What are /r/paloaltonetworks' favorite Products & Services?

From 3.5 billion Reddit comments

Another option is Amazon:

https://aws.amazon.com/marketplace/seller-profile?id=0ed48363-5064-4d47-b41b-a53f7c937314

All the licenses are included and you can spin them up and destroy them as you have time to study.

The front page of the WireGuard describes its purpose and benefit very well, it’s open source software, they aren’t selling anything. The crypto key routing is the good stuff.
This video also goes to describe some of the core benefits but in layman’s terms, it’s probably a bit simplified for this audience. If anyone has a more in-depth technical overview video please post it. https://www.wireguard.com/ https://youtu.be/mxpHRdO4rDU

I certainly wouldn’t call WireGuard the gold standard from an enterprise perspective, yet.
It is however an incredibly fast, simple, lightweight and very secure VPN technology that is fast become supported by all OS and Appliance vendors.
I manage many dozens of IPSec tunnels globally and have used Wireguard for personal implementations. It is excellent for inter-organisation, inter-site and roaming user VPN use cases.
Mark my words, WireGuard will supplant IPSec, OpenVPN and most other VPN technologies in use in the next 5-10 years.

You're almost there. Click on "alow" and it will add "action eq allow" to the filter. Change the "eq" to "neq". The net effect will be a filter for that IP for all traffic that isn't allowed. Here's a picture of what it should look like...

https://snipboard.io/86mBnb.jpg

Thanks, being a newbie to Panorama it's hard to find best practice guides that aren't horribly out of date. This slide seemed to be the most help -

https://www.slideshare.net/PaloAltoNetworks/panorama-device-group-hierarchy

From what I've read you should stick with either pre or post rules but try not to mix and match. There was a comment here in a previous thread that mentioned sticking to post rules was the best method.

Sounds like to me he wants to do maybe some SNMP monitoring for thing like system utilization etc. If that is the case check out http://www.cacti.net and http://forums.cacti.net/viewtopic.php?f=12&t=44560 for specifics on integrating PAN into cacti.

Wouldn't the first two policies supersede the third? I was always of the understanding that if a packet hits the first policy and it is applicable then it wouldn't go further down the chain of policies.

Ex. a SupportStaff user goes to logmein, the APPGroup SupportStaff does not have logmein included in the allowed applications. Does the user get blocked? Or do they go down the chain of policies until they match the last policy? URLs are even trickier, do I need to include www.logmein.com in the SupportStaff URL Filter?

This can get confusing real quick.

Thanks again for the help.

I understand and apologize for the confusion. I edited the post. I meant to put 'anonymized VPN traffic', so not IPSec to our network but someone using NordVPN/PIA/etc traversing ingress into our network.

Push down NanoDefender and the other privacy add-ons recommended here to managed browsers: https://www.privacytools.io/browsers/

Pi-hole may help cover this off from a network level for byod/unmanaged assets, etc.

Depends on which version you go with.

https://aws.amazon.com/marketplace/seller-profile?id=0ed48363-5064-4d47-b41b-a53f7c937314

https://aws.amazon.com/marketplace/pp/B00PJ2VDFA?qid=1497886525486&sr=0-2&ref_=srh_res_product_title

They also have a 15 day trial if you only need it for a short period of time. That does not cover the AWS infrastructure fees.

PIA VPN, so we're just talking about some commercial-grade VPN (such as NordVPN). And you want to configure the 440 as a client. First of all, there are zero benefits to using commercial-grade VPN other than location spoofing. Obviously, enterprise-grade firewalls are never going to support that because it's pointless. You do see this on routers such as Synology, but again that's a consumer-grade router.

You can put such a router in front of the PA-440, but what's the point? But if you're planning to run OpenWRT behind the PA-440, then I'm lost.

ELK, splunk, graylog, and others. I’ve been playing around with Humio and it’s been fast as hell. Like others, they offer a free version but they will host it for you in the cloud https://www.humio.com/getting-started/community-edition/

so after thinking it was not possible, i found a traffic log showing user id info from jumpcloud.com ....anyone else get this working consistently?

​

Source User
jumpcloud.com\tom.smith
Source
172.30.100.2
Source DAG

Country
172.16.0.0-172.31.255.255
Port
65469
Zone
L3-OpenVPN-Mobile
Interface
ae1.1102
X-Forwarded-For IP

Part of it has to do with support costs even when a device isn't licensed. If someone buys an old, EOS device like the 2000- or 4000- series and runs into a problem, they might call into support and eat up time just to be told that there's no support contract. It costs money to route calls and takes away time from paying customers.

The system won't let you install a new OS version even if you have it downloaded, as the support license has to be valid for the OS to be loaded.

FWIW, /u/cutplug is dead on as far as commit times. The 2k is about 8 year old tech, and I've seen commits take 30 minutes with even a moderately-sized config. A typo at that speed can be more frustrating than you might realize.

A VM or PA-200 is probably the best bet for your home lab. You could also get a Pay As You Go subscription on AWS. The cheap one is something like $1/hour according to the AWS marketplace: https://aws.amazon.com/marketplace/seller-profile?id=0ed48363-5064-4d47-b41b-a53f7c937314

you can just monitor the SNMP from your SNMP manager like solarwinds. If you don't have one you could just use my go script that monitors the CPS using SNMP (PAN-OS 8.0+ is required) 1. Make sure SNMPv2 is enabled in the firewall interface and there's no firewall blocking SNMP (UDP 161) traffic 2. Install Go https://golang.org/doc/install 3. Download my script go get github.com/zepryspet/GoPAN 4. Run the script (usually for a week or 2) --Change directory to the downloaded github repo cd $HOME/go/src/github.com/zepryspet/GoPAN --Execute the script go run pan.go run cps -c <snmp-community> -i <firewall-ip> 5. The script will save CPS files per zone (in the same folder where the script resides) in csv files so you can open them with excel. The columns are TCP CPS, UDP CPS and other IP CPS.

I work for a vendor and our product is a Threat Intelligence Gateway. We are in the process of integrating with various SIEM solutions. Our CTO recently came across a solution called Gravwell and he loves it. May be worth checking it out. https://www.gravwell.io

> … BUT when I try to use …

Don't use the offical GlobalProtect client. It's terrible. Even more terrible than most proprietary VPN clients, which are all terrible, because they all focus on making the IT department happy rather than the end users.

Use OpenConnect v8.00, or one of its graphical clients, which supports the GlobalProtect protocol in addition to others.

(Disclosure: I wrote the GlobalProtect support in OpenConnect out of frustration with the aforementioned terribleness.)

Not everyone implements SAML to spec, so it can get squirrely. FusionAuth just released SAML support, so take a look. Might be what you need. https://fusionauth.io/blog/2019/05/01/fusionauth-update-saml

It appears you have a closed mind and enjoy ridiculing people. ExpressVPN ghost VPN, Nord VPN all do exactly what I’m being asked to do. I don’t want these in the Enterpise environment so if I can’t convince the powers that be to have foreign company whitelist our US public IP and I’m forced to come up with something I’d rather do it with GP and PAN. My SE at PAN gave me the same solution as /robot-uprising and /haiohme

Enable logging on all your rules.
That will be enough to get the App-ID going. Keep in mind that without SSL decryption it's working with limited data - most stuff will be ssl.
If you got a lot of Chrome in your user base - make sure to have top rule denying QUIC otherwise.
Good preventive measure is to block all but sanctioned VPN apps and Proxy/Anonymizer apps/sites.

This comment is mainly so I get updates, however I was thinking of doing this, I looked at Nord and they have an IPSEC option so I don't see why it couldn't be made to work but who knows if it helps:

I got a booster to get cold outside air for my home lab. It might be better than the fans. https://www.amazon.com/gp/product/B01C82SZRM

I pushed some sponge inside to filter out the dust.

When I called my supplier, they told me that the 220 did not have a rack mount kit.

I went with this aftermarket one off of Amazon. It worked fine.

220 Rack mount kit