Vintage - Lab

 

My old Lab - Back in the Day .. 

Palo Alto Architecting

 Strat Cloud Manager ( => move away from Panorama 

Prisma Access (Global Protect)
Commits

General Protection

• Zone Protection profiles on all interfaces
• Migrate to Application-based rules
• Shared rules .. eg.  geoblocks, bad apps, cleanup
• Criticality threshold, medium severity is common
• Zero trust
• External Dynamic List

Remote User /On-Prem Protection

• Threat Protection
• URL Filtering
• SSL Forward Proxy (SSLD)
• Global Protect VPN W/Full Tunnel & HIPs
• User-ID
• Data Redistribution

Responsiveness

• Directional Clean up rulesHA configured locally, not in panorama
• Link and path monitoring for hardare 
• Baseline or referenece device group
• use tags
• Self-documentation configuration
• Security profile group for different use case
• Device group tiers and shared templates

Resilience

• Automate update installation, config backups
• Separate virtual router for secondary ISP
• Use path monitoring (not PBF) for route failover
• HA configured locally, not in Panorama
• Link and path monitoring for Hardware failover
• Use monitor profiles for all IPSec tunnels

Palo Alto

Prisma  Access - Associate Tenant

Prisma Access - Mobile Developer Tenant

Panorama Gateways

how to unload a firewall policy

 fw unloadlocal

Route

 netstat -rn | wc -l

34" MDF
11" Cut to accomidate 12" Speakers
All Joints are glued for sealed
Terminal Caps   
Rectangular Slotted port 1 15/16" Tall,  12 1/8" Wide and 13" Deep  (approx 1.5 Cubic Feet Volume)
Decrease the width lower the base frequency



Key Features
1.5 ft³ cabinet
Slotted port design
3/4" MDF construction
All joints glued and caulked
Black carpet covering


buffer flow 
x site scripting
sql injection 

Building a Checkpoint Firewall Cluster (Checklist)

 

Checklist to Build Cluster
1. Checkpoint Version R81.20
2. Checkpoint JumboHotFix JHF65 (or latest Checkpoint GA)
3. Hostname
4. DNS/NTP
5. Routes /Static/OSPF/Default Route/Route distribution
6. Add to Infoblox or your DNS server 
7. Interface Speed/Duplex
8. Integration with Cisco tacacs or Authentication Server
9. RSA Seed files if integration is needed for VPN
10. Serial Connection to Term Server
11. Monitoring
a. Add to SolarWinds
b. Add to Indeni 
12. Configure Firewall backup on Indeni  
13. Add to Firewall Management Servers
14. Apply Checkpoint License
15. Verify 
a. Logs on Logger
b. Policy is applied with software blades IPS/Identity Awareness
16. Configure Out-of-band LOM 

Special Configurations
1. Fix CP provided for the talk path issue 
/opt/CPsuite-R81.20/fw1/boot/modules/
Vi fwkern.conf
fwmultik_dispatcher_in_tap_mode=1

2. The core 0 CPU fix 
/opt/CPsuite-R81.20/fw1/boot/modules/
Vi fwkern.conf
fwmultik_sync_processing_enabled=0


Ref: https://support.checkpoint.com/results/sk/sk165853

a.

OSPF Configuration

 set ospf 

set router-id 100.14.25.12

set ospf area 5 on
set ospf interface eth1-01 area 5 on
set ospf interface eth1-01 cost 1
set ospf interface eth1-01 priority 0
set ospf interface eth1-01 authtype md5 key 1 secret already_scrambled_FFBm4JO9gDBWc=_00000000000000000000000000000000000000000000000000

set ospf interface eth1-04 area 5 on
set ospf interface eth1-04 priority 0
set ospf interface eth1-04 passive on
set ospf area backbone off

Troubleshooting Firewalls

 

[Expert@myfw101:0]# ip route get 216.18.76.16
216.18.76.16 via 10.114.255.11 dev eth1-01 src 10.113.255.14 
[Expert@myfw101:0]#

fw ctl zdebug + drop | grep 216.18.76.16

@;20508118;[vs_0];[tid_30];[fw4_30];fw_log_drop_ex: Packet proto=17 216.18.76.16:53 -> 10.113.255.14:39926 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "fw-cluster Security" rule 19;

DNS Not active on Standby Cluster Member

fwha_forw_packet_to_not_active=1

Heres the SK in case you need it: 

https://support.checkpoint.com/results/sk/sk43807

enabled_blades
fw stat 
cpinfo -y all

In addition, if you would please upload a cpinfo from your gateway, as well as uploading a HCP report, this will help us to look for known issues in your environment
cpinfo -s 6-0003824777
hcp -r all --include-wts yes

Standby
nslookup google.com 
tcpdump -nni any host 216.18.76.16

Active 
tcpdump -nni any host 216.18.76.16 and host 10.14.55.14

set dns mode default
set dns suffix bcbsma.com
set dns primary 216.118.176.16
set dns secondary 10.115.1.11
set dns tertiary 10.23.210.23
[Expert@myfw101:0]#


142.250.65.238
tcpdump -nni any host 216.118.176.16 and host 10.114.255.14 | grep -i 'google'
fw monitor -F "10.114.255.14,0,216.118.176.16,0,0"
fw monitor -F "10.114.255.14,0,216.118.176.16,0,0" | grep -i 'google'

[Expert@myfw101:0]## cat /var/opt/fw.boot/modules/fwkern.conf
enhanced_ssl_inspection=1
bypass_on_enhanced_ssl_inspection=1
fwmultik_input_queue_len=4096
[Expert@myfw101:0]## 



 hcp -r all


[Expert@myfw101:0]# tcpdump -nni Sync host 216.18.76.16 and host 10.14.255.14 | grep -i 'google'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on Sync, link-type EN10MB (Ethernet), capture size 262144 bytes
15:07:27.015688 IP 10.14.255.14.40175 > 216.18.76.16.53: 8827+ A? google.com. (28)
15:07:34.015911 IP 10.14.255.14.40175 > 216.18.76.16.53: 8827+ A? google.com. (28)
15:07:41.016201 IP 10.14.255.14.40175 > 216.18.76.16.53: 8827+ A? google.com. (28)
^C1648 packets captured
1685 packets received by filter
0 packets dropped by kernel

[Expert@myfw101:0]## 

[Expert@myfw101:0]## fw ctl get int fwha_cluster_hide_active_only
fwha_cluster_hide_active_only = 1
[Expert@myfw101:0]#


[Expert@myfw101:0]# fw ctl get int fwha_cluster_hide_active_only
fwha_cluster_hide_active_only = 1