing CP. Thanks

nickcx1 · ‎10-02-2013

PanOS 4.1.14 How does one clear the cache for an individual client IP, so that the end-user is presented with the SSL Opt-Out page again when they next try a site which uses SSL? All I can think of is clear session all filter ssl-decrypt yes. If I do a show session all I don't know which session ID I should be clearing, if any... Thanks

nickcx1 · ‎09-26-2013

Kunal, admin@PA-200# show deviceconfig setting ssl-decrypt ssl-decrypt { url-proxy yes; crl yes; crl-receive-timeout 5; ocsp yes; ocsp-receive-timeout 5; block-unknown-cert yes; block-timeout-cert no; cert-status-timeout 5; } Additionally, if of use: admin@PA-200> show system setting ssl-decrypt setting vsys : vsys1 Forward Proxy Ready : yes Inbound Proxy Ready : no Disable ssl : no Disable ssl-decrypt : no Notify user : no Proxy for URL : yes Wait for URL : no Deny session if setup fails : no Block revoked Cert : yes Block timeout Cert : no Block unknown Cert : yes Cert Status Query Timeout : 5 URL Category Query Timeout : 5 Use Cert Cache : yes Verify CRL : yes Verify OCSP : yes CRL Status receive Timeout : 5 OCSP Status receive Timeout : 5 Thanks!

Member Since	‎09-26-2013 07:28 AM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	16
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About nickcx1

Custom Vulnerability (.DMG)

Re: Applying URL filtering License - schema verification failed

Re: Applying URL filtering License - schema verification failed

Re: High Packet Rate / Throughput

Applying URL filtering License - schema verification failed

High Packet Rate / Throughput

Online Cloud Storage

Re: User Agent report?

User Agent report?

Re: Scheduled Backups from Panorama to [location]

Custom Vulnerability (.DMG)

High Packet Rate / Throughput

Re: Applying URL filtering License - schema verification failed

Re: Applying URL filtering License - schema verification failed

Re: Applying URL filtering License - schema verification failed

Re: High Packet Rate / Throughput

Re: High Packet Rate / Throughput

Custom Vulnerability (.DMG)

Re: Applying URL filtering License - schema verification failed

Re: Applying URL filtering License - schema verification failed

Re: High Packet Rate / Throughput

Applying URL filtering License - schema verification failed

High Packet Rate / Throughput

Online Cloud Storage

Re: User Agent report?

User Agent report?

Re: Scheduled Backups from Panorama to [location]

Scheduled Backups from Panorama to [location]

Re: Clear SSL opt-out response cache for client

Re: Clear SSL opt-out response cache for client

Clear SSL opt-out response cache for client

Re: Response Page for virus (e.g. Eicar test) when using SSL inspection

Unlock your full community experience!

About nickcx1