Tag Archives: Palo Alto Networks

Workaround for Not Using a Palo Alto with a 6in4 Tunnel

2019-07-10Cisco Systems, IPv6, Palo Alto Networks6in4, Cisco Router, fail, Hurricane Electric, IPv6, Palo Alto Networks, Tunnel BrokerJohannes Weber

Of course, you should use dual-stack networks for almost everything on the Internet. Or even better: IPv6-only with DNS64/NAT64 and so on. ;) Unfortunately, still not every site has native IPv6 support. However, we can simply use the IPv6 Tunnel Broker from Hurricane Electric to overcome this time-based issue.

Well, wait… Not when using a Palo Alto Networks firewall which lacks 6in4 tunnel support. Sigh. Here’s my workaround:

Continue reading Workaround for Not Using a Palo Alto with a 6in4 Tunnel →

PAN Blocking Details

2019-06-28Design/Policy, Palo Alto NetworksPalo Alto Networks, Policy, reader's question, TCP, Telnet, three-way handshakeJohannes Weber

One of my readers sent me this question:

We have an internal discussion about whether it is possible to block the 3 way hanshake TCP but allow the JDBC application protocol. In other words we would like to block the test of the port with the command “telent address port” but we would like that the connections via JDBC continue to work. is it possible to do this theoretically? Is it possibile to do it with paloalto firewall?

Let’s have a look:

Continue reading PAN Blocking Details →

My IPv6/Routing/Cisco Lab Rack (2019)

2019-06-24Memorandum, Off-Topic19", CCNA, CCNP, Cisco Router, Cisco Switch, Internet, Juniper SA, Juniper ScreenOS, Juniper SRX, Juniper SSG, Palo Alto Networks, PoE, Raspberry Pi, VPN, WebcamJohannes Weber

My lab rack of 2019 consists of multiple Cisco routers and switches, as well as Juniper ScreenOS firewalls for routing purposes, a Palo Alto Networks firewall, a Juniper SRX firewall, a server for virtualization and some Raspberry Pis. That is: This rack can be used for basic Cisco courses such as CCNA or CCNP, or for even bigger BGP/OSPF or IPsec VPN scenarios since those ScreenOS firewalls are perfect routers as well. Of course, everything is IPv6 capable. Having some PoE-powered Raspberry Pis you can simulate basic client-server connections. A Juniper SA-2500 (aka Pulse Connect Secure) for remote accessing the Lab rounds things up.

I am just writing down a few thoughts on why I have “designed” the rack in that way. It’s basically a reminder for myself. ;)

Continue reading My IPv6/Routing/Cisco Lab Rack (2019) →

Palo Alto Networks NGFW using NTP Authentication

2019-05-21Authentication, NTP, Palo Alto NetworksAuthentication, NTP, Palo Alto NetworksJohannes Weber

Everyone uses NTP, that’s for sure. But are you using it with authentication on your own stratum 1 servers? You should since this is the only way to provide security against spoofed NTP packets, refer to Why should I run own NTP Servers?. As always, Palo Alto has implemented this security feature in a really easy way, since it requires just a few clicks on the GUI. (Which again is much better than other solutions, e.g., FortiGate, which requires cumbersome CLI commands.) However, monitoring the NTP servers, whether authentication was successful or not, isn’t implemented in a good way. Here we go:

Continue reading Palo Alto Networks NGFW using NTP Authentication →

Using Case Sensitive IPv6 Addressing on a Palo Alto

2019-04-01IPv6, Palo Alto NetworksApril 1st, case sensitive, Features, IPv6, IPv6 Global Unicast Address, Palo Alto NetworksJohannes Weber

IPv6 brings us enough addresses until the end of the world. Really? Well… No. There was an interesting talk at RIPE77 called “The Art of Running Out of IPv6 Addresses” by Benedikt Stockebrand that concludes that we will run out of IPv6 addresses some day.

Luckily Palo Alto Networks has already added one feature to expand the IPv6 address space by making them case sensitive. That is: you can now differentiate between upper and lower case values “a..f” and “A..F”. Instead of 16 different hexadecimal values you now have 22 which increases the IPv6 space from $2^{128}$ to about $2^{142}$ . Here is how it works on the Palo Alto Networks firewall:

Continue reading Using Case Sensitive IPv6 Addressing on a Palo Alto →

Trying to change an IPv6 Link-Local Address on a FortiGate

2018-11-30Fortinet, IPv6EUI-64, fail, FortiGate, Fortinet, IPv6, IPv6 Interface Identifier, Link-Local Address, Palo Alto Networks, Router Advertisement, WiresharkJohannes Weber

I got an email where someone asked whether I know how to change the link-local IPv6 addresses on a FortiGate similar to any other network/firewall devices. He could not find anything about this on the Fortinet documentation nor on Google.

Well, I could not find anything either. What’s up? It’s not new to me that you cannot really configure IPv6 on the FortiGate GUI, but even on the CLI I couldn’t find anything about changing this link-local IPv6 address from the default EUI-64 based one to a manually assigned one. Hence I opened a ticket at Fortinet. It turned out that you cannot *change* this address at all, but that you must *add* another LL address which will be used for the router advertisements (RA) after a reboot (!) of the firewall. Stupid design!

Continue reading Trying to change an IPv6 Link-Local Address on a FortiGate →

MP-BGP Capture

2018-10-03IPv6, RoutingAuthentication, BGP, CCNP, Cisco Router, Dynamic Routing, Follow TCP Stream, FortiGate, Fortinet, IPv6, MD5, MP-BGP, Palo Alto Networks, pcap, WiresharkJohannes Weber

For those who are interested in analyzing basic BGP messages: I have a trace file for you. ;) It consists of two session establishments as I cleared the complete BGP session on two involved routers for it. Refer to my previous blog post for details about the lab, that is: MP-BGP with IPv6 and legacy IP, neighbouring via both protocols as well, with and without password. The involved routers were 2x Cisco routers, one Palo Alto Networks firewall, and one Fortinet FortiGate firewall.

Continue reading MP-BGP Capture →

Basic MP-BGP Lab: Cisco Router, Palo Alto, Fortinet

2018-09-24Authentication, Cisco Systems, Fortinet, IPv6, Palo Alto Networks, RoutingAuthentication, BGP, CCNP, Cisco Router, Dynamic Routing, FortiGate, Fortinet, IPv6, Loopback, MD5, MP-BGP, Palo Alto Networks, Password, RedistributionJohannes Weber

While playing around in my lab learning BGP I configured iBGP with Multiprotocol Extensions (exchanging routing information for IPv6 and legacy IP) between two Cisco routers, a Palo Alto Networks firewall, and a Fortinet FortiGate firewall. Following are all configuration steps from their GUI (Palo) as well as their CLIs (Cisco, Fortinet). It’s just a “basic” lab because I did not configure any possible parameter such as local preference or MED but left almost all to its defaults, except neighboring from loopbacks, password authentication and next-hop-self.

Continue reading Basic MP-BGP Lab: Cisco Router, Palo Alto, Fortinet →

Route- vs. Policy-Based VPN Tunnels

2018-07-10Design/Policy, IPsec/VPNCisco ASA, Crypto Map, FortiGate, IKE, IPsec, Juniper ScreenOS, Palo Alto Networks, Policy-Based VPN, Proxy-ID, Route-Based VPN, Security Association, Site-to-Site VPN, uRPF, VPNJohannes Weber

There are two methods of site-to-site VPN tunnels: route-based and policy-based. While some of you may already be familiar with this, some may have never heard of it. Some firewalls only implement one of these types, so you probably don’t have a chance to configure the other one anyway. Too bad since route-based VPNs have many advantages over policy-based ones which I will highlight here.

I had many situations in which network admins did not know the differences between those two methods and simply configured “some kind of” VPN tunnel regardless of any methodology. In this blogpost I am explaining the structural differences between them along with screenshots of common firewalls. I am explaining all advantages of route-based VPNs and listing a table comparing some firewalls regarding their VPN features.

Continue reading Route- vs. Policy-Based VPN Tunnels →

File Blocking Shootout – Palo Alto vs. Fortinet

2018-06-27Fortinet, Palo Alto Networks, PasswordData Leak Prevention, DLP, Encrypted, fail, File Blocking, FortiGate, Fortinet, Microsoft Office, Palo Alto Networks, Password, PDF, Protected, ZIPJohannes Weber

We needed to configure the Internet-facing firewall for a customer to block encrypted files such as protected PDF, ZIP, or Microsoft Office documents. We tested it with two next-generation firewalls, namely Fortinet FortiGate and Palo Alto Networks. The experiences were quite different…

TL;DR: While Fortinet is able to block encrypted files, Palo Alto fails since it does not identify encrypted office documents! [UPDATE: Palo Alto has fixed the main problem, see notes below.]

Continue reading File Blocking Shootout – Palo Alto vs. Fortinet →

Palo Alto policy-deny though Action allow

2018-06-18Certificate, Palo Alto NetworksCertificate, Palo Alto Networks, Pinning, PolicyJohannes Weber

I came across some strange behaviors on a Palo Alto Networks firewall: Certain TLS connections with TLS inspection enabled did not work. Looking at the traffic log the connections revealed an Action of “allow” but of Type “deny” with Session End Reason of “policy-deny”. What?

Continue reading Palo Alto policy-deny though Action allow →

Notes regarding Palo Alto HA2 Session Sync

2018-06-13Palo Alto NetworksCluster, HA, High Availability, Palo Alto Networks, Session Sync, TroubleshootingJohannes Weber

Just a quick note concerning the session sync on a Palo Alto Networks firewall cluster: Don’t trust the green HA2 bubble on the HA widget since it is always “Up” as long as the HA interface is up. It does NOT indicate whether the session sync is working or not. You MUST verify the session count on the passive unit to be sure. Here are some details:

Continue reading Notes regarding Palo Alto HA2 Session Sync →

Palo Alto Application: First Packets Will Pass!

2018-06-07Design/Policy, Palo Alto NetworksApp-ID, Application, FTP, Next-Generation Firewall, Palo Alto Networks, PolicyJohannes Weber

I am using an almost hidden FTP server in my DMZ behind a Palo Alto Networks firewall. FTP is only allowed from a few static IP addresses, hence no brute-force attacks on my server. Furthermore, I have an “allow ping and traceroute from any to DMZ” policy since ping is no security flaw but really helpful while troubleshooting.

Now, here comes the point: My FTP server logfile showed dozens of connections from many different IP addresses from the Internet. WHAT? For the first moment I was really shocked. Have I accidentally exposed my FTP server to the Internet? Here is what happened:

Continue reading Palo Alto Application: First Packets Will Pass! →

Generating SSHFP Records Remotely

2018-02-08DNS/DNSSEC, Linux, Security, SSH, Tutorial/HowtoCisco Router, DNSSEC, DSA, FortiGate, Fortinet, Juniper ScreenOS, Juniper SSG, Nmap, Palo Alto Networks, SSH, ssh-keygen, ssh-keyscan, SSHFP, WorkaroundJohannes Weber

Until now I generated all SSHFP resource records on the SSH destination server itself via ssh-keygen -r <name>. This is quite easy when you already have an SSH connection to a standard Linux system. But when connecting to third-party products such as routers, firewalls, whatever appliances, you don’t have this option. Hence I searched and found a way to generate SSHFP resource records remotely. Here we go:

Continue reading Generating SSHFP Records Remotely →

IKEv2 IPsec VPN Tunnel Palo Alto <-> FortiGate

2017-09-21Fortinet, IPsec/VPN, IPv6, Palo Alto NetworksFortiGate, Fortinet, IKEv2, IPsec, IPv6, Palo Alto Networks, Site-to-Site VPNJohannes Weber

And one more IPsec VPN post, again between the Palo Alto Networks firewall and a Fortinet FortiGate, again over IPv6 but this time with IKEv2. It was no problem at all to change from IKEv1 to IKEv2 for this already configured VPN connection between the two different firewall vendors. Hence I am only showing the differences within the configuration and some listings from common CLI outputs for both firewalls.

Continue reading IKEv2 IPsec VPN Tunnel Palo Alto <-> FortiGate →

Weberblog.net

IT-Security, Networks, IPv6, VPN, DNSSEC, NTP