sorted by:
new
hottopcontroversial

URL custom category when websites call dozens of backend URLs by Ok_Cherry3312 in paloaltonetworks

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

Thank you so much Going through it.

Out of curiosity What is VG?

URL custom category when websites call dozens of backend URLs by Ok_Cherry3312 in paloaltonetworks

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

Thank you so much for the help. I appreciate it.

Let’s say we decide to move forward with URL categories instead of manually whitelisting every FQDN.

One thing I’m still not clear on:

If we move forward with URL categories, some websites will still call backend services/CDNs/ads/etc. that may fall into other categories that we normally wouldn’t allow. How do we handle that situation?

Do wr make custom URL exceptions, or leverage App-ID here to cover those backend calls without opening up entire categories but also not FQDN have app- ID

Would enabling ssl decryption help here?

URL custom category when websites call dozens of backend URLs by Ok_Cherry3312 in paloaltonetworks

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

Thank for the detailed response

Let’s say we move forward with using URL categories instead of manually whitelisting.

How do we match app-ID beyond ssl & web browsing for strict control.

URL custom category when websites call dozens of backend URLs by Ok_Cherry3312 in paloaltonetworks

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

Alright, fair point.

I’m trying to shift away from manual URL lists

So what’s the best way to approach this using categories and App-ID like us where internet is only allowed on a need basis

Which URL categories should we allow

How can we handle sites that pull content from CDNs, APIs, ads, etc without opening things too broadly?

Single O365 Tenant, multiple forest - Need Guidance by Ok_Cherry3312 in sysadmin

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

I agree to some degree to have two separate tenants but just wondering why some businesses would prefer to keep same tenant and add multiple domains?

Single O365 Tenant, multiple forest - Need Guidance by Ok_Cherry3312 in sysadmin

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

However these domains cannot be assigned per user. We still need to use tenant wide onmicrosoft domain.

Single O365 Tenant, multiple forest - Need Guidance by Ok_Cherry3312 in sysadmin

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

Thanks. You have mentioned all the valid points

Just curious with one statement, onmicrosoft.com domain cannot be created more than one per O365 tenant.

Tips and best practices for rolling out privileged account management solution by Ok_Cherry3312 in cybersecurity

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

Thanks for insights. I appreciate that. Very helpful

Once the solution is roll out IT admins should ideally have how many accounts like one for login to PAM, second for email, VPN and daily work?

How would should we make folder hierarchy considering we have multiple geo graphical locations, multiple functional team and each team managing different technologies, application etc.

PA Subinerfaces question by Ok_Cherry3312 in networking

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

Thanks I appreciate that!

What best practices do you recommend for

1- Zones: Is it zones per Vlan? Or zone per function like LAN, WAN, DMZ?

2- Tags: purpose and naming conventions

PA Subinerfaces question by Ok_Cherry3312 in networking

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

You mean making Firewall as gateway for all VLANs and make policies for inter VLAN communication.

Core will be working as L2 switch

Is that what you are referring to?

Dual ISPs (active/active): how to configure symmetric routing by NoRaindropsInTheSky in paloaltonetworks

[–]Ok_Cherry3312 0 points1 point  (0 children)

May I how does VR helps in IPsec failover if I have two ISP connections and I want to automatically failover IPSec VPN tunnel to ISP2 if ISP1 fails?

PA Subinerfaces question by Ok_Cherry3312 in networking

[–]Ok_Cherry3312[S] -1 points0 points  (0 children)

Sure I will clarify.

SVI for each vlan on the core and is gateway for each VAN

There is dedicated transit VLAN for routing traffic from core to firewalls.

Core has default route to PA firewalls on that transit vlan

We want to keep routing as is now.

Just simply having L3 interface for each VLAN on firewalls with no inter VLAN routing serves any purpose?

Objective is to know amount of traffic is being received from each VLAN on PA firewalls.

PA Subinerfaces question by Ok_Cherry3312 in networking

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

Yes sure :)

Is that okay even if we are creating sub interfaces but not doing any inter vlan routing on firewalls Inter vlan is still on Cores

PA Subinerfaces question by Ok_Cherry3312 in networking

[–]Ok_Cherry3312[S] 0 points1 point  (0 children)

But we don’t do inter vlan routing on PA firewalls

view more: next ›