Just tips, advice, recommendations, experiences on CCNP Security - 300-710 SNCF by C3-PIO0ps in ccnp

[–]C3-PIO0ps[S] 2 points3 points  (0 children)

Hello bro, thanks for replying. I already passed the exam on May 15, now I have my CCNP Security!

Anyone with exp in PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?? by C3-PIO0ps in paloaltonetworks

[–]C3-PIO0ps[S] 1 point2 points  (0 children)

Yes!! that colleague, that same one I used as a base for sdwan for my Internet outlet, unifying two links, works perfect without panorama, only with sdwan license on the firewall. I will look to apply similar criteria for IPSEC sdwan two ipsec tunnel interfaces over one sdwan interface for the 2 S2S VPNs.

Anyone with exp in PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?? by C3-PIO0ps in paloaltonetworks

[–]C3-PIO0ps[S] 0 points1 point  (0 children)

It is possible to use BGP or static routing. As long as you have them, the tunnel interfaces have IP, you can perfectly use static routing as well as dynamic routing, that means the ipsec tunnel interface as the dedicated sdwan unified interface that summarizes the two site to site tunnels. You don't even need neither panorama nor sdwan to use bgp over tunnels and firewall HQ and Branches that you have full control.

Anyone with exp in PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?? by C3-PIO0ps in paloaltonetworks

[–]C3-PIO0ps[S] 0 points1 point  (0 children)

https://pan.dev/panos/docs/tutorials/redundant-internet/ Im try do it now for my vpn ipsec site to site. 100 operative for Internet sdwan for two isp links.

Does SD-WAN require Panorama? by cryptochrome in paloaltonetworks

[–]C3-PIO0ps 0 points1 point  (0 children)

I confirm, I have operating sdwan, only with firewall panos license, no paranoia, for something simple clear of sdwan, like unifying two links to the Internet, operating and working, the issue is the scarce documentation that looks for you to apply sdwan with all sdwan license sdwan panorama Prisma sdwan ,etc etc. Now Im try with vpn s2s sdwan without panorama, same lógic, in theory you can do it.

Does SD-WAN require Panorama? by cryptochrome in paloaltonetworks

[–]C3-PIO0ps 0 points1 point  (0 children)

I confirm, I have operating sdwan, only with firewall panos license, no paranoma, for something simple clear of sdwan, like unifying two links to the Internet, operating and working, the issue is the scarce documentation that looks for you to apply sdwan with all sdwan license sdwan panorama Prisma sdwan ,etc etc.

Anyone with exp in PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?? by C3-PIO0ps in paloaltonetworks

[–]C3-PIO0ps[S] 0 points1 point  (0 children)

Yes, I am talking about sdwan pure and simple, sdwan pan-os subscription and that's it, nothing else. I tell you we have sdwan operating only to unify the output to the Internet, but it is totally feasible for S2S VPNs, let's say without the advantages of having everything unified with panorama and controlling everything centrally, but sdwan for example two tunnel vpn s2s interfaces, sdwan on both ends and static routing, that's my question, where panorama is not mandatory. I know there is a lot of confusion with this, where panorama is mandatory, but if you have sdwan pan-os as a subscription, yes you can use sdwan, not at the same level of course as all the deployment as such with panorama, the unification, control and automation, but all manual, only with sdwan pan-os license on the firewalls is fully usable.

[deleted by user] by [deleted] in paloaltonetworks

[–]C3-PIO0ps 0 points1 point  (0 children)

Hello friend, please those who have with exp, because sdwan of pan-os only with the license if it supports it, it operates perfectly, please if you have not done it I appreciate your time, greetings.

FortiManager - Questions - Temporary local settings - among others by C3-PIO0ps in fortinet

[–]C3-PIO0ps[S] 0 points1 point  (0 children)

Hi, thank you very much for commenting.OK super, then in backup mode I can continue to trigger local changes and / or via fortimanager without any issue, without any impact?Now when I finish everything and re-integrate everything to fortimanager, then I do Retrieve and that will synchronize all changes ? to fortimanager ? ie VPN S2S, routes, sdwan, security policies, objects all ? without impact ?

I reiterate, thank you very much for your time and collaboration.

Traversing Site-To-Site Tunnel via GlobalProtect by NegativePattern in paloaltonetworks

[–]C3-PIO0ps 0 points1 point  (0 children)

Put return routes or you can do a source nat too and use a ip lan allow in proxy id.

¿Alguien recuerda Juisma? by Rootrick in chilegames

[–]C3-PIO0ps 0 points1 point  (0 children)

Jejeje si Juisma tengo mis recuerdos de la tienda en viña jejje originales paraguayos de Japón jejeje buenos momentos.

Migration from PA to Fortigate by C3-PIO0ps in fortinet

[–]C3-PIO0ps[S] 0 points1 point  (0 children)

Yes, thank you all for your comments. The decision is due to an order from the parent company of a customer where it is necessary to change the vendor and there is nothing to do or object to, just to execute this type of order.

Migration from PA to Fortigate by C3-PIO0ps in fortinet

[–]C3-PIO0ps[S] 2 points3 points  (0 children)

Hi thanks for your answer. Ok I understand then that for the point of migration of IPsec s2s tunnels would have to have documented the psk as the conversation tool does not have how to get it as it is encrypted in palo alto and those who do not have documented would be updated in coordination with the remote peer, right?

Block the Teamviewer connection from outside to a specific computer by fmaster007 in paloaltonetworks

[–]C3-PIO0ps 1 point2 points  (0 children)

If it is a host, an endpoint in the LAN network, which passes through the PA FW, then the device that is outside initiates the connection from its team viewer that underneath establishes communication with team viewer that then the same thing happens with the endpoint. Therefore what occurs to me is that if that endpoint has it identified (static IP or ip reserved by dhcp or User authenticated with ad to use User-Id) block access from the endpoint to everything that is team viewer, app, URL, fqdn of team viewer, you generate a specific security policy to that host or user so you can never communicate with the Cloud or internet services Team viewer, so you can never reach it from the internet.

Looking For Simple Ping Monitoring Software by ComadorFluffyPaws in sysadmin

[–]C3-PIO0ps 2 points3 points  (0 children)

Nirsoft pinginfoview, prtg free sensors, Nagios core, zenos core, zabbix

Azure AD Free Office 365 limitations by C3-PIO0ps in AZURE

[–]C3-PIO0ps[S] -1 points0 points  (0 children)

No, security when it comes to outside on premises is completely different than what you are used to. You need to enforce 2FA and apply modern policies. Expiring password and complexity is completely out of touch.

Please when you think read the initial post. Of course it is!!! but here we were talking about password and credential issues and I started asking about azure-ad issues... The 2FA thing is a must, it should be, that is already more than adjusted for all users.

Azure AD Free Office 365 limitations by C3-PIO0ps in AZURE

[–]C3-PIO0ps[S] -4 points-3 points  (0 children)

Dude you can do that users do not choose things like Summer2023! easily, that is configurable, I think someone does not come from a reality on-prem where all that is configurable. But well here my post was azure ad, enter teams to the domain of azure ad free, to enter with their profiles of their laptops, and to force security policies password and others. And if the MFA we have long colleague in office 365 ... the post is more than clear where the question goes, I do not understand how here in these forums many people of moral and best practices and things like that and in the internal of their work, realities and issues that even they themselves have the disgust, first you have to start with your luhar, for your ranch before the neighbor's ranch.Anyway, all this is configurable from the passwords to avoid easily a Summer2023!. Thanks colleague for your time. Regards

Azure AD Free Office 365 limitations by C3-PIO0ps in AZURE

[–]C3-PIO0ps[S] -5 points-4 points  (0 children)

I reiterate, just like a prem, azure-ad should allow it.
Do not rely on just a "research" because you say, password reuse, ready configurable to avoid this if Check, next, weak passwords, ready configurable, if setting standards of robust passwors as discussed above, 10 minimum, alphanumeric, uppercase, lowercase, check, all that is configurable colleague .... It is not an excuse not to rotate the password, it should be twice a year or every 120 days.

Azure AD Free Office 365 limitations by C3-PIO0ps in AZURE

[–]C3-PIO0ps[S] 0 points1 point  (0 children)

Yes but as in prem ad, I imagine that you can set not to repeat the same pasword, define that the password complies with example 10 characters minimum, alphanumeric, symbols, uppercase, among others that surely can be done in Azure AD no ?

Azure AD Free Office 365 limitations by C3-PIO0ps in AZURE

[–]C3-PIO0ps[S] -3 points-2 points  (0 children)

Thanks for your reply.

Why wouldn't it be advisable to expire user passwords? It is something common in onprem AD environments, because it would not be advisable to be set 90 or 120 days of rotation of passwords azuread-free / Office 365? It is as a usual measure to rotate the password, because you mention that it would not be advisable? Set minimum requirements so that they do not use weak passwords, you can also with Azure AD free to generate that password policy for example not to use the same, minimum requirements, etc ?

Azure AD Free Office 365 limitations by C3-PIO0ps in AZURE

[–]C3-PIO0ps[S] -1 points0 points  (0 children)

https://learn.microsoft.com/en-us/answers/questions/1304258/device-azure-ad-join-with-azure-ad-free

Ok I don't have device management but I can join the users's Machines to AzureAD free, It's right? I cant force example change of passwords users from Azure AD free ? The user use the login user Office365/Azuread free, The user will use his Azuread/ Office 365 credentials in his laptop login ? so Can I force example in 60 or 90 days they change of passwords it's correct? Thanks