BLOG
CLI
et cli config-output-format setconfigureshow================================set cli config-output-format setset cli terminal width 500set cli scripting-mode onpaste your configcommit ====================show counter global filter delta yes CLI...
HA LACP limitation
Warning, only mid to high end models 3xxx, 5xxx ou 7xxx support prempt LACP en HA A/PThis means, that for example 820 in HA mode with LCAP link can take roughly up to 40seconds to failover due to LACP negotiation time with the switches...
Palo Alto User ID/group troubleshooting
show all user attributes : show user user-attributes user allDump domain to ID mappings : debug user-id dump domain-id-table domain allshow content of IDMGR : debug user-id dump idmgr type user all debug user-id reset user-id-manager type all Group Mappings:show user...
Default Master Key
in very old PANOS version the default Master Key = p1a2l3o4a5l6t7o8 Encryption = AES-256 This was later changed to AES CBC mode with salt = md5("pannetwork") = salt=b'\x75\xb8\x49\x83\x90\xbc\x2a\x65\x9c\x56\x93\xe7\xe5\xc5\xf0\x24' And now it has been changed to ???...
UserID Windows Agent from syslog flow
A good site to test the regex : https://regexr.com/ Event Regex: 'An account was successfully logged on.'Username Regex: 'Account Name: ([^-][a-zA-Z0-9-\._]+) ' ( this takes out the machines as they finish by $Address Regex: 'Source Network Address:...
Crack configuration passwords
By default the encryption method is a MD5 Salt encryption. (Same as old Linux easyily recognized by $1$AAA$BBB where AAA is the Salt and BBB is the hash).Therefor bruteforce is possible with tools like John or Hashcat (type 500).Only when it is a hardware device (no...