Quick note on troubleshooting password based Kerberos authentication on a Palo Alto Networks firewall

While endeavoring to test a Kerberos based authentication profile on a clients Palo Alto Networks I ran into a couple of error messages that need a little clarification.

To test the authentication I connected to the CLI on the firewall and issued the following command:

 test authentication authentication-profile client-test-1 username genesyswave password

This prompts me to enter my password and the firewall will then use either the management interface (default) or the configured service route interface for the authentication server type (LDAP, RADIUS, Kerberos or TACACS+).

In the first attempt I received the following ,message:

Failed to initialize KERBEROS auth context: Improper format of Kerberos configuration file

A quick search of the Internet returned results about the device not being properly joined to the realm, but that is not required for password based authentication to Kerberos on a Palo Alto Networks firewall. 

I then checked the authd.log for more specifics on the Kerberos configuration file 

pan_authd_create_krb5_config(pan_authd_shared_util.c:186): krb5 config:

[libdefaults]

    dns_lookup_kdc = false

    default_realm = DOMAIN.CLIENT.COM

[realms]

DOMAIN.CLIENT.COM = {

    kdc = 

    default_domain = pge

}

This indicates that there is a DNS name resolution issue with the firewall.  DNS was not configured on this particular firewall.  

DNS configuration was updated.

Tested the authentication again and received a different error message:

Authentication failure: KDC server at 'server-IP:88' is not reachable (code:-1765328228)

This message indicates a different issue. The firewall is unable to connect to the KDC servers. Either it is a routing issue or there is something preventing the connection from completing successfully.  In my client's case there is a Cisco firewall between the management interfaces an the Kerberos servers. After adding a rule to the other firewall, the authentication succeeded.

*Note - republished with corrected title, apologies for the gooft

Job Openings - Consultants and resident engineers

My employer is looking for a few qualified individuals
Do you love network security? (who doesn't)
Do you long to work with next generation firewalls? (who doesn't)
Do you long to rack  up airline miles and hotel points? (who doesn't)
Do you meet the qualifications below? If so, please send me you resume for review.

Key Points

·         Position is focused on becoming subject matter expert in the field of network security, specifically firewalls and VPN technologies.

·         Positions offers the ability to become an “industry expert” in the particular area of expertise this role supports.

·         Supporting customers small to large including Fortune 50 and some of the largest infrastructures in the United States.

·         Unique position allows for individuals to work with some of the best technologies on the market.

·         Offers ability to grow into a position to present at conferences and/or publish on subject matter expertise to and on behalf of our technology partners.

·         Unparalleled access to training on the subject matter areas.

·         Working with a seasoned team of subject matter experts with the ability to cross-train across products.

Position Description

·         Security consulting engineer with experience in consulting, design, and implementation working with enterprise customers.

·         Work with customer to install firewall products into their environments and customize reporting based upon customer needs.

·         Based upon identified business challenges, help define and develop a solution to solve using network analytic tools

·         Participate in the development of new product offerings using network analysis tools.

·         Become a subject matter expert in the technologies supported.

Requirements

·         Demonstrated consulting experience and soft skills working with medium-to-large customers in developing networking solutions to solve business problems.

·         Problem solving skills, both technical and business oriented when working with customers.

·         Extensive networking background in large or complex environments, comfortable with complex networking designs

·         Demonstrated strong experience level with firewalls such as Palo Alto Networks, Cisco, or Checkpoint etc.

·         Security certifications a plus – CISSP or vendor advanced security certifications

Travel – 75%+

Salary - Based upon experience

Health Benefits and 401K

Troubleshooting Dynamic Updates on Palo Alto Firewalls

The following are troubleshooting steps to take when installing a Palo Alto Firewall in Virtual Wire mode or doing an initial configuration behind the existing firewalls and the dynamic updates for Threat Protection, AntiVirus and URL Filtering are not pulling down updates.
After verifying that the device is licensed and registered for updates, it is time to verify that there is not a connectivity issue:
All of these are done from the command line, so either connect via SSH or via a console cable.

PAN updates
First thing to check is the connection from the Management interface to the Palo Alto Networks update site.
ping host updates.paloaltonetworks.com
This will show the basic connectivity is in place. Updates.paloaltonetworks.com will respond to ping if the path is good.
If that fails, another test is to see there are routing issues
traceroute host updates.paloaltonetworks.com
If this does not reach the first hop, verify that the management interface is configured with the correct default gateway.
After determining that base level connectivity exists for updates, the next step is to verify that it is possible to connect to the service port for udpates.
telnet port 443 host updates.paloaltonetworks.com
If this is good, then it is possible to manually request updates. If not it will be necessary to verify or update the configuration for the current firewalls.
Anti-Virus
request anti-virus upgrade download latest
or if in an High Availability pair
request anti-virus upgrade download latest sync-to-peer
Applications and content
request content upgrade download latest
or if in an High Availability pair
request content upgrade download latest sync-to-peer

If the firewall is licensed for the BrightCloud URL filtering updates, the testing is slightly different since the updates come from a different site and service port.
Start by verifying the basic connectivity
ping host service.brightcloud.com
Verify that the traffic is routing properly
traceroute host service.brightcloud.com
Verify that it is possible to connect to port 80 on service.brightcloud.com
telnet port 80 host service.brightcloud.com
If this is good, then it is possible to manually request updates. If not it will be necessary to verify or update the configuration for the current firewalls.
URL filtering
request an update of the URL Filtering database
request url-filtering upgrade brightcloud
verify that the download is in progress
request url-filtering download status
if there is still an issue the following should appear
{data time} Error: dtMessageTime(bcnet.cpp:256): failed connect to 64.87.3.54 on 80
When the download begins successfully, the following should appear\
{data time} URL database download: 90% done
When successful a message similar to the following will appear
369745418 total bytes 16.90 secs -79112.66 kB/S

Hopefully someone will find this useful
Be safe out there
James

Creating Palo Alto Reports at the Command Line

I have been working on creating reports on Palo Alto Firewalls from the command line.
For this scenario I have created two security policy rules for inbound and outbound. Now we want to get a weekly report that shows the top 50 applications that are flowing in each direction.

Either connect via the console port on the firewall or ssh:
Change to configuration mode:
configure

To configure the custom reports that will be used, the following syntax
set shared reports {name_of_report} period last-7-calendar-days topn 50 topm 10 query "rule eq "{rule_name}'" type traffic aggregate-by [ app from to ] values bytes sortby bytes

The text for the two custom reports would be:
set shared reports Inbound period last-7-calendar-days topn 50 topm 10 query "rule eq 'inbound_allow'" type traffic aggregate-by [ app from to ] values bytes sortby bytes
set shared reports Outbound period last-7-calendar-days topn 50 topm 10 query "rule eq 'outbound_allow'" type traffic aggregate-by [ app from to ] values bytes sortby bytes

Next set up the report group that will be used to assign the custom reports to the schedule:
set shared report-group {report_name} title-page no

The text for the custom report group
set shared report-group Weekly title-page no

Next add the custom reports to the report group
set shared report-group {report_name} custom-widget 1 custom-report {name_of_report}

The text for assigning the custom reports to the report
set shared report-group Weekly custom-widget 1 custom-report Inbound
set shared report-group Weekly custom-widget 2 custom-report Outbound

Next create the scheduler for the report
set shared email-scheduler {schedule_name} email-profile {email_profile} report-group {report_name} recurring weekly {day_of_week}

The text for creating the custom schedule:
set shared email-scheduler Weekly email-profile mail.example.com report-group Weekly recurring weekly monday

Don't forget to commit the configuration
commit

This process will generate a report that is delivered on Monday mornings to the email addresses that are configured for mail.example.com and will show the top 50 inbound and outbound applications by bytes. The report can then be used to narrow down what applications will be allowed inbound and outbound. The Palo Alto reporting features can also be used to identify what applications are being used by a particular service port to refine a security rule from using any application to specific applications.

Be safe out there.
James