About jsalmans

I've been having some IPv6 issues (we're a dual-stack setup currently), and it seems like every time I fix one, I find another.   The latest is an issue with some, but not all, IPv6 websites. Sometimes they'll load... sometimes they'll start to load and then stall.  Sometimes they load, and then a refresh has them stalling.   Looking at packet captures, it appears that the issue was related to TLS 1.3.  After much Googling, I was able to find flags to force my browsers to use TLS 1.2, and the issue seems to be resolved.  I also verified that it worked just fine with the default flags (so using TLS 1.3) when I disabled IPv6 on my adapter.   So it appears it is a combination of IPv6 and TLS 1.3.  I opened a case with Palo support, but I decided to continue looking into this myself.  The last thing they had me try was a change to the Zone Protection Profile on the TCP Drop tab to set "Reject Non-SYN TCP" to No (it was set to Global previously), as they indicated the global counters were showing:   flow_tcp_non_syn 3 0 info flow session Non-SYN TCP packets without session match flow_tcp_non_syn_drop 3 0 drop flow session Packets dropped: non-SYN TCP without session match   The session browser was also showing "non-syn-tcp" on the application on attempts to load the test webpage when it failed (when it succeeded, it seemed like there were also sessions open showing SSL).   I tried something else this morning... I set my PC's IPv6 MTU to 1400, down from 1500, and it seems to have improved the situation.  Page loading on the test site seems to work fine without the stalling, even on refreshing.  The session browser is showing SSL application sessions from my PC.   Has anyone else had a similar issue?  Do I just need to adjust my IPv6 network interfaces down to 1400 MTU, or should I look at the IPv6 TCP MSS?  I figured Path MTU Discovery should be taking care of any MTU issues since the client has to be the one to fragment on IPv6 but something obviously isn't working and, since lowering the IPv6 MTU on my PC seems to fix the issue, I assume there is an MTU issue somewhere along the line but I don't think I've seen Packet Too Big messages. ... View more

Greeting all,   I've tinkered with Forward Proxy Decryption a bit in the past and I want to revisit this for a limited rollout to our servers at least.  My previous experimentation into the feature was for a Windows client so I understand the basics there in that you can add the certificate to the Windows cert store and most applications should use it by default (with the exception of some such as Firefox, Filezilla, etc).   What is the implementation for Linux servers?  If you drop the same certificate in the system's certificate store, will all command line applications (including yum, apt-get, etc) use that or is it common to run into issues with ones that use their own certificate store?   I'm also curious about the certificate itself... using an internal PKI, is it best practice just to create a new cert signed by the internal CA for decryption?  And what about cert lifetime duration?   Thanks! ... View more

Greetings all.   I'm having a time trying to configure this and could use some pointers where I may be going wrong.  Here is the environment:   Single portal already configured using ADFS (ADFS is also already set up with DUO MFA) with agent configurations based on AD security groups Multiple gateways already configured based on AD security groups Windows 10 laptop domain joined but also with a DUO MFA prompt at Windows login I've set up two portal agent configs, one for the Always On VPN security group and the other for prelogon... auth override cookies have been configured.  Prelogon tunnel rename timeout is currently set to -1.  The user group based one is set to use SSO along with some other things like requiring a password to disconnect/uninstall. Always on gateway has been configured with same auth override cookie config and also uses ADFS auth just like the portal.  I had multiple agent configs (one for prelogon and one for the user security group) with different IP addressing but I've changed this to a single "any" users config for now for testing and simplicity I have an AD generated certificate for the PC generated and installed and I believe that part is working for prelogon sign in Split tunneling is disabled on the gateway AD GPO has mapped drives that we want to successfully map at Windows login so the tunnel being established still at that point is important   The behavior I'm seeing: Prelogon seems to work as I see GP logs on the firewall and I can see the tunnel established on the client During sign in, the DUO prompt appears and allows me to do the MFA.  Once that's done, Windows continues to sign in and shows the username Once signed in, the tunnel is still established, however, it is for prelogon user still and never seems to switch to the windows/AD user.  GP logs on the firewall continue to show prelogon as does the GP client if opened on the laptop.  After opening the GP client (and not before), the ADFS prompt appears for the user to sign in.  In can be ignored and closed and the prelogon tunnel stays.   Checking the GP logs, it looks like account info is not being handed off as part of the sign in to GP for the SSO part.   I've tried: "pangps -registerplap" and that does add a symbol allowing me to check before login if the tunnel is established.  Helpful, but it didn't fix anything.  I also found somewhere talking about making sure default windows and GP were the only credential providers listed in Windows registry.. DUO was in there on ours too so I deleted that key which re-enabled the login options to appear.  Choosing the GP login option does seem to at least provide my username in the SSO logs but still didn't actually switch to the username in GP.   This is driving me crazy so I'm hopeful someone else has come across this and has some insight! ... View more

I'm looking at deploying some PAN-440 firewalls and wanted to get some advice as this is one of the first remote sites I've done with Palo.  My intention was to build an IPSEC bridge between the remote site and our on-prem firewalls in order to pipe all of the remote site's traffic to us.  That would allow us to control internet access and use our on-prem subscriptions for cybersecurity as well as enable the remote site to access our wireless controller, VoIP system, etc.   Looking at deployment options, it seems like ZTP might be good for this so I'm reading up on that.   My question: I'm assuming the management that ZTP sets up would NOT go across the IPSEC tunnel and that it would be best practice to leave it that way?  Theoretically, if we create firewall policy that only allows the static IPs on each side to communicate with each other then this would allow troubleshooting if the tunnel fails for some reason.  I must admit that I'm a little hesitant to create an inbound NAT and security policy pointing to Panorama for security but, again, this could be mitigated by only allowing the remote static IP and it appears to be necessary for ZTP setup.   Thanks! ... View more

I noticed an issue with this feature before when I tried to set up an outgoing email on the Correlated Events log settings in the Panorama built-in collector group.  My idea was to filter to certain networks and then send an email when a correlated event came in that matched the filter so that a ticket could be created and our desktop services folks could investigate.  I never got it working reliably.. usually only got a few sporadic emails and then it would stop working.   More recently, I decided to try something with the Threat logs forwarding.  I'm actually trying to forward High and Critical threat information to Minemeld in json format so that I can create a list from the source IPs.  I'm getting an error when attempting a test send "SSL peer certificate or SSH remote key was not OK".  I've created a cert for the Minemeld server using the firewall and I've added it and the signing cert to Panorama as imported certs.  Minemeld has the signed server installed and is using it on HTTPS.   I've tried just sending it as HTTP as well but it isn't working with the miner I set up.  In fact, it isn't really clear to me if Panorama is sending it anything at all.  To test, I tried modifying IP in the HTTP Server profile to just be my machine (turned off my local firewall) and ran Wireshark.. I saw some data but if it contained the json I'm trying to send then it was encrypted still because I couldn't read it in the capture.   Do I need to turn on authentication requirements for all feeds in Minemeld to clear that SSL cert error?  Or is there a process I need to check on Panorama to verify it is evaluating the incoming logs and sending them as part of the log forward configs?   Thanks! ... View more

Ok, I'm at my wit's end with TAC.. after 7 months of explaining the issues, collecting logs, and then starting over when a new agent takes the case, I'm hoping the community can help me.   I've had inbound decryption set up for our FTP server for some time.  We noticed an issue after updating to 10.0.8 (we're now on 10.1.5-h1 ) where people seemed to not be able to connect anymore.  After investigating, it appears that in Filezilla they are actually able to connect but it looks like they aren't because a TLS error occurs and the LIST command fails.  Right-clicking on the remote side and hitting Refresh several times will often eventually complete the directory listing.  This is with FTPS set to "Require explicit FTP over TLS" and with the Transfer Method set to Default (which I think may be Passive). This issue appears to be intermittent and sometimes it seems to connect fine.   Further investigation also showed the following: The TLS error mentioned above when the LIST command fails is "GnuTLS error -110:  The TLS connection was non-properly terminated." followed by "Server did not properly shut down TLS connection" followed by "The data connection could not be established: ECONNABORTED - Connection Aborted" and then followed by "Failed to retrieve the directory listing".  Decryption logs GUI shows "General TLS Protocol Error" when this happens. Error showing: "Server sent unsorted certificate chain in violation of the TLS specifications" at the start of each connection attempt Changing the Transfer Method to Active seems to make it more reliable as far as connecting without a TLS error and getting the directory listed automatically (it still complains about the certificate chain) Even with Active set, we then sometimes get a message indicating that the connection isn't secure because the server previously was detected as supporting TLS session resumption (I'm assuming this was either working before through the Palo and now it isn't or it's because when we've tested we've connected directly to the server which supports it) Trying another client, WinSCP also doesn't list the directory on Passive.. it works when changed to Active.  I have no idea if it is getting any errors/warnings as I haven't noticed if there is a log view in that software. Turning off the decryption rule resolves all of the issues.. the FTP connection is also a lot less verbose (in another words, when decryption is turned on there is a lot more chatting with commands/responses between the client and the firewall/server) It looks like someone else has run into an issue like this before with Passive FTP and it was related to an issue with the content packs https://live.paloaltonetworks.com/t5/general-topics/passive-ftp/td-p/11573   Anyone else having any issues or have any experience in what I can do to resolve this?   Thanks! ... View more